13Authorisation for data custodian to share public sector data

13 Authorisation for data custodian to share public sector data

(1) An entity (the sharer) is authorised to share data with another entity (the user), either directly or through another entity (the intermediary), if all of the following apply: (a) the constitutional requirements in subsection (4) are met; (b) the data custodian requirements in subsection (2) are met; (c) the project the sharing is part of is covered by a registered data sharing agreement that is in effect and that meets the requirements of this Act; (d) the sharing is in accordance with the data sharing agreement; (e) the sharer is satisfied that the project is consistent with the data sharing principles; (f) the user is an accredited user and its accreditation is not suspended; (g) if the data shared with the user includes personal information—the privacy coverage condition in section 16E is met in relation to the user; (h) if the sharer shares through an intermediary—the intermediary is an ADSP and its accreditation is not suspended; (i) if the data shared with the intermediary includes personal information—the privacy coverage condition in section 16E is met in relation to the intermediary.

Note: This section authorises the sharer to share its public sector data with the user and with the intermediary (if any). It also authorises the intermediary (if any) to share with the user, on behalf of the sharer, ADSP‑enhanced data of which the sharer is the data custodian.

(2) The data custodian requirements are the following: (a) the data is public sector data and the sharer is the data custodian of the data; (b) if the sharer is not the only data custodian of the data—authority to share the data has been given by each other data custodian; (c) the sharing is not barred by section 17; (d) the sharing is consistent with the general privacy protections in section 16A and the purpose‑specific privacy protections in section 16B; (e) if the data shared does not include personal information—only the minimum amount of data necessary for the project to proceed is shared; (f) if the requirement in subsection 16C(2) or 16D(2) applies—the requirement is met.

Note: If sharing is done through an intermediary, it is possible that authority to share as mentioned in paragraph (2)(b) will be needed from additional data custodians of ADSP‑enhanced data of the project, before the ADSP‑enhanced data can be shared with the user.

(3) Authority given by a data custodian for the purposes of paragraph (2)(b) must be given by one of the following: (a) an authorised officer of that data custodian; (b) if another data custodian is authorised to act as the agent of that data custodian—an authorised officer of the agent data custodian. (4) The constitutional requirements are that any of the following apply: (a) the data is shared with a Commonwealth body or Territory body, or the Commonwealth or a Territory; (b) the data is shared with a State body or a State, as part of a project that: (i) relates to a matter of national interest that requires national cooperation to achieve an identified national objective; or (ii) addresses an immediate need to take coordinated action in an area that will have significant national and cross‑jurisdictional effect; or (iii) occurs in the context of the Commonwealth otherwise facilitating cooperation with or between the States; (c) the data is shared as part of a project that is for a data sharing purpose set out in paragraph 15(1)(a) (delivery of government services) or (b) (informing government policy and programs), if the government concerned is or includes the Commonwealth; (d) the data is shared with a constitutional corporation as part of a project that is for the data sharing purpose set out in paragraph 15(1)(c) (research and development); (e) the data is shared by means of electronic communication; (f) the data is shared to enable analysis for statistical purposes; (g) the data is statistical information.