Data Sharing (Government Sector) Act 2015

This Act is the Data Sharing (Government Sector) Act 2015.

This Act commences on the date of assent to this Act.

The objects of this Act are—

to promote, in a manner that recognises the protection of privacy as an integral component, the management and use of government sector data as a public resource that supports good Government policy making, program management and service planning and delivery, and

to remove barriers that impede the sharing of government sector data with the DAC or between other government sector agencies, and

to facilitate the expeditious sharing of government sector data with the DAC or between other government sector agencies, and

to provide protections in connection with data sharing under this Act by—

specifying the purposes for, and the circumstances in, which data sharing is permitted or required, and

ensuring that data sharing involving health information or personal information continues to be in compliance with the requirements of the privacy legislation concerning the collection, use, disclosure, protection, keeping, retention or disposal of such information, and

requiring compliance with data sharing safeguards in connection with data sharing.

In this Act—

control in relation to data—see subsection (2).

DAC means that part of the Department known as the Data Analytics Centre or such other government sector agency (or part of a government sector agency) as may be prescribed by the regulations.

data means any facts, statistics, instructions, concepts or other information in a form that is capable of being communicated, analysed or processed (whether by an individual or by a computer or other automated means).

data analytics work means the examination and analysis of data for the purpose of drawing conclusions about that data (including, for example, conclusions about the efficacy of Government policies, program management or service planning and delivery by government sector agencies).

data provider means the government sector agency that controls government sector data that is provided under this Act to a data recipient.

data recipient means the government sector agency to which government sector data is provided under this Act.

data sharing safeguards—see Part 3.

Department means the Department of Finance, Services and Innovation.

function includes a power, authority or duty, and exercise a function includes perform a duty.

government sector agency means each of the following—

the DAC,

a government sector agency within the meaning of the Government Sector Employment Act 2013,

a statutory body representing the Crown,

a council, county council or joint organisation within the meaning of the Local Government Act 1993,

a State owned corporation,

a body (whether incorporated or unincorporated) established or continued for a public purpose by or under the provisions of an Act or statutory instrument,

a wholly-owned subsidiary of the Crown in right of the State or an agency, council, corporation or other body referred to in paragraph (a), (b), (c), (d), (e) or (f),

a person or body exercising public official functions declared by the regulations to be a government sector agency for the purposes of this Act.

government sector data means any data that a government sector agency controls, but does not include data of a kind excluded by the regulations.

head of a government sector agency means—

in the case of a government sector agency within the meaning of the Government Sector Employment Act 2013—the head of the agency within the meaning of that Act, and

in the case of any other government sector agency—

the chief executive officer or other principal officer of the agency, or

any other person who is declared by the regulations to be the head of the agency for the purposes of this definition.

health information has the same meaning as in the Health Records and Information Privacy Act 2002.

personal information has the same meaning as in the Privacy and Personal Information Protection Act 1998.

Note—

Section 4A of the Privacy and Personal Information Protection Act 1998 excludes health information from the definition of personal information in section 4 of that Act.

privacy legislation means—

the Privacy and Personal Information Protection Act 1998 or the Health Records and Information Privacy Act 2002, and

any regulation or code of practice made, and any public interest directions or guidelines issued, under either of those Acts.

share, in relation to government sector data, means to provide (or be provided with) the data.

For the purposes of this Act, a person or body is taken to have control of data if—

the person or body has possession or custody of the data, or

the person or body has the data in the possession or custody of some other person or body.

A person or body is, for example, taken to have control of data held by the person or body in storage with a commercial storage provider (including a storage provider who provides cloud storage facilities).

Note—

The Interpretation Act 1987 contains definitions and other provisions that affect the interpretation and application of this Act.

Notes included in this Act do not form part of this Act.

Subject to subsection (2), a disclosure of government sector data by a government sector agency to the DAC or to another government sector agency is lawful for the purposes of any other Act or law that would otherwise operate to prohibit that disclosure (whether or not the prohibition is subject to specified qualifications or exceptions) if—

this Act provides that the agency is authorised to share the data with the DAC or other government sector agency, and

the agency provides the data to the data recipient only for the purpose to which the authorisation to share relates.

Nothing in this Act authorises, permits or requires the DAC or another government sector agency—

to collect, use, disclose, protect, keep, retain or dispose of any government sector data that is health information or personal information otherwise than in compliance with the privacy legislation, or

to disclose any government sector data that is—

excluded information of an agency specified in Schedule 2 to the Government Information (Public Access) Act 2009 (being any information that relates to any function specified in that Schedule in relation to the agency), or

information of a kind described in Schedule 1 to that Act, or

to deal with any government sector data to which the State Records Act 1998 applies after it is shared under this Act otherwise than in compliance with the State Records Act 1998.

This Act is not intended to prevent or discourage the sharing of government sector data by government sector agencies as permitted or required by or under any Act or other law (apart from this Act).

A government sector agency (other than the DAC) is, subject to section 5 (2), authorised to share government sector data that it controls with the DAC or with another government sector agency for any of the following purposes—

to enable data analytics work to be carried out on the data to identify issues and solutions regarding Government policy making, program management and service planning and delivery by the government sector agencies,

to enable related government sector agencies (such as branches, offices and other agencies within or otherwise related to a Public Service agency) to develop better Government policy making, program management and service planning and delivery by the agencies,

such other purposes as may be prescribed by the regulations.

If government sector data is shared under this section, the data provider and the data recipient must comply with all data sharing safeguards that are applicable to them in connection with the sharing.

The Minister may direct a government sector agency in writing to provide specified government sector data that it controls to the DAC within 14 days or such longer period specified in the direction, but only if the Premier has advised the Minister that the data concerned is required to be shared for the purpose of advancing a Government policy.

A copy of a direction given under this section must be provided to the head of the government sector agency to which the direction is given.

If a direction is given under this section—

the specified data provider is, subject to section 5 (2), authorised and required to provide the specified government sector data in compliance with the direction, and

the specified data provider and the DAC must comply with all data sharing safeguards that are applicable to them in connection with the sharing of the data.

The Premier may certify, in writing, that the Premier has advised the Minister that a specified provision of government sector data by a government sector agency is required for the purpose of advancing a Government policy. The certificate is conclusive evidence of the matter stated in the certificate.

The head of a government sector agency to which a direction is given under this section must ensure that the direction is complied with in accordance with subsection (3).

A direction cannot be given under this section to a government sector agency that is a university.

The Minister may direct a government sector agency in writing to provide the DAC with such information concerning the government sector data that it controls as the Minister may require so as to enable the DAC to determine the number and kinds of sets of data that the agency controls and the kind of information collected in those data sets.

A copy of a direction given under this section must be provided to the head of the government sector agency to which the direction is given.

The government sector agency is (subject to section 5 (2)) authorised and required to comply with a direction given to it under this section.

This section does not require a government sector agency to provide government sector data to the DAC.

Nothing in this section affects or limits the functions of the Privacy Commissioner under the privacy legislation.

The DAC is, subject to section 5 (2), authorised to share with government sector agencies the results of data analytics work that it has carried out on data provided to it by a government sector agency under this Act, but is not authorised to share that data with any other agency, person or body.

A direction may be given under this Part to a State owned corporation only if—

the direction is given with the approval of the Premier, and

where the portfolio Minister of the State owned corporation is neither the Premier nor the Minister administering this Act—the Minister administering this Act has consulted the portfolio Minister about the direction before it is given.

If the direction to provide the government sector data is given in circumstances where the board of the State owned corporation considers that it is not in the commercial interests of the State owned corporation to provide the data, a State owned corporation is entitled to be reimbursed for the activity of providing the data in accordance with the provisions of section 20N (3)–(5) of the State Owned Corporations Act 1989.

In this section—

portfolio Minister, in relation to a State owned corporation, has the same meaning as in the State Owned Corporations Act 1989.

This Part sets out the data sharing safeguards for the purposes of this Act that are applicable to the sharing of government sector data under this Act with the DAC or between other government sector agencies.

Without limiting section 5 (2), a data provider and data recipient must ensure that health information or personal information contained in government sector data that is shared is not collected, used, disclosed, protected, kept, retained or disposed of otherwise than in compliance with the privacy legislation.

If a data recipient that is provided with government sector data that contains health information or personal information becomes aware that the privacy legislation has been (or is likely to have been) contravened in relation to that information while in the recipient’s control, the data recipient must, as soon as is practicable after becoming aware of it, inform the data provider and the Privacy Commissioner of the contravention or likely contravention.