Cybersecurity Act · 2024 Revised Edition · Part · Critical Information Infrastructure
19. Appeal to Minister
Official textFrom Attorney General's Chambers, unchanged
The owner of a critical information infrastructure who is aggrieved by —
owner
“owner”, in relation to a critical information infrastructure, means the legal owner of the critical information infrastructure and, where the critical information infrastructure is jointly owned by more than one person, includes every joint owner;
the decision of the Commissioner to issue the notice under section 9(1) designating the critical information infrastructure as such;
a written direction of the Commissioner under section 14
or 18(2); or
any provision in any code of practice or standard of performance issued or approved by the Commissioner that applies to the owner, or any amendment made to it, may appeal to the Minister against the decision, direction, provision or amendment in the manner prescribed.
An appeal under subsection (1) shall be made within 30 days after the date of the notice or direction, or the issue, approval or amendment
(as the case may be) of the code of practice or standard of performance, as the case may be, or such longer period as the Minister allows in a particular case (whether allowed before or after the end of the 30 days).
code of practice
“code of practice” means any code of practice issued or approved under section 13(1);
Any person who makes an appeal to the Minister under subsection (1) shall, within the period specified in subsection (2) —
Cybersecurity 27
cybersecurity
“cybersecurity” means the state in which a computer or computer system is protected from unauthorised access or attack, and because of that state — (a) the computer or computer system continues to be available and operational; (b) the integrity of the computer or computer system is maintained; and (c) the integrity and confidentiality of information stored in, processed by or transmitted through the computer or computer system is maintained;
state as concisely as possible the circumstances under which the appeal arises, and the issues and grounds for the appeal; and
submit to the Minister all relevant facts, evidence and arguments for the appeal.
Where an appeal has been made to the Minister under subsection (1), the Minister may require —
any party to the appeal; and
any person who is not a party to the appeal but appears to the
Minister to have information that is relevant to the matters appealed against, to provide the Minister with all such information as the Minister may require, whether for the purpose of deciding if an Appeals Advisory Panel should be established or for determining the appeal, and any person so required shall provide the information in such manner and within such period as may be specified by the Minister.
The Minister may dismiss an appeal of an appellant who fails to comply with subsection (3) or (4).
Unless otherwise provided by this Act or allowed by the Minister, where an appeal is lodged under this section, the decision, direction or other thing appealed against shall be complied with until the determination of the appeal.
The Minister may determine an appeal under this section —
by confirming, varying or reversing a decision, notice, direction, provision of a code of practice or standard of performance, or an amendment to such code or standard; or
by directing the
Commissioner to reconsider the
Commissioner’s decision, notice, direction, or provision of a code of practice or standard of performance, as the case may be.
Before determining an appeal under subsection (7), the Minister may consult any Appeals Advisory Panel established for the purpose of advising the Minister in respect of the appeal but, in making such determination, is not bound by the advice of the Panel.
Cybersecurity 28
The decision of the Minister in any appeal is final.
Terms defined in s 2
code of practice
Defined · s 2“code of practice” means any code of practice issued or approved under section 13(1);
Commissioner
Defined · s 2“Commissioner” means the Commissioner of Cybersecurity appointed under section 5(1);
critical information infrastructure
Defined · s 2“critical information infrastructure” means a computer or a computer system in respect of which a designation under section 9(1) is in effect;
cybersecurity
Defined · s 2“cybersecurity” means the state in which a computer or computer system is protected from unauthorised access or attack, and because of that state — (a) the computer or computer system continues to be available and operational; (b) the integrity of the computer or computer system is maintained; and (c) the integrity and confidentiality of information stored in, processed by or transmitted through the computer or computer system is maintained;
owner
Defined · s 2“owner”, in relation to a critical information infrastructure, means the legal owner of the critical information infrastructure and, where the critical information infrastructure is jointly owned by more than one person, includes every joint owner;
standard of performance
Defined · s 2“standard of performance” means any standard of performance issued or approved under section 13(1).
Part
Responses to Cybersecurity Threats and Incidents
Part