Public Sector (Data Sharing) Act 2016

This Act may be cited as the Public Sector (Data Sharing) Act 2016.

This Act will come into operation on a day to be fixed by proclamation.

In this Act—

data means any facts, statistics, instructions, concepts or other information in a form that is capable of being communicated, analysed or processed (whether by an individual or by a computer or other automated means);

data analytics work means the examination and analysis of data for the purpose of drawing conclusions about that data (including, for example, conclusions about the efficacy of Government policies, program management or service planning and delivery by public sector agencies);

data provider means the public sector agency that controls public sector data that is provided to a data recipient under Part 3 or Part 4;

data recipient means the public sector agency to which public sector data is provided under Part 3 or Part 4;

de-identified—personal information is de-identified if the information is no longer about an identifiable individual or an individual who is reasonably identifiable;

exempt public sector data means—

public sector data held by a prescribed public sector agency; and

any other public sector data, or public sector data of a kind, prescribed by the regulations;

individual means a natural person (including a deceased person);

ODA—see section 6;

personal information means information or an opinion, including information or an opinion forming part of a database, whether true or not, and whether recorded in a material form or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion;

public sector agency has the same meaning as in the Public Sector Act 2009 but—

excludes a person or body prescribed by the regulations for the purposes of this definition; and

includes any other person or body prescribed by the regulations for the purposes of this definition;

public sector data means any data that a public sector agency controls;

trusted access principles—see section 7.

The regulations may provide that section 16(1) does not apply in relation to a person or body prescribed for the purposes of paragraph (b) of the definition of public sector agency in subsection (1).

If part of an existing public sector agency is designated as ODA under section 6, ODA is taken to be a public sector agency in its own right for the purposes of this Act.

The objects of this Act are—

to promote, in accordance with the trusted access principles and the data sharing safeguards, the management and use of public sector data as a public resource that supports good Government policy making, program management and service planning and delivery; and

to remove barriers that impede the sharing of public sector data between public sector agencies; and

to facilitate the expeditious sharing of public sector data between public sector agencies; and

to provide protections in connection with public sector data sharing under this Act by—

specifying the purposes for, and the circumstances in which, public sector data sharing is permitted or required; and

ensuring that public sector data held by public sector agencies shared under this Act continues to be protected from unauthorised use or disclosure; and

ensuring that data providers retain responsibility for the release of public sector data outside the public sector under the Freedom of Information Act 1991; and

requiring compliance with data sharing safeguards in connection with public sector data sharing; and

to provide for the Minister to enter into data sharing agreements with certain entities.

Subject to subsection (2), the provision of public sector data by a public sector agency to another public sector agency is lawful for the purposes of any other Act or law that would otherwise operate to prohibit that provision (whether or not the prohibition is subject to specified qualifications or exceptions) if—

this Act provides that the agency is authorised to provide the other public sector agency with the public sector data; and

the agency provides the public sector data to the data recipient only for the purpose to which the authorisation relates.

Nothing in this Act authorises, permits or requires a data recipient—

to use or disclose public sector data received under this Act for a purpose other than the purpose to which the authorisation to provide the data relates; or

to deal with any public sector data to which the State Records Act 1997 applies after it is provided under this Act otherwise than in compliance with the State Records Act 1997.

If a document (within the meaning of the Freedom of Information Act 1991) is provided by a data provider to a data recipient under this Act, despite the Freedom of Information Act 1991 the following provisions apply:

a person does not have a right to access the document under that Act from the data recipient and must not be given access to the document by the data recipient;

insofar as an application to the data recipient seeks access to the document under that Act—

the data recipient must refer the application to the data provider; and

the application is taken to be transferred to the data provider under section 16(1)(b) of that Act but the data recipient is not required to forward a copy of the document to the data provider under section 16(2) of that Act.

This Act is not intended to prevent or discourage the sharing of public sector data by public sector agencies if it is proper and reasonable to do so or if it is permitted or required by or under any other Act or law.

The Minister may, by notice in the Gazette, designate a public sector agency, or part of a public sector agency, as the Office for Data Analytics (ODA).

The functions of ODA are—

to undertake data analytics work on public sector data received from across the whole of Government; and

to make the results of that data analytics work available to public sector agencies, to the private sector and to the general public as ODA sees fit; and

to perform any other functions conferred on ODA by the Minister.

ODA is to undertake its functions in a manner that prioritises the provision of relevant and up to date information to public sector agencies about their service delivery, operations and performance.

ODA may, with the written approval of the Minister, direct a public sector agency to provide public sector data to ODA for the purposes of carrying out its functions.

The Minister must have regard to the trusted access principles before granting an approval under subsection (4).

The Minister may impose specified requirements or limitations on the power of ODA to make a direction under subsection (4).

ODA must comply with all relevant data sharing safeguards in respect of public sector data provided to it under this section.

The trusted access principles to be applied in respect of the sharing and use of public sector data under this Act are set out in this section.

Safe projects

The purpose for which data is proposed to be shared and used must be assessed as appropriate having regard to—

whether the data is necessary for the purpose; and

the proposed use of the data; and

whether the purpose for which data is proposed to be shared and used will be of value to the public; and

whether the public interest in the proposed sharing and use of data outweighs any contrary public interest; and

whether there is a risk of loss, harm or other detriment to the community if the sharing and use of the data does not occur.

Safe people

A proposed data recipient must be assessed as an appropriate public sector agency with whom data may be shared for a particular purpose having regard to—

whether the proposed data recipient is appropriately equipped and in possession of the relevant skills and experience to effectively use data for the proposed purpose; and

whether the proposed data recipient will restrict access to the data to specified persons with appropriate security clearance; and

whether the data provider will be able to engage with the data recipient to support the use of the data for the purpose; and

whether other persons or bodies in addition to the data recipient are invested in the outputs of the project and the motivations of those persons or bodies to be so invested.

Safe data

If data to be shared and used contains personal information, the personal information must be de‑identified unless—

the person to whom the personal information relates has consented to the sharing and use; or

the sharing and use of the personal information is reasonably related to the original purpose for which it was collected and there is no reason to think that the person to whom the information relates would object to the sharing and use; or

the sharing and use of the personal information is in connection with a criminal investigation or criminal proceedings or proceedings for the imposition of a penalty; or

the sharing and use of the personal information is in connection with the wellbeing, welfare or protection of a child or children or other vulnerable person; or

the sharing and use of the personal information is reasonably necessary to prevent or lessen a threat to the life, health or safety of a person; or

the purpose of the sharing and use of the personal information cannot be achieved through the use of de-identified data and it would be impracticable in the circumstances to seek the consent of the person to whom the information relates; or

the sharing and use of the personal information is for a prescribed purpose or occurs in prescribed circumstances;

Data to be shared and used for a purpose must be assessed as appropriate for that purpose having regard to—

whether the data is of the necessary quality for the proposed use (such as being accurate, relevant and timely); and

whether the data relates to people; and

if data containing personal information is to be de‑identified, how that de‑identification will be undertaken and whether the data may be re‑identified, and if so, how it may be re‑identified.

Safe settings

The environments in which the data will be stored, accessed and used must be assessed as appropriate having regard to—

the physical location where the data will be stored and used; and

the location of any linked data sets; and

whether the proposed data recipient has appropriate security and technical safeguards in place to ensure data remains secure and not subject to unauthorised access and use (such as secure login, user authentication, encryption and supervision or surveillance); and

the likelihood of deliberate or accidental disclosure or use occurring; and

how the data will be dealt with after it has been used for the purpose for which it is shared.

Safe outputs

The publication or other disclosure of the results of data analytics work conducted on data shared under this Act must be assessed as appropriate having regard to—

the nature of the proposed publication or disclosure; and

who is the likely audience of the publication or disclosure; and

the likelihood and extent to which the publication or disclosure may contribute to the identification of a person to whom the data relates; and

whether the results of the data analytics work or other data for publication or disclosure will be audited and whether that process involves the data provider.

Prescribed trusted access principles

The regulations may prescribe any additional requirements or principles relating to the safe and secure sharing and use of data for the purposes of the definition of the trusted access principles (and any such additional requirements or principles may relate to the same subject matters as the trusted access principles already set out in this section).

Subject to this Act, a public sector agency is authorised to provide public sector data, other than exempt public sector data, that it controls to other public sector agencies for any of the following purposes:

to enable data analytics work to be carried out on the data to identify issues and solutions regarding Government policy making, program management and service planning and delivery by public sector agencies;

to enable public sector agencies to facilitate, develop, improve and undertake Government policy making, program management and service planning and delivery by the agencies;

such other purposes as may be prescribed by the regulations.

Before public sector data is provided to a public sector agency under subsection (1)—

the public sector agency must make a written record of the purpose or purposes for which the public sector data is proposed to be provided and used as agreed with the public sector agency that is to provide the data; and

the public sector agency that is to provide the data must apply the trusted access principles and be satisfied that the provision and use of the data is appropriate in all the circumstances.

A public sector agency must, on being satisfied that the sharing and use of data is appropriate under subsection (2), provide the data to the data recipient as soon as is reasonably practicable.

If public sector data is provided under this section, the data provider and the data recipient must comply with all relevant data sharing safeguards.

The Minister may direct a public sector agency to provide public sector data that it controls, including exempt public sector data, to another public sector agency for any of the purposes referred to in section 8(1).

A direction of the Minister under subsection (1)—

authorises the public sector agency specified in the direction to provide public sector data in accordance with the direction; and

is binding according to its terms on each public sector agency referred to in the direction; and

must, in relation to the provision of public sector data, specify—

the nature and extent of the public sector data to be provided; and

the purposes for which the public sector data is to be provided.

The Minister must, before making a direction under this section in relation to public sector data, have regard to the trusted access principles and be satisfied that the sharing and use of the data is appropriate in all the circumstances.

A public sector agency must, on being directed to provide data under subsection (1), provide the data to the data recipient as soon as is reasonably practicable.

If public sector data is provided under this section, the data provider and the data recipient must comply with all relevant data sharing safeguards.

The Minister must—

as soon as practicable after making a direction under subsection (1), cause notice of the direction to be published in the Gazette; and

within 6 sitting days of making a direction under subsection (1), cause notice of the direction to be laid before each House of Parliament.

A notice under subsection (6) must specify the data provider, the data recipient and the general nature of the public sector data to which the direction relates.

A data recipient that receives public sector data containing confidential or commercially sensitive information under Part 3 or Part 4 must ensure that the confidential or commercially sensitive information is dealt with in a way that complies with any contractual or equitable obligations of the data provider concerning how it is to be dealt with.

In this section—

confidential or commercially sensitive information means—

information a person or body controls that the person or body is required to keep confidential because of a contractual or equitable obligation; or

any other information the disclosure of which would prejudice any person's legitimate business, commercial, professional or financial interests.

A data provider and data recipient must ensure that public sector data provided under Part 3 or Part 4 is maintained and managed in compliance with any legal requirements concerning its custody and control (including, for example, requirements under the State Records Act 1997) that are applicable to them.

If a data recipient arranges for a person or body (other than another public sector agency) to conduct data analytics work using public sector data with which it has been provided, the data recipient must ensure that appropriate contractual arrangements are in place before the public sector data is provided to ensure that the person or body deals with the data in compliance with any requirements of this Act, the State Records Act 1997 and any data security policies that are applicable to the data recipient.

A data provider and data recipient must comply with such other requirements as may be prescribed by the regulations in connection with the provision and receipt of public sector data under Part 3 or Part 4.