19Requirements to be met by all data sharing agreements

19 Requirements to be met by all data sharing agreements

(1A) The requirements in this section must be met by all data sharing agreements.

Note: There are other requirements that, depending on the nature of the project, must be met by some data sharing agreements. See sections 16A and 16B.

(1) The parties to the agreement must be identified in the agreement. (2) The agreement must describe the project and specify that this Act applies to the project. (3) The agreement must specify: (a) the public sector data that the data custodian is to share (including any ADSP‑enhanced data an ADSP is to share on behalf of the data custodian) (the source data); and (b) the output of the project that the data custodian and accredited user agree is to be the final output. (4) The agreement must: (a) specify the data custodian of the source data; and (b) if the agreement appoints a Commonwealth body as data custodian of output of the project in accordance with section 20F—specify the output and explain why the appointment has been made.

Note: If the accredited user is a Commonwealth body, the agreement may appoint the accredited user as the Commonwealth body that is to be data custodian of the output.

(5) The agreement must specify the title of any law that the sharing would contravene but for section 23 (authorisation to share overrides other laws). (6) The agreement must: (a) specify: (i) the data sharing purpose, or data sharing purposes, of the project; and (ii) if, under the agreement, the accredited user is to be allowed to use output of the project for any purpose incidental to that purpose or those purposes—any such incidental purpose; and (b) except in relation to any use of the output allowed in accordance with section 20D—prohibit the accredited user from collecting and using output of the project for any of the following: (i) any purpose not specified; (ii) any precluded purpose. (6A) The agreement must prohibit the accredited user from creating output of the project, other than: (a) the final output; and (b) output the creation of which is reasonably necessary or incidental to creation of the final output. (7) The agreement must specify how the project will be consistent with the data sharing principles, including by: (a) describing how the public interest is served by the project; and (b) specifying the actions the party will take to give effect to the principles. (8) If the sharing is being done through an ADSP, the agreement must: (a) specify any data services the ADSP is to perform in relation to public sector data shared with the ADSP by the data custodian; and (b) specify the circumstances in which the ADSP is to share, with the accredited user on behalf of the data custodian, ADSP‑enhanced data of the project; and (c) prohibit the ADSP from providing access to, or releasing, the ADSP‑enhanced data in any other circumstances other than circumstances (if any) specified in the agreement. (8A) For the purposes of paragraph (8)(c), the only other circumstances that may be specified in the agreement are those allowed by section 20A. (9) The agreement must: (a) describe in general terms the use to be made by the accredited user of the output of the project; and (b) prohibit the accredited user from using the output in a way that is inconsistent with the description; and (c) prohibit the accredited user from providing access to, or releasing, the output in any circumstances other than circumstances (if any) specified in the agreement. (10) For the purposes of paragraph (9)(c), the only circumstances that may be specified in the agreement are those allowed by section 20A, 20B, 20C or 20D. (11) The agreement must prohibit the accredited entities that are party to the agreement from doing anything inconsistent with the conditions of accreditation imposed on or applicable to the entity from time to time. (12) If section 37 applies in relation to sharing under the agreement and the agreement does not provide that subsections 37(2) and (3) are not to apply, the agreement must specify that those subsections apply. (12A) If the parties agree to responsibilities in relation to data breaches additional to those under Part 3.3, the agreement must set out those responsibilities. (13) The agreement must specify the circumstances in which it may be varied or terminated and how a variation or termination is to be done. (14) The agreement must specify either or both of the following: (a) its duration; (b) the intervals at which the parties must review it. (15) The agreement must provide for how scheme data covered by the agreement is to be dealt with when the agreement ends. (16) The agreement must meet any other requirements prescribed by a data code for the purposes of this subsection. (17) The agreement must require the data custodian of the source data to give the Commissioner written notice of the cessation of the agreement, as soon as practicable after the agreement ceases be in effect.