Commonwealth Consolidated Acts

DATA AVAILABILITY AND TRANSPARENCY ACT 2022 - SECT 16B

If data sharing purpose is delivery of government services

  (1)   If the data sharing purpose of the project is delivery of government services, the data must not include personal information about an individual unless:

  (a)   one or more of the following apply:

  (i)   the service being delivered is a service mentioned in paragraph   15(1A)(a) or (b) and is delivered to the individual;

  (ii)   the individual consents to the sharing of their personal information;

  (iii)   the sharing would be a disclosure authorised under Part   VIA of the Privacy Act 1988 (dealing with personal information in emergencies and disasters); and

  (b)   the service being delivered is identified in the data sharing agreement for the project; and

  (c)   only the minimum amount of personal information necessary to properly deliver the service is shared.

  (2)   If data that includes personal information is to be shared with an accredited user in circumstances in which the shared data exits the data sharing scheme under subsection   20E(4), the data sharing agreement must specify this.

If data sharing purpose is informing government policy and programs or research and development

  (3)   If the data sharing purpose of the project is informing government policy and programs, or research and development, the data must not include personal information about an individual unless:

  (a)   both of the following apply:

  (i)   the individual consents to the sharing of their personal information;

  (ii)   only the minimum amount of personal information necessary for the project to proceed is shared; or

  (b)   all of the following apply:

  (i)   the project cannot proceed without the personal information;

  (ii)   the public interest served by the project justifies the sharing of personal information about individuals without their consent;

  (iii)   only the minimum amount of personal information necessary for the project to proceed is shared;

  (iv)   a permitted circumstance for the project's data sharing purpose exists (see subsections   (4) and (5)).

  (4)   The permitted circumstances for the data sharing purpose of informing government policy and programs are the following:

  (a)   it is unreasonable or impracticable to seek the individual's consent;

  (b)   the data is to be collected and used in the course of medical research and in accordance with guidelines under subsection   95(1) of the Privacy Act 1988 ;

  (c)   the sharing is with an ADSP as an intermediary, to enable the ADSP to prepare ADSP - enhanced data that does not involve personal information about the individual;

  (d)   the sharing is ADSP - controlled access (see subsection   (6));

  (e)   the accredited user is a Commonwealth body (other than a Commonwealth body excluded from this paragraph by the rules) and the final output of the project includes only de - identified information;

  (f)   the sharing is a disclosure authorised under Part   VIA of the Privacy Act 1988 (dealing with personal information in emergencies and disasters).

Note:   It is not unreasonable or impracticable to seek an individual's consent merely because the consent of a very large number of individuals needs to be sought. The Commissioner is also required to make a data code dealing with this matter.

  (5)   The permitted circumstances for the data sharing purpose of research and development are the circumstances mentioned in paragraphs   (4)(a) to (d).

  (6)   Sharing is ADSP - controlled access if:

  (a)   an ADSP is sharing the data on behalf of the data custodian with an accredited user; and

  (b)   the data is shared by means of the ADSP providing access to the data:

  (i)   by use of systems controlled by the ADSP; and

  (ii)   to particular identified designated individuals for the entity, each of whom has appropriate experience, qualifications or training; and

  (c)   the ADSP has implemented controls to prevent or minimise the risk of the data being used to identify individuals.

  (7)   If the data custodian of the data being shared concludes that, in relation to the sharing of personal information under the agreement for the purpose of informing government policy and programs, or research and development, the circumstance mentioned in paragraph   (4)(a) exists (unreasonable or impracticable to seek individual's consent), the agreement must include:

  (a)   a statement that personal information is being shared without consent of individuals because it is unreasonable or impracticable to seek their consent; and

  (b)   an explanation of the data custodian's reasons for so concluding.

  (8)   If personal information about an individual is to be shared without the consent of the individual for the data sharing purpose of informing government policy and programs, or research and development, the data sharing agreement must include a statement setting out why sharing the personal information is consistent with this section.