16CProject involving use of de‑identification or secure access data services

16C Project involving use of de‑identification or secure access data services

(1) The requirement in subsection (2) applies if: (a) the data sharing purpose of the project is informing government policy and programs or research and development; and (b) the project involves performing a de‑identification data service (see subsection (3)) or a secure access data service (see subsection (4)). (2) The data sharing agreement that covers the project must require the service to be performed by one of the following: (a) the data custodian of the data, if the data custodian is not an ADSP but is satisfied that it has the appropriate skills and experience to perform the service; (b) the data custodian of the data, if the data custodian is an ADSP able to perform such a service consistently with its conditions of accreditation; (c) an ADSP able to perform such a service consistently with its conditions of accreditation. (3) A de‑identification data service is a service to treat data that includes personal information so that the data is de‑identified, using techniques that restrict the data being used in a way that would have the result that the data ceases to be de‑identified. (4) A secure access data service is: (a) the service of providing ADSP‑controlled access; or (b) any other service that enables an entity to access data under the control of another entity and that includes controls to prevent or minimise the risk of the data being misused.