72Revocation of approval to participate in the Australian Government Digital ID System

72 Revocation of approval to participate in the Australian Government Digital ID System

Digital ID Regulator must revoke approval if Minister gives a direction to do so (1) The Digital ID Regulator must, in writing, revoke an approval given to an entity under section 62 if the Minister gives a direction under subsection 73(1) to do so. Digital ID Regulator may revoke approval (2) The Digital ID Regulator may, in writing, revoke an approval given to an entity under section 62 if: (a) the Digital ID Regulator reasonably believes that the entity has contravened or is contravening this Act; or (b) the Digital ID Regulator reasonably believes that: (i) there has been a cyber security incident involving the entity; and (ii) the cyber security incident is serious; or (c) if the entity is a body corporate—the entity is a Chapter 5 body corporate (within the meaning of the Corporations Act 2001); or (d) if the entity is an individual—the entity is an insolvent under administration; or (e) the Digital ID Regulator is satisfied that it is not appropriate for the entity to participate in the Australian Government Digital ID System; or (f) circumstances specified in the Digital ID Rules apply in relation to the entity.

Note: The Digital ID Regulator may impose conditions on an entity’s approval before revoking it (see paragraph 64(4)(g)).

(3) In determining whether the Digital ID Regulator is satisfied of the matter in paragraph (2)(e), regard may be had to whether the entity is a fit and proper person.

Note: In having regard to whether an entity is a fit and proper person, the Digital ID Regulator must have regard to any matters specified in the Digital ID Rules and may have regard to any other matters considered relevant (see section 12).

(4) Subsection (3) does not limit paragraph (2)(e). Revocation on application (5) The Digital ID Regulator must, on application by an entity, revoke an approval given to the entity under section 62. The revocation takes effect on the day determined by the Digital ID Regulator.

Note: See Part 5 of Chapter 9 for matters relating to applications.

Show cause notice must generally be given before decision to revoke (6) Before revoking the approval of an entity under subsection (2), the Digital ID Regulator must give a written notice (a show cause notice) to the entity. (7) The show cause notice must: (a) state the grounds on which the Digital ID Regulator proposes to revoke the entity’s approval; and (b) invite the entity to give the Digital ID Regulator, within 28 days after the day the notice is given, a written statement showing cause why the Digital ID Regulator should not revoke the approval. Notice of revocation (8) If the Digital ID Regulator is to revoke an entity’s approval under subsection (1), (2) or (5), the Digital ID Regulator must give the entity a written notice stating the following: (a) that the entity’s approval to participate in the Australian Government Digital ID System is to be revoked; (b) the reasons for the revocation; (c) the day the revocation is to take effect.