15Digital ID Regulator must decide whether to accredit an entity

15 Digital ID Regulator must decide whether to accredit an entity

(1) This section applies if an entity has made an application under section 14 for accreditation as an accredited entity. (2) The Digital ID Regulator must decide: (a) to accredit the entity; or (b) to refuse to accredit the entity. (3) The Digital ID Regulator must not accredit an entity: (a) as an accredited attribute service provider unless the entity provides, or will provide, some or all of the services described in the definition of attribute service provider; or (b) as an accredited identity exchange provider unless the entity provides, or will provide, some or all of the services described in the definition of identity exchange provider; or (c) as an accredited identity service provider unless the entity provides, or will provide, some or all of the services described in the definition of identity service provider; or (d) if Accreditation Rules made for the purposes of paragraph 14(1)(d) prescribe services—as an entity that provides services of the kind prescribed unless the entity provides, or will provide, some or all of the services of that kind. (4) The Digital ID Regulator must not accredit an entity if: (a) a direction under subsection 27(1) (about security) directing the Digital ID Regulator to refuse to accredit the entity is in force; or (b) the Digital ID Regulator is not satisfied that the entity is able to comply with this Act; or (c) Accreditation Rules made for the purposes of section 28 require specified criteria to be met and the entity does not meet the criteria; or (d) Accreditation Rules made for the purposes of section 28 require the Digital ID Regulator to be satisfied of specified matters and the Digital ID Regulator is not satisfied of those matters. (5) In deciding whether to accredit the entity, the Digital ID Regulator: (a) must have regard to the matters (if any) prescribed by the Accreditation Rules; and (b) may have regard to the following: (i) whether the entity is a fit and proper person; (ii) any other matters the Digital ID Regulator considers relevant.

Note: In having regard to whether an entity is a fit and proper person for the purposes of subparagraph (b)(i), the Digital ID Regulator must have regard to any matters specified in the Digital ID Rules and may have regard to any other matters considered relevant (see section 12).

(6) The Digital ID Regulator must: (a) give written notice of a decision to accredit, or to refuse to accredit, the entity; and (b) if the decision is to refuse to accredit the entity—give reasons for the decision to the entity. (7) If the Digital ID Regulator decides to accredit the entity, the notice must also set out the following: (a) the kind or kinds of accredited entity that the entity is accredited as; (b) the day the accreditation comes into force; (c) any conditions imposed on the entity’s accreditation under subsection 17(2).