{"id":"victorian-data-sharing-act-2017","name":"Victorian Data Sharing Act 2017","slug":"victorian-data-sharing-act-2017","collection":"act","jurisdiction":"vic","status":"in_force","isInForce":true,"actNumber":null,"makingDate":null,"administeringDepartment":null,"currentVersion":{"id":174064,"registerId":"vic-victorian-data-sharing-act-2017-current","compilationNumber":null,"startDate":"2026-04-05","status":"InForce","reasons":null,"registeredAt":null},"sections":[{"sectionNumber":"1","sectionType":"section","heading":"Victorian Data Sharing Act 2017","content":"Version No. 002\n\n**Victorian Data Sharing Act 2017**\n\n**No. 60 of 2017**\n\nVersion incorporating amendments as at  \n6 December 2018\n\n**TABLE OF PROVISIONS**\n\n*Section Page*\n\nPart 1—Preliminary 1\n\n1 Purposes 1\n\n2 Commencement 2\n\n3 Definitions 2\n\n4 Act binds the Crown 8\n\n5 Purpose of data sharing 8\n\nPart 2—Chief Data Officer 9\n\n6 Chief Data Officer 9\n\n7 Functions and powers of Chief Data Officer 9\n\nPart 3—Data requests 10\n\n8 Chief Data Officer may request data 10\n\n9 Data sharing body must respond to data request 10\n\n10 Designated body may respond to data request 11\n\n11 Chief Data Officer may request information about data holdings 11\n\n12 Data sharing body must respond to data holding request 12\n\n13 Designated body may respond to data holding request 13\n\n14 Reasons for refusing to provide specified data or information 13\n\nPart 4—Use and disclosure of data 15\n\nDivision 1—Authorised use and disclosure of identifiable data 15\n\n15 Data sharing body or designated body may disclose identifiable data 15\n\n16 Chief Data Officer may disclose identifiable data for the purpose of data integration 15\n\n17 Chief Data Officer or data analytics body may use identifiable data for the purpose of data integration 15\n\n18 Restrictions on the use of identifiable data for the purpose of data analytics work 15\n\n19 Restriction on the disclosure of results of data analytics work 16\n\nDivision 2—Authorised use and disclosure of data to which a secrecy provision applies 16\n\n20 Data sharing body or designated body may disclose data to which a secrecy provision applies 16\n\n21 Data sharing body or designated body must inform Chief Data Officer of secrecy provision 17\n\n22 Chief Data Officer may use data to which a secrecy provision applies 17\n\n23 Chief Data Officer may disclose data to which a secrecy provision applies 17\n\nDivision 3—Relationship with other Acts 18\n\n24 Handling of data under other Acts 18\n\n25 Exemption from Freedom of Information Act 1982 19\n\nPart 5—Offences 20\n\n26 Unauthorised access to, use of or disclosure of data or information—summary offence 20\n\n27 Unauthorised access to, use of or disclosure of data or information—indictable offence 20\n\nPart 6—Reporting and review 22\n\n28 Report to the Health Complaints Commissioner 22\n\n29 Report to the Information Commissioner 23\n\n30 Review of Act after 5 years 24\n\nPart 7—Other matters 25\n\n31 Delegation 25\n\n32 Regulations 25\n\n33 Chief Data Officer may issue policies and guidelines 26\n\n═════════════\n\nEndnotes 28\n\n1 General information 28\n\n2 Table of Amendments 30\n\n3 Amendments Not in Operation 31\n\n4 Explanatory details 32\n\n**Version No.** **002**\n\n**Victorian Data Sharing Act 2017**\n\n**No. 60 of 2017**\n\nVersion incorporating amendments as at  \n6 December 2018\n\n**The Parliament of Victoria enacts:**\n\nPart 1—Preliminary\n\n\t1 Purposes\n\nThe purposes of this Act are—\n\n(a) to establish the office of Chief Data Officer; and\n\n(b) to promote the sharing and use of public sector data as a public resource that supports government policy making, service planning and design; and\n\n(c) to remove barriers that impede the sharing of identifiable data with the Chief Data Officer or with data analytics bodies, and to facilitate the sharing of data across the public sector; and\n\n(d) to provide protections in connection with data sharing under this Act, by—\n\n(i) specifying the purposes of data sharing, and the circumstances in which sharing of identifiable data is permitted; and\n\n(ii) ensuring that data that is handled under this Act is protected from unauthorised access, use or disclosure; and\n\n(e) to make consequential and other amendments to other Acts.\n\n\t2 Commencement\n\nThis Act comes into operation on the day after the day on which this Act receives the Royal Assent.\n\n\t3 Definitions\n\n(1) In this Act—\n\n***Board of Inquiry***  has the same meaning as in the **Inquiries Act 2014**;\n\n***Centre***  means the persons employed or engaged by the Secretary to the Department to support the Chief Data Officer in the performance of the Chief Data Officer's functions, powers and duties under this Act;\n\n***Chief Data Officer*** means the person employed as the Chief Data Officer under section 6;\n\n***commissioner***,  of a Royal Commission, has the same meaning as in the **Inquiries Act 2014**;\n\n***data*** means any facts, statistics, instructions, concepts or other information in a form that is capable of being communicated, analysed or processed (whether by an individual or by a computer or other automated means);\n\n***data analytics body*** means—\n\n(a) the Secretary to a Department; or\n\n(b) any of the following prescribed by the regulations for the purposes of this paragraph—\n\n(i) a body established or appointed for a public purpose by or under an Act;\n\n(ii) a body established or appointed for a public purpose by the Governor in Council, or by a Minister, otherwise than under an Act;\n\n(iii) a person holding an office or position established by or under an Act (other than the office of member of the Parliament of Victoria) or to which the person was appointed by the Governor in Council, or by a Minister, otherwise than under an Act;\n\n(iv) any other data sharing body;\n\n(v) any other designated body;\n\n***data analytics work*** means the examination and analysis of data for the purpose of drawing conclusions as a result of that examination and analysis, but does not include data integration;\n\n***data integration*** means the combination or collation of data contained in 2 or more data sets;\n\n***data sharing body*** means—\n\n(a) a public service body; or\n\n(b) a public entity; or\n\n(c) Victoria Police; or\n\n(d) any of the following prescribed by the regulations for the purposes of this paragraph—\n\n(i) a body established or appointed for a public purpose by or under an Act;\n\n(ii) a body established or appointed for a public purpose by the Governor in Council, or by a Minister, otherwise than under an Act;\n\n(iii) a person holding an office or position established by or under an Act (other than the office of member of the Parliament of Victoria) or to which the person was appointed by the Governor in Council, or by a Minister, otherwise than under an Act;\n\n**Note**\n\nA data analytics body is a data sharing body under this Act.\n\n***de-identified***, in relation to data, means data that no longer relates to an identifiable individual or an individual who can be reasonably identified;\n\n***Department*** has the same meaning as in the **Public Administration Act 2004**;\n\n***designated body*** means—\n\n(a) an exempt body; or\n\n(b) an exempt body official; or\n\n(c) a special body, other than Victoria Police; or\n\n(d) a special body Head, other than the Chief Commissioner of Victoria Police; or\n\n(e) a Board of Inquiry or a Formal Review; or\n\n(f) a member of a Board of Inquiry or a Formal Review; or\n\n(g) a Royal Commission; or\n\n(h) a commissioner of a Royal Commission;\n\n***exempt body***  has the same meaning as in the **Public Administration Act 2004**;\n\n***exempt body official*** has the same meaning as in the **Public Administration Act 2004**;\n\n***Formal Review*** has the same meaning as in the **Inquiries Act 2014**;\n\n***handling***, in relation to data, means the collection, holding, management, use, disclosure or transfer of that data;\n\n***Health Complaints Commissioner*** has the same meaning as in the **Health Records Act 2001**;\n\n***health information*** has the same meaning as in the **Health Records Act 2001**;\n\n***identifiable data*** means one or more of the following—\n\n(a) health information;\n\n(b) personal information;\n\n(c) identifiers;\n\n(d) unique identifiers;\n\n***identifier*** has the same meaning as in the **Health Records Act 2001**;\n\n***individual*** means a natural person;\n\n***Information Commissioner*** has the same meaning as in the **Freedom of Information Act 1982**;\n\n***personal information*** has the same meaning as in the **Privacy and Data Protection Act 2014**;\n\n***public entity*** has the same meaning as in the **Public Administration Act 2004**;\n\n***public entity Head*** has the same meaning as in the **Public Administration Act 2004**;\n\n***public sector*** has the same meaning as in the **Public Administration Act 2004**;\n\n***public service body*** has the same meaning as in the **Public Administration Act 2004**;\n\n***public service body Head*** has the same meaning as in the **Public Administration Act 2004**;\n\n***responsible officer*** means*—*\n\n(a)  for a public service body—the public service body Head; or\n\n(b)  for a public entity—the public entity Head; or\n\n(c)  for Victoria Police—the Chief Commissioner of Victoria Police; or\n\n(d)  for a designated body—the head (however described) of that body; or\n\n(e)  for a body that is prescribed as a data analytics body or a data sharing body—the head (however described) of that body;\n\n***restricted data*** means the following—\n\n(a) data that could reasonably be expected to disclose, or enable a person to ascertain, the identity of a confidential source of information in relation to the enforcement or administration of the law;\n\n(b) data that could reasonably be expected to disclose the existence or identity of a person included in a witness protection program;\n\n(c) data that could reasonably be expected to prejudice national security;\n\n(d) data that could reasonably be expected to disclose investigative measures or procedures, including but not limited to intelligence gathering methodologies, investigative techniques or technologies, covert practices or information sharing arrangements between law enforcement agencies;\n\n(e) data to which a provision prescribed in the regulations applies;\n\n***Royal Commission*** means—\n\n(a) a Royal Commission established under the **Inquiries Act 2014**; or\n\n(b) a Royal Commission established under the prerogative of the Crown;\n\n***secrecy provision*** means a provision of an Act that restricts or prohibits the disclosure of information (whether that restriction or prohibition is absolute or subject to qualifications or exceptions), other than a provision prescribed in the regulations as a provision to which Division 2 of Part 4 does not apply;\n\n***Secretary to the Department*** means the Secretary to the Department responsible for the administration of this Act;\n\n***special body*** has the same meaning as in the **Public Administration Act 2004**;\n\n***special body Head*** has the same meaning as in the **Public Administration Act 2004**;\n\n***unique identifier*** means an identifier (usually a number) assigned by an organisation to an individual uniquely to identify that individual for the purposes of the operations of the organisation but does not include an identifier that consists only of the individual's name and does not include an identifier within the meaning of the **Health Records Act 2001**;\n\n***Victoria Police*** has the same meaning as in the **Victoria Police Act 2013**;\n\n***Victorian protective data security framework*** has the same meaning as in the **Privacy and Data Protection Act 2014**.\n\n(2) For the purposes of this Act, a body holds data if the data is contained in a document that is in the possession or under the control of the body, whether alone or jointly with other persons or bodies, irrespective of where the document is situated, whether in or outside Victoria.\n\n\t4 Act binds the Crown\n\nThis Act binds the Crown in right of Victoria and, so far as the legislative power of the Parliament permits, the Crown in all its other capacities.\n\n\t5 Purpose of data sharing\n\nData must only be handled under this Act for the purpose of informing government policy making, service planning and design.\n\nPart 2—Chief Data Officer\n\n\t6 Chief Data Officer\n\nThe Secretary to the Department may employ a person under Part 3 of the **Public Administration Act 2004** to be the Chief Data Officer for the purposes of this Act.\n\n\t7 Functions and powers of Chief Data Officer\n\n(1) The Chief Data Officer has the following functions—\n\n(a) to conduct data integration and data analytics work to inform government policy making, service planning and design;\n\n(b) to build capability in data analytics across the public sector;\n\n(c) to lead and coordinate cross-jurisdictional data sharing and data integration work on behalf of the State of Victoria;\n\n(d) to make available to data sharing bodies and designated bodies—\n\n(i) integrated data sets; and\n\n(ii) the results of data analytics work;\n\n(e) to collaborate with data sharing bodies and designated bodies;\n\n(f) functions incidental to the functions referred to in paragraphs (a) to (e);\n\n(g) any other functions conferred on the Chief Data Officer under this Act or any other Act.\n\n(2) The Chief Data Officer has all the powers necessary to perform his or her functions, including the powers conferred on the Chief Data Officer under this Act or any other Act.\n\nPart 3—Data requests\n\n\t8 Chief Data Officer may request data\n\n(1) The Chief Data Officer, in accordance with section 5, may give a written notice to the responsible officer of a data sharing body or a designated body requesting that the data sharing body or designated body provide to the Chief Data Officer data that is—\n\n(a) held by the data sharing body or designated body; and\n\n(b) specified in the notice.\n\n(2) A notice under subsection (1) must specify—\n\n(a) the data requested; and\n\n(b) the reasons for the request; and\n\n(c) how the data will be handled.\n\n(3) The Chief Data Officer must not request restricted data.\n\n\t9 Data sharing body must respond to data request\n\n(1) This section applies if the Chief Data Officer gives a notice under section 8 requesting that a data sharing body provide specified data.\n\n(2) The responsible officer of the data sharing body must respond in writing to the Chief Data Officer within 10 business days of the date of receiving the notice or within a longer period as is agreed by the Chief Data Officer, either—\n\n(a) by providing the specified data; or\n\n(b) by written notice stating that the data sharing body does not intend to provide some or all of the specified data in accordance with section 14.\n\n(3) If the responsible officer of the data sharing body does not intend to provide some or all of the specified data, the response to the request must—\n\n(a) be given to the Secretary to the Department in addition to being given to the Chief Data Officer; and\n\n(b) state the reasons for that intention in accordance with section 14.\n\n\t10 Designated body may respond to data request\n\nIf the Chief Data Officer gives a notice under section 8 requesting that a designated body provide specified data—\n\n(a) the designated body may provide some or all of the specified data to the Chief Data Officer, but is not required to do so; and\n\n(b) the designated body is not required to respond to the request.\n\n\t11 Chief Data Officer may request information about data holdings\n\n(1) The Chief Data Officer, in accordance with section 5, may give a written notice to the responsible officer of a data sharing body or a designated body, requesting that the data sharing body or designated body provide information about the data holdings of the data sharing body or the designated body.\n\n(2) The information that may be requested includes, but is not limited to—\n\n(a) the kind of data sets held by the data sharing body or designated body; and\n\n(b) the number of data sets held by the data sharing body or designated body; and\n\n(c) the kind of information contained in the data sets held by the data sharing body or designated body; and\n\n(d) the accuracy, currency and completeness of the data sets held by the data sharing body or designated body.\n\n(3) A notice under subsection (1) must specify—\n\n(a) the information requested; and\n\n(b) the reasons for the request; and\n\n(c) how the information will be handled.\n\n\t12 Data sharing body must respond to data holding request\n\n(1) This section applies if the Chief Data Officer gives a notice under section 11 requesting that a data sharing body provide specified information about the body's data holdings.\n\n(2) The responsible officer of the data sharing body must respond in writing to the Chief Data Officer within 10 business days or within a longer period as agreed by the Chief Data Officer, either—\n\n(a) by providing the specified information; or\n\n(b) by written notice stating that the data sharing body does not intend to provide some or all of the specified information in accordance with section 14.\n\n(3) If the responsible officer of the data sharing body does not intend to provide some or all of the specified information, the response to the request must—\n\n(a) be given to the Secretary to the Department in addition to being given to the Chief Data Officer; and\n\n(b) state the reasons for that intention in accordance with section 14.\n\n\t13 Designated body may respond to data holding request\n\nIf the Chief Data Officer gives a notice under section 11 requesting that a designated body provide information about the body's data holdings—\n\n(a) the designated body may provide some or all of the specified information to the Chief Data Officer, but is not required to do so; and\n\n(b) the designated body is not required to respond to the request.\n\n\t14 Reasons for refusing to provide specified data or information\n\nThe responsible officer of a data sharing body may refuse to provide data requested by the Chief Data Officer under section 8, or information requested by the Chief Data Officer under section 11, if the responsible officer considers for any reason that the data or information should not be provided, including but not limited to the following reasons—\n\n(a) that the provision of the data or information would constitute a breach of one or more of the following—\n\n(i) client legal privilege or legal professional privilege;\n\n(ii) contract;\n\n(iii) an equitable obligation of confidence;\n\n(iv) an order of a court or tribunal;\n\n(v) subject to Part 4, a law of the Commonwealth, a State or a Territory;  or\n\n(b) that the provision of the data or information would be likely to prejudice one or more of the following—\n\n(i) the investigation of a breach, or possible breach, of a law of the Commonwealth, a State or a Territory, or the administration or enforcement of such a law;\n\n(ii) a coronial inquest or inquiry;\n\n(iii) a proceeding before a court or tribunal; or\n\n(c) that the responsible officer believes on reasonable grounds that the provision of the data or information would be likely to endanger the health, safety or welfare of one or more individuals.\n\nPart 4—Use and disclosure of data\n\nDivision 1—Authorised use and disclosure of identifiable data\n\n\t15 Data sharing body or designated body may disclose identifiable data\n\n(1) The responsible officer of a data sharing body or designated body, in accordance with section 5, may disclose identifiable data to the Chief Data Officer in response to a request under section 8.\n\n(2) The responsible officer of a data sharing body or designated body, in accordance with section 5, may disclose identifiable data to a data analytics body for the purpose of data integration.\n\n\t16 Chief Data Officer may disclose identifiable data for the purpose of data integration\n\nSubject to section 23, the Chief Data Officer, in accordance with section 5, may disclose identifiable data received from data sharing bodies and designated bodies under this Act to a data analytics body for the purpose of data integration.\n\n\t17 Chief Data Officer or data analytics body may use identifiable data for the purpose of data integration\n\nThe Chief Data Officer or a data analytics body, in accordance with section 5, may collect, hold, manage and use identifiable data received from data sharing bodies and designated bodies under this Act for the purpose of data integration.\n\n\t18 Restrictions on the use of identifiable data for the purpose of data analytics work\n\n(1) The Chief Data Officer or a data analytics body must take reasonable steps to ensure that data received from data sharing bodies and designated bodies under this Act no longer relates to an identifiable individual or an individual who can reasonably be identified before using that data for the purpose of data analytics work.\n\n(2) For the purposes of subsection (1), the Chief Data Officer or a data analytics body must have regard to the following—\n\n(a) the de-identification techniques applied to treat the data;\n\n(b) the technical and administrative safeguards and protections implemented in the data analytics environment to protect the privacy of individuals;\n\n(c) any other considerations specified in the guidelines issued by the Chief Data Officer.\n\n\t19 Restriction on the disclosure of results of data analytics work\n\nBefore disclosing the results of data analytics work, the Chief Data Officer or a data analytics body must ensure that the results to be disclosed include only de-identified data.\n\nDivision 2—Authorised use and disclosure of data to which a secrecy provision applies\n\n\t20 Data sharing body or designated body may disclose data to which a secrecy provision applies\n\nIf a secrecy provision applies to the data disclosed by the responsible officer of a data sharing body or designated body to the Chief Data Officer, the disclosure of that data does not contravene the secrecy provision if it is in accordance with, and for the purposes of, this Act.\n\n\t21 Data sharing body or designated body must inform Chief Data Officer of secrecy provision\n\nIf the responsible officer of a data sharing body or designated body who discloses data to the Chief Data Officer in accordance with this Act is aware of a secrecy provision that applies to that data, the responsible officer must inform the Chief Data Officer of that secrecy provision.\n\n\t22 Chief Data Officer may use data to which a secrecy provision applies\n\nIf a secrecy provision applies to the data received by the Chief Data Officer under this Act, the collection, holding, management or use of that data does not contravene the secrecy provision if it is in accordance with, and for the purposes of, this Act.\n\n\t23 Chief Data Officer may disclose data to which a secrecy provision applies\n\n(1) If a secrecy provision applies to the data received by the Chief Data Officer under this Act, the disclosure of that data by the Chief Data Officer does not contravene the secrecy provision if—\n\n(a) the Minister responsible for administering the secrecy provision has authorised the disclosure; and\n\n(b) in the case of data that is subject to a secrecy provision set out in the **Taxation Administration Act 1997**, the Commissioner of State Revenue has authorised the disclosure; and\n\n(c) the disclosure is in accordance with, and for the purposes of, this Act and, in the case of identifiable data, is in accordance with section 16.\n\n(2) Data may be lawfully disclosed—\n\n(a) for the purpose of complying with subsection (1)(a), to the Minister responsible for administering the secrecy provision; and\n\n(b) for the purpose of complying with subsection (1)(b), to the Commissioner of State Revenue.\n\nDivision 3—Relationship with other Acts\n\n\t24 Handling of data under other Acts\n\n(1) This Part does not affect the handling of data that would otherwise be permitted by or under the **Privacy and Data Protection Act 2014**, the **Health Records Act 2001** or any other Act.\n\n(2) Except as expressly provided by this Part, this Act does not affect obligations under the **Privacy and Data Protection Act 2014** or the **Health Records Act 2001** in relation to the handling of identifiable data.\n\n(3) If the Chief Data Officer or a data analytics body becomes aware that this Act, the **Privacy and Data Protection Act 2014** or the **Health Records Act 2001** has been, or is likely to have been, breached in relation to data handled under this Act while in the control of the Chief Data Officer or of the data analytics body, the Chief Data Officer or the data analytics body must, as soon as practicable after becoming aware of the possible breach, inform—\n\n(a) in the case of a breach of this Act or the **Privacy and Data Protection Act 2014**, the Information Commissioner; and\n\n(b) in the case of a breach of the **Health Records Act 2001**, the Health Complaints Commissioner; and\n\n(c) in any case, the data sharing body or designated body who provided the data.\n\n\t25 Exemption from Freedom of Information Act 1982\n\n(1) The **Freedom of Information Act 1982** does not apply to—\n\n(a) a document that is in the possession of the Chief Data Officer, containing—\n\n(i) data provided to the Chief Data Officer under section 9 by the data sharing body or under section 10 by a designated body; or\n\n(ii) information provided to the Chief Data Officer under section 12 by the data sharing body or under section 13 by a designated body; or\n\n(iii) data sets created following data integration conducted by the Chief Data Officer under this Act; or\n\n(b) a document that is in the possession of a data analytics body, containing—\n\n(i) data provided to the data analytics body under section 15(2) by a data sharing body or a designated body; or\n\n(ii) data provided to the data analytics body under section 16 by the Chief Data Officer; or\n\n(iii) data sets created by a data analytics body following data integration conducted by the data analytics body under this Act.\n\n(2) In this section—\n\n***document***  has the same meaning as in the **Freedom of Information Act 1982**.\n\nPart 5—Offences\n\n\t26 Unauthorised access to, use of or disclosure of data or information—summary offence\n\n(1) A person must not, without reasonable excuse, access, use or disclose any data or information obtained by the person under this Act other than—\n\n(a) in accordance with this Act; or\n\n(b) in connection with the performance of functions under this Act.\n\nPenalty: 240 penalty units or imprisonment for 2 years or both.\n\n(2) Without limiting what may be a reasonable excuse, it is a reasonable excuse if the person took reasonable steps not to access, use or disclose the data or information.\n\n**Note**\n\nSee also section 72 of the **Criminal Procedure Act 2009**, which deals with the evidential burden of proof.\n\n\t27 Unauthorised access to, use of or disclosure of data or information—indictable offence\n\n(1) A person must not access, use or disclose any data or information obtained by the person under this Act if the person knows or is reckless as to whether the data or information may be used (whether by the person or any other person) to—\n\n(a) endanger the life or physical safety of any person; or\n\n(b) commit, or assist in the commission of, an indictable offence; or\n\n(c) impede or interfere with the administration of justice.\n\nPenalty: 600 penalty units or imprisonment for 5 years or both.\n\n(2) An offence against subsection (1) is an indictable offence.\n\nPart 6—Reporting and review\n\n\t28 Report to the Health Complaints Commissioner\n\n(1) The Chief Data Officer must provide a report to the Health Complaints Commissioner on the operation of the Centre in relation to health information at intervals of no longer than 12 months.\n\n(2) A report under subsection (1) must include the following—\n\n(a) the steps taken by the Chief Data Officer to ensure compliance with the **Health Records Act 2001**;\n\n(b) details of the data integration and data analytics work projects undertaken by the Centre that have used health information during the reporting period and whether the projects have met key objectives and achieved specified outcomes;\n\n(c) the number of requests for data containing health information made by the Chief Data Officer;\n\n(d) the number of times a data sharing body has failed or refused to respond to a request for data containing health information from the Chief Data Officer;\n\n(e) an assessment of issues and challenges that have arisen;\n\n(f) any other information requested by the Health Complaints Commissioner.\n\n\t29 Report to the Information Commissioner\n\n(1) The Chief Data Officer must provide a report to the Information Commissioner on the operation of the Centre in relation to personal information (other than health information) at intervals of no longer than 12 months.\n\n(2) A report under subsection (1) must include the following—\n\n(a) the steps taken by the Chief Data Officer to ensure compliance with the **Privacy and Data Protection Act 2014**, including but not limited to the Information Privacy Principles and the Victorian protective data security framework;\n\n(b) details of the data integration and data analytics work projects undertaken by the Centre that have used personal information (other than health information) during the reporting period and whether the projects have met key objectives and achieved specified outcomes;\n\n(c) the number of requests for data containing personal information (other than health information) made by the Chief Data Officer;\n\n(d) the number of times a data sharing body has failed or refused to respond to a request for data containing personal information (other than health information) from the Chief Data Officer;\n\n(e) an assessment of issues and challenges that have arisen;\n\n(f) any other information requested by the Information Commissioner.\n\n\t30 Review of Act after 5 years\n\nThe Minister must—\n\n(a) cause a review to be made of the first 5 years of operation of this Act; and\n\n(b) cause a copy of a report of the review to be laid before each House of Parliament on or before the end of the period of 12 months after the day on which the review is completed.\n\nPart 7—Other matters\n\n\t31 Delegation\n\n(1) The Chief Data Officer may by instrument delegate any power, function or duty of the Chief Data Officer under this Act or the regulations made under this Act, other than this power of delegation, to a person employed in or engaged by the Department responsible for administering this Act.\n\n(2) The Secretary to a Department may by instrument delegate any power, function or duty of the Secretary (in the Secretary's capacity as a data analytics body) under this Act or the regulations made under this Act, other than this power of delegation, to a person employed in or engaged by the Department.\n\n(3) The responsible officer of a data sharing body, a designated body or a data analytics body may by instrument delegate any power, function or duty of the responsible officer under this Act or the regulations made under this Act, other than this power of delegation, to a person employed in or engaged by the data sharing body, designated body or data analytics body, as the case requires.\n\n\t32 Regulations\n\n(1) The Governor in Council may make regulations for or with respect to any matter or thing required or permitted by this Act to be prescribed or necessary to be prescribed to give effect to this Act.\n\n(2) Without limiting subsection (1), the regulations may—\n\n(a) prescribe a body to be a data sharing body; and\n\n(b) prescribe a body to be a data analytics body; and\n\n(c) prescribe a class of data to be restricted data; and\n\n(d) prescribe a provision to be a secrecy provision to which Division 2 of Part 4 does not apply.\n\n(3) The regulations may—\n\n(a) be of general or limited application; and\n\n(b) differ according to differences in time, place or circumstances; and\n\n(c) confer a discretionary authority or impose a duty on a specified person or a specified class of person.\n\n\t33 Chief Data Officer may issue policies and guidelines\n\n(1) The Chief Data Officer may issue policies and guidelines in relation to the administration of this Act.\n\n(2) Policies or guidelines issued under subsection (1) may cover the following matters—\n\n(a) privacy and confidentiality preserving procedures for treating data;\n\n(b) data security safeguards in relation to data handling and storage under this Act;\n\n(c) secure technology platforms for data handling and storage under this Act;\n\n(d) risk mitigation frameworks for data handling and storage, such as proportionate risk assessment tools and techniques;\n\n(e) protocols for data integration and data analytics work projects, such as project design, governance and data handling arrangements;\n\n(f) any other matters the Chief Data Officer considers relevant.\n\n(3) The Chief Data Officer may publish policies and guidelines issued under this section.\n\n(4) A data sharing body, a designated body or a data analytics body must have regard to policies or guidelines issued under subsection (1).\n\nPt 8 (Heading and ss 34–36) repealed by No. 60/2017 s. 36.\n\n* * * * *\n\n ═════════════\n\nEndnotes\n\n1 General information\n\nSee [www.legislation.vic.gov.au](http://www.legislation.vic.gov.au) for Victorian Bills, Acts and current Versions of legislation and up-to-date legislative information.\n\n*Minister's second reading speech—*\n\n*Legislative Assembly: 18 October 2017*\n\n*Legislative Council: 2 November 2017*\n\nThe long title for the Bill for this Act was \"A Bill for an Act to establish the office of Chief Data Officer, to promote the sharing and use of public sector data for the purpose of supporting government policy making, to amend the **Privacy and Data Protection Act 2014** and for other purposes.\"\n\nThe **Victorian Data Sharing Act 2017** was assented to on 5 December 2017 and came into operation on 6 December 2017: s. 2.\n\nINTERPRETATION OF LEGISLATION ACT 1984 (ILA)\n\nStyle changes\n\nSection 54A of the ILA authorises the making of the style changes set out in Schedule 1 to that Act.\n\nReferences to ILA s. 39B\n\nSidenotes which cite ILA s. 39B refer to section 39B of the ILA which provides that where an undivided section or clause of a Schedule is amended by the insertion of one or more subsections or subclauses, the original section or clause becomes subsection or subclause (1) and is amended by the insertion of the expression \"(1)\" at the beginning of the original section or clause.\n\nInterpretation\n\nAs from 1 January 2001, amendments to section 36 of the ILA have the following effects:\n\n• Headings\n\nAll headings included in an Act which is passed on or after 1 January 2001 form part of that Act. Any heading inserted in an Act which was passed before 1 January 2001, by an Act passed on or after 1 January 2001, forms part of that Act. This includes headings to Parts, Divisions or Subdivisions in a Schedule; sections; clauses; items; tables; columns; examples; diagrams; notes or forms. See section 36(1A)(2A).\n\n• Examples, diagrams or notes\n\nAll examples, diagrams or notes included in an Act which is passed on or after 1 January 2001 form part of that Act. Any examples, diagrams or notes inserted in an Act which was passed before 1 January 2001, by an Act passed on or after 1 January 2001, form part of that Act. See section 36(3A).\n\n• Punctuation\n\nAll punctuation included in an Act which is passed on or after 1 January 2001 forms part of that Act. Any punctuation inserted in an Act which was passed before 1 January 2001, by an Act passed on or after 1 January 2001, forms part of that Act. See section 36(3B).\n\n• Provision numbers\n\nAll provision numbers included in an Act form part of that Act, whether inserted in the Act before, on or after 1 January 2001. Provision numbers include section numbers, subsection numbers, paragraphs and subparagraphs. See section 36(3C).\n\n• Location of \"legislative items\"\n\nA \"legislative item\" is a penalty, an example or a note. As from 13 October 2004, a legislative item relating to a provision of an Act is taken to be at the foot of that provision even if it is preceded or followed by another legislative item that relates to that provision. For example, if a penalty at the foot of a provision is followed by a note, both of these legislative items will be regarded as being at the foot of that provision. See section 36B.\n\n• Other material\n\nAny explanatory memorandum, table of provisions, endnotes, index and other material printed after the Endnotes does not form part of an Act.  \nSee section 36(3)(3D)(3E).\n\n2 Table of Amendments\n\nThis publication incorporates amendments made to the **Victorian Data Sharing Act 2017** by Acts and subordinate instruments.\n\n–––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––\n\n**Victorian Data Sharing Act 2017, No. 60/2017**\n\n| Assent Date: | 5.12.17 |\n| --- | --- |\n| Commencement Date: | S. 36 on 6.12.17: s. 2 |\n| Note: | S. 36 repealed Pt 8 (ss 34–36) on 6.12.18 |\n| Current State: | This information relates only to the provision/s amending the **Victorian Data Sharing Act 2017** |\n\n\n–––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––\n\n3 Amendments Not in Operation\n\nThere are no amendments which were Not in Operation at the date of this publication.\n\n4 Explanatory details\n\nNo entries at date of publication.","sortOrder":0}],"analysis":{"summary":{"complexity_score":6,"scope_assessment":{"changed":false,"description":"Based on the available text and the Act's known history, the legislation appears to have remained broadly consistent with its original intent — establishing a controlled framework for Victorian government data sharing. The consolidated version suggests amendments have been made since enactment, but the core purpose of enabling inter-agency data sharing under regulated conditions does not appear to have materially shifted from the original 2017 design."},"complexity_factors":["Interaction with existing privacy legislation (Privacy and Data Protection Act 2014 Vic and Health Records Act 2001 Vic) creates layered obligations","Requires understanding of data governance concepts (data custodians, data sharing agreements, de-identification) that are technical in nature","Multiple roles and entities are created or referenced, each with different responsibilities and powers","Balancing competing interests — government efficiency vs individual privacy rights — adds interpretive nuance","The legislation provided was fragmentary and incomplete, limiting full assessment of its operative provisions","Provisions likely include exceptions and carve-outs that modify the general rules in context-specific ways","Enforcement and compliance mechanisms add another layer of complexity for affected agencies"],"plain_english_summary":"The Victorian Data Sharing Act 2017 creates a legal framework for sharing government-held data across Victorian agencies and with approved external parties for purposes like service improvement and research. It sets rules on how data may be shared, stored and used, establishes oversight and a coordinating role, and includes privacy protections. This enables better coordinated public services but increases the potential for personal information to be shared across government."},"issue_detection":{"absurdities":[],"contradictions":[]},"flash_summary":{"complexity_score":7,"scope_assessment":{"changed":false,"description":"The Act as drafted aligns with its stated purpose to establish a Chief Data Officer and facilitate public sector data sharing for policy and service design (see s 1 and s 5). It does not, on its face, extend beyond that purpose. However, the regulations and ministerial authorisations (notably s 32 and s 23) permit prescription of additional bodies, classes of restricted data and exceptions to secrecy rules, which creates a mechanism that can broaden operational scope over time."},"complexity_factors":["Cross‑legislation interaction and reliance on external definitions and standards (Privacy and Data Protection Act 2014, Health Records Act 2001, Freedom of Information Act 1982) (see ss 3, 24, 25).","Wide discretion for the CDO to request data and for responsible officers to refuse requests (s 8; s 14), creating case‑by‑case compliance burdens.","Regulation‑making powers that can expand or specify who counts as data sharing/analytics bodies and what is 'restricted data' (s 32).","Secrecy provisions override and require ministerial authorisation for some disclosures (s 20–23), adding procedural and governance complexity.","FOI exemption for documents held by the CDO and data analytics bodies (s 25), affecting transparency and access rights.","De‑identification and data handling obligations plus guideline regime (s 18, s 19, s 33) requiring technical and administrative safeguards.","Criminal offence regime with significant penalties for unauthorised access, use or disclosure (ss 26–27), raising compliance and training costs.","Reporting obligations to privacy and health regulators and a statutory 5‑year review (ss 28–30), increasing oversight and administrative reporting.","Delegation rules that permit operational decentralisation within departments and agencies (s 31), which complicate accountability paths.","Definition breadth for 'data analytics body' and 'data sharing body' with many categories and delegated prescription (s 3), making scope uncertain without regulations."],"plain_english_summary":"This Act creates the office of the Chief Data Officer (CDO) and authorises the CDO to request, receive and integrate public sector data to inform government policy, service planning and design. It permits identifiable data sharing between defined public bodies and data analytics bodies (subject to limits such as no \"restricted data\") and requires de‑identification before data is used for analytics.\n\nAgencies must respond to requests, the CDO issues guidelines and reports, misuse carries criminal penalties, certain materials are exempt from FOI, and ministerial or regulatory authorisations can affect what data may be shared."},"kimi_summary":{"content_quality":"ok","complexity_score":5,"scope_assessment":{"changed":false,"description":"The legislation appears consistent with its original intent as stated in the long title: establishing a Chief Data Officer and promoting data sharing for policy making. The 2018 amendment (repealing Part 8) actually reduced scope by removing transitional provisions, rather than expanding it."},"complexity_factors":["Multiple overlapping defined terms (24 defined terms in section 3, with nested definitions like 'data analytics body' including 'data sharing body' and 'designated body')","Complex classification system distinguishing between 'data sharing bodies' (must comply), 'designated bodies' (may comply), and 'data analytics bodies' (can receive data)","Conditional logic for secrecy provisions requiring dual authorisation for tax data (Minister plus Commissioner of State Revenue under section 23)","Cross-references to at least 6 other Acts (Public Administration Act 2004, Privacy and Data Protection Act 2014, Health Records Act 2001, Freedom of Information Act 1982, Inquiries Act 2014, Victoria Police Act 2013)","Dual offence structure with summary and indictable offences (sections 26-27) requiring assessment of 'reasonable excuse' and mental states (knowledge/recklessness)","Multiple reporting obligations to different commissioners (Health Complaints Commissioner vs Information Commissioner) depending on data type"],"plain_english_summary":"This Victorian law creates a system for government agencies to share data with each other to help make better policies and plan public services.\n\n**What it does:**\n- **Creates a Chief Data Officer** – a senior public servant whose job is to coordinate data sharing across Victorian government agencies, combine different datasets (called \"data integration\"), and analyse information to help government decision-making.\n- **Sets up rules for requesting data** – The Chief Data Officer can ask government bodies (called \"data sharing bodies\") to hand over data they hold. Most agencies must respond within 10 business days, though some sensitive bodies (like courts and integrity bodies, called \"designated bodies\") can choose whether to respond.\n- **Protects personal information** – The Act allows sharing of \"identifiable data\" (information that can identify specific people, like health records or personal details) only for specific purposes. Before using personal data for analysis, agencies must remove identifying details (\"de-identify\" it) where possible.\n- **Overrides secrecy laws in limited cases** – Normally, some government data is protected by \"secrecy provisions\" (laws that make it illegal to share certain information). This Act allows sharing despite those laws, but only with ministerial approval for sensitive data like tax information.\n- **Exempts shared data from Freedom of Information** – Documents held by the Chief Data Officer or analytics bodies under this Act cannot be accessed through FOI requests.\n- **Creates offences** – It is a crime to improperly access, use or disclose data obtained under this Act. Serious cases (where someone knowingly risks harming others or committing crimes) carry penalties of up to 5 years in prison.\n\n**Who it affects:**\n- Victorian government departments and public agencies (\"data sharing bodies\")\n- Courts, tribunals, integrity bodies and other special agencies (\"designated bodies\")\n- Victorian residents whose data may be shared (though with privacy protections)\n\n**Why it matters:**\nThe Act tries to break down \"silos\" where different government agencies hoard data. The idea is that combining information (for example, linking health data with housing data) can reveal patterns that help design better services. However, it balances this against privacy risks by requiring de-identification, limiting purposes to policy-making, and creating criminal penalties for misuse."},"flash_summary_failed":{"failed":true,"reason":"A positive credit balance is required for all requests, including BYOK, so fallback providers remain available. Add credits at https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai%3Fmodal%3Dtop-up to continue.","source":"analysis-cron"}},"importantCases":[],"_links":{"self":"/api/acts/victorian-data-sharing-act-2017","history":"/api/acts/victorian-data-sharing-act-2017/history","analysis":"/api/acts/victorian-data-sharing-act-2017/analysis","conflicts":"/api/acts/victorian-data-sharing-act-2017/conflicts","importantCases":"/api/acts/victorian-data-sharing-act-2017/important-cases","documents":"/api/acts/victorian-data-sharing-act-2017/documents"}}