16Data sharing principles

16 Data sharing principles

Project principle (1) The project principle is that the project is an appropriate project or program of work. (2) The project principle includes (but is not limited to) the following elements: (a) the project can reasonably be expected to serve the public interest; (b) the parties observe processes relating to ethics, as appropriate in the circumstances. People principle (3) The people principle is that data is made available only to appropriate persons. (4) The people principle includes (but is not limited to) the following elements: (a) access to data is only provided to individuals who have attributes, qualifications, affiliations or expertise appropriate for the access; (b) the entity sharing the data considers the following matters in relation to the entity collecting the data (the collector): (i) the collector’s experience with projects involving the sharing of public sector data, under this Act or otherwise; (ii) the collector’s capacity to handle public sector data securely; (iii) any data breaches, or breaches of the law relating to data, by the collector; (iv) any other matters specified in a data code. Setting principle (5) The setting principle is that data is shared, collected and used in an appropriately controlled environment. (6) The setting principle includes (but is not limited to) the following elements: (a) the means by which the data is shared, collected and used are appropriate, having regard to the type and sensitivity of the data, to control the risks of unauthorised use; (b) reasonable security standards are applied when sharing, collecting and using data. Data principle (7) The data principle is that appropriate protections are applied to the data. (8) The data principle includes (but is not limited to) the element that only the data reasonably necessary to achieve the applicable data sharing purpose or purposes is shared, collected and used. Output principle (9) The output principle is that the only output of the project is: (a) the final output; and (b) output the creation of which is reasonably necessary or incidental to creation of the final output. (10) The output principle includes (but is not limited to) the following elements: (a) the data custodian of the data and the accredited user consider: (i) the nature and intended use of the output of the project; and (ii) requirements and procedures for use of the output of the project; (b) the final output contains only the data reasonably necessary to achieve the applicable data sharing purpose or data sharing purposes. Application of data sharing principles (11) For a data scheme entity to be satisfied that the project is consistent with the data sharing principles, the entity must be satisfied that it has applied each principle to the sharing, collection or use of data in such a way that, when viewed as a whole, the risks associated with the sharing, collection or use are appropriately mitigated.