26Revocation of accreditation

26 Revocation of accreditation

Digital ID Regulator must revoke accreditation if Minister gives a direction to do so (1) The Digital ID Regulator must, in writing, revoke the accreditation of an accredited entity if the Minister gives a direction under subsection 27(1) to do so. Revocation on Digital ID Regulator’s own initiative (2) The Digital ID Regulator may, in writing, revoke an entity’s accreditation if: (a) the Digital ID Regulator reasonably believes that the accredited entity has contravened or is contravening this Act; or (b) the Digital ID Regulator reasonably believes that: (i) there has been a cyber security incident involving the entity; and (ii) the cyber security incident is serious; or (c) if the entity is a body corporate—the entity becomes a Chapter 5 body corporate (within the meaning of the Corporations Act 2001); or (d) the Digital ID Regulator is satisfied that it is not appropriate for the entity to be an accredited entity; or (e) circumstances specified in the Accreditation Rules apply in relation to the entity.

Note: The Digital ID Regulator may impose conditions on an entity’s accreditation before revoking it (see paragraph 17(4)(g)) and can give directions to give effect to a decision to revoke an entity’s accreditation (see paragraph 127(1)(b)).

(3) In determining whether the Digital ID Regulator is satisfied of the matter in paragraph (2)(d), regard may be had to whether the entity is a fit and proper person.

Note: In having regard to whether an entity is a fit and proper person, the Digital ID Regulator must have regard to any matters specified in the Digital ID Rules and may have regard to any other matters considered relevant (see section 12).

(4) Subsection (3) does not limit paragraph (2)(d). Revocation on application (5) The Digital ID Regulator must, on application by an entity, revoke the entity’s accreditation.

Note: See Part 5 of Chapter 9 for matters relating to applications.

Date of effect (6) The revocation takes effect on the day determined by the Digital ID Regulator. Approval must also be revoked (7) If: (a) an entity’s accreditation is revoked under subsection (1), (2) or (5); and (b) the entity holds an approval to participate in the Australian Government Digital ID System; the Digital ID Regulator must at the same time revoke the entity’s approval to participate as an accredited entity. Show cause notice must generally be given before decision to revoke (8) Before revoking the accreditation of an entity under subsection (2), the Digital ID Regulator must give a written notice (a show cause notice) to the entity. (9) The show cause notice must: (a) state the grounds on which the Digital ID Regulator proposes to revoke the entity’s accreditation; and (b) invite the entity to give the Digital ID Regulator, within 28 days after the day the notice is given, a written statement showing cause why the Digital ID Regulator should not revoke the accreditation. Exception—cyber security incident (10) Subsection (8) does not apply if the revocation is on a ground mentioned in paragraph (2)(b). Notice of revocation (11) If the Digital ID Regulator is to revoke an entity’s accreditation under subsection (1), (2) or (5), the Digital ID Regulator must give the entity a written notice stating the following: (a) that the entity’s accreditation is to be revoked; (b) if the entity is accredited as more than one kind of accredited entity—the accreditation that is to be revoked; (c) the reasons for the revocation; (d) the day the revocation is to take effect. Accreditation can be revoked even while suspended (12) Despite paragraph 25(11)(a), the Digital ID Regulator may revoke an entity’s accreditation under this section even if a suspension is in force under section 25 in relation to the entity.