Public sector data becomes accessible under the new Data Availability and Transparency Act 2022

Accreditation: Who can share data?

Under the scheme there are two kinds of scheme entities:

1. Data custodians – Commonwealth bodies (that are not an excluded entity e.g. Australia Government law enforcement and intelligence agencies) that control public sector data; and
2. Accredited entities – Australian entities (Commonwealth, States, Territory, or a body of such, or an Australian university) granted accreditation as either an ‘accredited user’ who can collect and use shared data or an Accredited Data Service Provider (ADSP) who are expert intermediaries that can assist data custodians to prepare and share data appropriately.

Foreign entities, private entities (bodies corporate), individuals and unincorporated bodies (e.g. partnerships and trusts) are unable to participate in the scheme, effectively leaving only Commonwealth, state and territory government agencies and public Australian universities able to become accredited users. Commonwealth, state and territory government agencies can apply for accreditation from 1 June 2022, while Australian universities can apply from 1 August 2022.²

The Commissioner or Minister are responsible for assessing an entity’s capability to handle data safety and manage risks against the accreditation criteria before deciding whether to grant the accreditation. Administrative measures can also be taken to impose conditions on accreditation of an entity, and the Commissioner and Minister can suspend or cancel the accreditation of an entity if:³

• They are reasonably satisfied that the data scheme entity doesn’t meet the accreditation criteria;
• The data scheme entity becomes a body corporate;
• For accreditation of a government body as an ADSP – the Minister refuses to accredit or suspends or cancels the accreditation of the entity as an accredited user;
• For accreditation as an accredited user – the Commissioner suspends or cancels the entity’s accreditation as an ADSP;
• They determine it is in the national interest; or
• For security reasons, including on the basis of an adverse or qualified security assessment.

Data scheme entities are responsible for a number of general duties set out in Chapter 3 of the Act, including the requirement to comply with any rules made by the Minister or data codes released by the Commissioner, complying with the conditions of their accreditation, registering data sharing agreements and mitigating and notifying data breaches. Commonwealth entities should also note that as data custodians they are not required to share public sector data, but they must consider the request to provide the data within a reasonable period and must give written notice with the reasons for refusal within 28 days of deciding to refuse a request.⁴

Authorisations: What data can be shared?

Under the scheme, authorisations set out requirements for each stage of a data sharing project to ensure the sharing is fit for purpose.

Data sharing must be part of a project that is:

1. for a data sharing purpose;
2. follows the data sharing principles; and
3. under a registered data sharing agreement.⁵

The data sharing purposes include:

• Delivery of government services (excluding enforcement related purposes and purposes relating to national security);
• Informing government policy and programs; and
• Research and development.

The data sharing principles include:

• Project principle – the project is an appropriate project or program of work, including that the project can reasonably be expected to serve the public interest and the parties observe processes relating to ethics as appropriate;
• People principle – data is made available only to appropriate persons, including people with appropriate attributes, qualifications, affiliations and experience;
• Setting principle – data is shared, collected and used in an appropriately controlled environment, including reasonable security standards having regard to the sensitivity of the data;
• Data principle – appropriate protections are applied to the data and only data reasonably necessary for the data sharing purposes can be shared;
• Output principle – the only output of the project is the final output, or output the creation of which is reasonably necessary or incidental to the creation of the final output.

A data sharing agreement is required to include certain information such as the parties to the agreement (being a minimum of one data custodian and one accredited user), a description of the project and data to be shared, details of the output of the project, the applicable data sharing purposes and an explanation of the project’s consistency with the data sharing principles. If an ADSP will be involved in the data sharing, then the agreement must specify the services it will perform and the circumstances in which it can share the data. The Commissioner has released a draft data sharing agreement template for general use, but this is not tied to the Act and is not an approved form (available here).

Liability and penalties in relation to authorisations

Under the Act, it is a civil penalty provision for an entity or individual to share, use or collect data that is not authorised, with a penalty up to 300 penalty units ($66,600).⁶ Unauthorised sharing, use or collection of data that is reckless is an offence with a maximum penalty of 5 years imprisonment or 300 penalty units, or both.

Generally, entities are liable for the conduct of their employees, officers and agents (i.e. ‘designated individuals’) and bodies corporate party to an ‘approved contract’ with the entity (i.e. a contract authorised under the data sharing agreement).⁷ The Act clarifies that the Commonwealth cannot be prosecuted for criminal offences, but can be liable to pay pecuniary penalties under civil penalty orders.⁸

Government entities are protected from contravening a civil penalty provision if they took reasonable precautions and exercised due diligence to avoid the contravening conduct (e.g. training designated individuals, ensuring policies are clear and available, etc.). Further, individuals whose conduct is attributed to a government entity will not be personally liable for contravening a civil penalty provision, including an ancillary contravention.⁹ However, these protections do not extend to criminal offences under the Act.

Privacy protections

Generally, personal information should not be shared under the scheme unless an exception applies and it is necessary that the personal information be shared.

There are three general privacy protections including:

• a prohibition on the sharing of biometric data without express consent;
• a prohibition on storing or accessing, or providing access to output outside of Australia. If an ADSP is involved then they are prohibited from storing or accessing, or providing access to ADSP-enhanced data outside of Australia; and
• where de-identified data is shared instead of personal information, a prohibition on re-identification of that de-identified data.¹⁰

Enforcement framework

If a data scheme entity breaches the Act or a data sharing agreement, another entity can complain to the Commissioner, who will investigate the complaint which may lead to enforcement action being taken. The Commissioner can also assess whether data scheme entities are operating in accordance with the Act, and if they reasonably suspect a breach of the Act or a data sharing agreement they may investigate the entity without a complaint being made. The Minister can also direct the Commissioner to investigate a data scheme entity.

The Commissioner has other enforcement powers including, requiring persons to provide information, certain monitoring and investigation powers, and transferring matters to a more appropriate agency (including the police).

The enforcement options available to the Commissioner under the Act, include:

• making recommendations to a data scheme entity following an assessment or investigation of that entity;
• giving data scheme entities directions to take or not take specified actions in specific circumstances;
• issuing an infringement notice or applying to a court for a pecuniary penalty order if the Commissioner determines that a data scheme entity has contravened a civil penalty provision;
• accepting an enforceable undertaking in relation to the Act; and
• applying to a court for an injunction if a data scheme entity contravenes, or proposes to contravene, a civil penalty provision or provision of Chapter 3 (responsibilities of data scheme entities).

Next steps

As of 1 June 2022, government agencies can start applying to become accredited entities and the requests for data sharing projects will start kicking off. Commonwealth bodies should start thinking about how they will provide access to public sector data and whether they will require the assistance of ADSPs. This Act also creates opportunities for Commonwealth agencies to consider what data they would benefit from having access to and potential data sharing projects they may want to seek out.