25Suspension of accreditation

25 Suspension of accreditation

Digital ID Regulator must suspend accreditation if Minister’s direction about suspension is in force (1) The Digital ID Regulator must, in writing, suspend the accreditation of an accredited entity if a direction under subsection 27(1) directing the Digital ID Regulator to do so is in force in relation to the entity. Digital ID Regulator may decide to suspend accreditation in other circumstances (2) The Digital ID Regulator may, in writing, suspend the accreditation of an accredited entity if: (a) the Digital ID Regulator reasonably believes that the accredited entity has contravened or is contravening this Act; or (b) the Digital ID Regulator reasonably believes that there has been a cyber security incident involving the entity; or (c) the Digital ID Regulator reasonably believes that a cyber security incident involving the entity is imminent; or (d) if the entity is a body corporate—the entity becomes a Chapter 5 body corporate (within the meaning of the Corporations Act 2001); or (e) the Digital ID Regulator is satisfied that it is not appropriate for the entity to be an accredited entity; or (f) circumstances specified in the Accreditation Rules apply in relation to the entity.

Note: The Digital ID Regulator may impose conditions on an entity’s accreditation before suspending it (see paragraph 17(4)(g)) and can give directions to give effect to a decision to suspend an entity’s accreditation (see paragraph 127(1)(b)).

(3) The reference to cyber security incident in paragraph (2)(b) does not include acts, events or circumstances covered by paragraph (b) or (d) of the definition of that term unless the Digital ID Regulator is satisfied that the attempts referred to in those paragraphs involve an unacceptable risk to the provision of the entity’s accredited services. (4) In determining whether the Digital ID Regulator is satisfied of the matter in paragraph (2)(e), regard may be had to whether the entity is a fit and proper person.

Note: In having regard to whether an entity is a fit and proper person, the Digital ID Regulator must have regard to any matters specified in the Digital ID Rules and may have regard to any other matters considered relevant (see section 12).

(5) Subsection (4) does not limit paragraph (2)(e). Digital ID Regulator may suspend accreditation on application (6) The Digital ID Regulator may, on application by an accredited entity, suspend the accreditation of the entity.

Note: See Part 5 of Chapter 9 for matters relating to applications.

Show cause notice must generally be given before decision to suspend (7) Before suspending the accreditation of an entity under subsection (2), the Digital ID Regulator must give a written notice (a show cause notice) to the entity. (8) The show cause notice must: (a) state the grounds on which the Digital ID Regulator proposes to suspend the entity’s accreditation; and (b) invite the entity to give the Digital ID Regulator, within 28 days after the day the notice is given, a written statement showing cause why the Digital ID Regulator should not suspend the accreditation. Exception—cyber security incident (9) Subsection (7) does not apply if the suspension is on a ground mentioned in paragraph (2)(b) or (c). Notice of suspension (10) If the Digital ID Regulator suspends an entity’s accreditation under subsection (1), (2) or (6), the Digital ID Regulator must give the entity a written notice stating the following: (a) that the entity’s accreditation is suspended; (b) if the entity is accredited as more than one kind of accredited entity—the accreditation that is suspended; (c) the reasons for the suspension; (d) the day the suspension is to start; (e) if the accreditation is suspended for a period—the period of the suspension; (f) if the accreditation is suspended until a specified event occurs or action is taken—the event or action. Effect of suspension (11) If an entity’s accreditation is suspended under this section: (a) the entity is taken not to be accredited while the suspension is in force; and (b) if the entity holds an approval to participate in the Australian Government Digital ID System as an accredited entity—the entity is taken not to hold that approval while the entity’s accreditation is suspended. Revocation of suspension (12) If the Digital ID Regulator suspends an entity’s accreditation under subsection (2), the Regulator may revoke the suspension by written notice to the entity. (13) If the Digital ID Regulator suspends an entity’s accreditation under subsection (6), the Regulator must revoke the suspension by written notice to the entity if the entity requests the suspension be revoked. (14) A notice given under subsection (12) or (13) must specify the day the revocation takes effect.