14Data principle—appropriate protection

14 Data principle—appropriate protection

(1) As part of satisfying itself that a project is consistent with the data principle set out in subsection 16(7) of the Act, including the element set out in subsection 16(8) of the Act, an entity must take into account the matters, and comply with the requirements, set out in this section. (2) The entity must consider whether, before the data is shared, it should be treated in a way that contributes to the proportionate management of the risks of sharing, collecting and using the data.

Note 1: For the purposes of this section, treatment of data might include processes that reduce the detail in the data by deletion, modification, or combination of variables, categories or unit records.

Note 2: For the purposes of this section, see also the privacy protections in sections 16A and 16B of the Act, and the requirements relating to de‑identification or secure access data services in section 16C of the Act.

(3) If the data is to be shared through an ADSP, the data custodian must consider the appropriateness of treating the data before sharing with the ADSP. (4) The entity must consider whether a reasonable person, who is properly informed, would agree that the data to be shared, collected or used is reasonably necessary to achieve the data sharing purpose or purposes of the project.

Note: See also paragraph 13(2)(e) of the Act, and the privacy protections in sections 16A and 16B of the Act.