Data Availability and Transparency (Consequential Amendments) Transitional Rules 2022

The central concept is the transitional entity. Under subitem 1(1) of Schedule 3 to the DAT (Consequential Amendments) Act, a transitional entity is an entity that the Minister prescribes by legislative instrument. This instrument exercises that power by listing seven entities in the table in s 5. The effect is that each listed entity is deemed to be an ADSP during the transition period without having to go through the usual accreditation process under Pt 6 of the DAT Act. The instrument also prescribes conditions of accreditation as an ADSP for each transitional entity (s 6). These conditions are listed in column 2 of the table in s 5 and are specific restrictions on the services the entity may provide. The note to s 6 warns that the DAT Act may impose other conditions as well. The transition period is defined in s 7 as beginning on the day listed in column 3 of the table (which is the commencement day for most entities, or the commencement day of a later amending rule for Queensland Health) and ending at the earliest of: renewal under s 84, cancellation under s 81, or the end of 30 July 2025. Three types of data services are explicitly referenced in the conditions: secure access data services, complex data integration services, and de-identification data services. These terms are defined in the DAT Act and its rules, not in this instrument. The instrument also uses the term Commonwealth Social Services Department, defined as the department administered by the Minister who administers the Social Security (International Agreements) Act 1999. This is a narrow departmental identifier, not the entire Services Australia or Department of Social Services. For Queensland Health, the definition cross-references the Public Sector Act 2022 (Qld) and a gazette notice, meaning the entity is the Queensland Department of Health as declared under state law. The instrument thus relies on a mix of Commonwealth and state definitions to identify which organisational units can benefit from the transitional treatment. The concept of a transitional entity is time limited; it is not a permanent status. Once the transition period ends, the entity must either be a fully accredited ADSP or cease providing the regulated services.

The instrument directly affects seven government entities. The Australian Bureau of Statistics (item 1), the Australian Institute of Family Studies (item 2), and the Australian Institute of Health and Welfare (item 3) each have no conditions listed in column 2, meaning they face no service-specific restrictions during the transition period. They can provide all types of ADSP services subject only to other conditions under the DAT Act. The Commonwealth Social Services Department (item 4) is prohibited from providing secure access data services entirely. This is a significant restriction that prevents that department from operating a secure data lab or remote access facility during transition. Queensland Health (item 4A, added by a 2023 amendment) faces the most restrictive conditions: it cannot provide complex data integration services unless those services are provided by its Statistical Services Branch and only for data linkage activities; and it cannot provide secure access data services or de-identification data services at all. Queensland Treasury (item 5) cannot provide de-identification or complex data integration services unless those services are provided by the Queensland Government Statistician’s Office, and cannot provide secure access data services. The Victorian Department of Health (item 6) can only provide de-identification, complex integration, or secure access services if those services are provided by the Centre for Victorian Data Linkage. These restrictions channel data services through specific internal units, which may be under-resourced or operationally constrained. The instrument also indirectly affects private sector ADSPs and potential competitors. By granting public entities a transitional period with limited service scope, it may delay the emergence of a competitive market for data services. Private ADSPs must comply with full accreditation requirements from the outset, while public entities receive favourable treatment for a fixed period. Users of data services (researchers, policy analysts, private firms) are affected because the range of services available from each transitional entity is limited. For example, a researcher wanting secure access to linked health data may be forced to use the Victorian Centre for Victorian Data Linkage if dealing with Victorian Department of Health data, rather than a private ADSP. The DAT Commissioner is also affected, as the Commissioner must manage the transition periods, monitor compliance with conditions, and decide on renewal or cancellation of accreditation. The Commissioner's workload is front-loaded as the 30 July 2025 deadline approaches.

The instrument imposes duties on each transitional entity in the form of conditions of accreditation as an ADSP. These are not optional; they are prescribed under s 6 for the purposes of subitem 2(2) of Schedule 3 to the DAT (Consequential Amendments) Act. For entities with restrictions, the duty is to refrain from providing the specified service types, or to provide them only through a designated unit. For example, Queensland Health must not provide secure access data services or de-identification data services under any circumstances as part of a project. This is an absolute prohibition. For complex data integration services, Queensland Health may only provide them if the services are provided by its Statistical Services Branch and only for data linkage activities. This creates a duty to channel all such work through that branch and to ensure the work is limited to data linkage. Similarly, the Victorian Department of Health may provide de-identification, complex integration, and secure access services only through the Centre for Victorian Data Linkage. These duties bind the entities’ internal operations and project management. The entities have the right to be treated as transitional entities during the transition period, which means they are deemed to be accredited ADSPs without the need to apply under s 82 of the DAT Act. They also have the right to apply for renewal of their accreditation under s 84 of the DAT Act; if the Commissioner renews, the transition period ends at the start of the renewed accreditation. Conversely, if the Commissioner cancels accreditation under s 81, the transition period ends at that point. The entities do not have a right to extend the transition period beyond 30 July 2025; the sunset is absolute. The instrument also gives the entities the right to rely on the definitional framework: for example, the Commonwealth Social Services Department can point to the definition in s 4 to confirm exactly which departmental entity is covered. The instrument does not create any rights for third parties, such as data users or private ADSPs, to challenge the transitional arrangements. Those rights may exist under the DAT Act or administrative law, but not under this instrument.

This instrument does not itself create penalties. Instead, enforcement flows from the DAT Act. If a transitional entity breaches a condition prescribed in this instrument (for example, by providing a prohibited service), the DAT Commissioner may take action under the DAT Act. Specifically, s 81 of the DAT Act allows the Commissioner to cancel an ADSP's accreditation if the entity contravenes a condition of accreditation. Since the transitional entity is deemed an ADSP during the transition period, a breach of these conditions could lead to cancellation. Cancellation under s 81 would end the transition period at the start of the day the cancellation takes effect (s 7(b)(ii) of this instrument). The entity would then lose its deemed ADSP status and could no lawfully provide any regulated data services without full accreditation. The DAT Act also contains offence provisions for unauthorised use or disclosure of data (Pt 4 of the DAT Act), but those are not altered by this instrument. The instrument's conditions are enforceable primarily through the accreditation regime rather than through criminal penalties. However, if a transitional entity provides a service it is not permitted to provide, it may also be acting outside the DAT Act's authorisation for data sharing, potentially exposing it to civil liability for breach of confidence or privacy. The Commissioner's powers under the DAT Act include investigation, compliance notices, and the ability to refer matters to other regulators. The instrument does not specify any penalty amounts or infringement notices. The practical enforcement risk is that the Commissioner will become aware of a breach through complaints, audits, or annual reporting requirements under the DAT Act. Entities that breach conditions may also face reputational damage and loss of user trust. Given that the transition periods are relatively short (ending by July 2025), the Commissioner may take a proportionate approach, but the instrument provides no safe harbour for inadvertent breaches. The instrument itself is a legislative instrument, so it is subject to disallowance by Parliament, but that is a separate enforcement pathway.

This instrument is made under Schedule 3 to the Data Availability and Transparency (Consequential Amendments) Act 2022, which itself amends a suite of other Acts to align them with the DAT Act. The instrument directly interacts with the DAT Act's accreditation framework. It provides transitional relief from the usual accreditation process but does not override the DAT Act's substantive requirements regarding data sharing, security, and privacy. The conditions prescribed in this instrument operate in addition to any other conditions that the DAT Act imposes on ADSPs (as the note to s 6 makes clear). The instrument also interacts with state and territory laws. For example, the definition of Queensland Health refers to the Public Sector Act 2022 (Qld) and a gazette notice. The instrument does not purport to override Queensland law; it merely identifies the entity for Commonwealth transitional purposes. The conditions may also engage state health records legislation, privacy laws, and data sharing arrangements. For instance, the Victorian Department of Health's condition that secure access services be provided only by the Centre for Victorian Data Linkage must be consistent with Victorian health privacy laws. The instrument also interacts with the Social Security (International Agreements) Act 1999 indirectly through the definition of Commonwealth Social Services Department. That reference ties the transitional entity to a specific ministerial portfolio, which could shift with administrative changes. The instrument does not amend the DAT Act itself; it is a standalone legislative instrument that fills a transitional gap. It also interacts with the Privacy Act 1988 and other information commissioners' oversight. The DAT Act itself states that it does not override privacy protections, so this instrument cannot be used to authorise conduct that would breach privacy law. The interaction with competition law is indirect: by limiting the scope of services that public entities can offer, the instrument may reduce the risk of anti-competitive behaviour (e.g., a public entity using its transition to undercut private ADSPs on secure access services). However, the restrictions also entrench existing public data linkage centres, potentially creating barriers to entry for private firms that wish to offer complex integration services. The instrument does not reference the Competition and Consumer Act 2010, but the conditions effectively regulate the scope of government participation in the data services market.

The instrument was made in 2022 and has been amended once. The original version prescribed six transitional entities: Australian Bureau of Statistics, Australian Institute of Family Studies, Australian Institute of Health and Welfare, Commonwealth Social Services Department, Queensland Treasury, and Victorian Department of Health. On a later date, the instrument was amended by the Data Availability and Transparency (Consequential Amendments) Transitional Rules (Transitional Entity) Amendment Rule 2023, which inserted item 4A for Queensland Health. This amendment added Queensland Health as a transitional entity with a separate start date for its transition period: "the day the Data Availability and Transparency (Consequential Amendments) Transitional Rules (Transitional Entity) Amendment Rule 2023 commences." The amendment also introduced the most restrictive conditions of any entity, reflecting perhaps a negotiated scope for Queensland's health data activities. The amendment history is not fully detailed in the source text (the endnotes are not provided), but the text of item 4A and the reference in column 3 clearly indicate the amendment occurred in 2023. No other amendments are mentioned. The instrument itself commenced on the day it was registered (likely in 2022) for most entities. The instrument is subject to periodic review as the transition periods progress. The hard sunset of 30 July 2025 means that after that date the instrument will become effectively spent, unless further amendments extend the transition periods or add new entities. The amendment history is short, but the instrument's importance lies in its operational effect rather than its legislative development.

The source text does not record any litigation history concerning this instrument. No cases are cited in the instrument itself. Given that the instrument is a relatively technical transitional rule, and that the entities listed are government bodies, it is unlikely that there has been any reported litigation directly challenging the instrument. However, it is possible that the instrument has been subject to judicial review in the background, particularly by private sector data service providers who might argue that the transitional treatment gives public entities an unfair competitive advantage or that the conditions are inconsistent with the DAT Act. No such cases have been identified in the source. The instrument's short lifespan (2012-2025) and narrow scope may have limited the incentive for litigation. Alternatively, disputes may have arisen in administrative proceedings before the DAT Commissioner regarding the interpretation of conditions, such as what constitutes "data linkage activities" for Queensland Health's Statistical Services Branch, or whether a particular service falls within the prohibition on secure access data services. These would not be reported as litigation but could form the basis of internal review or Ombudsman complaints. The absence of litigation history does not mean the instrument is uncontroversial; it may simply reflect that the entities have complied, or that disputes have been resolved without court action. For compliance professionals, the lack of judicial guidance means that the DAT Commissioner's interpretations will be the primary source of legal certainty.

Several aspects of the instrument could trap unwary officers or users of data services. First, the conditions are entity-specific and service-specific. The Commonwealth Social Services Department is prohibited from providing secure access data services entirely, but there is no exception for pilot projects or internal testing. Any arrangement that involves a third party gaining remote access to data through a department-managed secure environment would breach the condition. Second, the definition of "Commonwealth Social Services Department" is narrow: it is the department administered by the Minister who administers the Social Security (International Agreements) Act 1999, not the entire Department of Social Services or Services Australia. If machinery-of-government changes move the function to another department, the transitional entity may no longer exist, potentially voiding the transition period. Third, for Queensland Health and Queensland Treasury, the conditions require that certain services be provided only through a designated unit (Statistical Services Branch, Queensland Government Statistician’s Office). If that unit is reorganised or renamed, the condition may become impossible to satisfy, effectively blocking the entity from providing those services for the remainder of the transition period. Fourth, the instrument's transition period ends at the earlier of renewal, cancellation, or 30 July 2025. If an entity inadvertently fails to apply for renewal by that date, it loses its ADSP status immediately. There is no grace period. Any data project that relies on that entity's ADSP services must wind down or find an alternative provider. Fifth, the conditions in column 2 of the table apply "as part of a project". This language may be narrower than the entity's general operations, but "project" is not defined in this instrument. It could be argued that business-as-usual data services are not projects, creating a loophole or ambiguity. Sixth, the instrument does not impose conditions on the ABS, AIFS, or AIHW. Those entities have full flexibility during transition, but they must still comply with all other DAT Act conditions and the general law. Oversight may be less intense, potentially leading to compliance gaps. Seventh, the instrument is a legislative instrument; it may be disallowed by Parliament within a certain period. Entities should not assume the transitional treatment will remain unchanged throughout the period. Finally, the instrument's reliance on external definitions (e.g., "Queensland Health" via a gazette notice) means that changes in state administrative arrangements automatically change the entity's status under this instrument. Practitioners must monitor those notices.

For each transitional entity, compliance requires a three-step approach. First, identify the specific conditions in column 2 of the table in s 5 that apply to the entity. If no conditions are listed (as for the ABS, AIFS, and AIHW), the entity can provide all ADSP services during transition, subject to the DAT Act's other conditions. For entities with conditions, prepare an internal register of which services are permitted and which are prohibited, and under what conditions. Second, restrict service delivery to match those conditions. For example, the Commonwealth Social Services Department must ensure that no project involving secure access data services is undertaken. This means no remote data lab access for external users, no virtual desktop environments for analysts, and no online secure portals for data extraction. The department should audit existing data projects to identify any that involve secure access and either restructure them (e.g., provide data only through other means like de-identified files) or terminate them. For Queensland Health, complex data integration must be channelled through the Statistical Services Branch and limited to data linkage activities. Any project that falls outside that scope (e.g., statistical modelling using linked data) may still be prohibited unless the branch provides only the linkage and another entity performs the modelling. The entity should establish internal protocols to route all requests for complex integration through the branch and to verify that the branch is only performing linkage, not additional services. Queensland Health must also ensure no secure access or de-identification services are provided at all. The Victorian Department of Health must route all three restricted service types through the Centre for Victorian Data Linkage. Third, monitor the transition period end date. The end is the earliest of renewal under s 84, cancellation under s 81, or 30 July 2025. Entities should apply for full accreditation under s 84 well before July 2025 to avoid a gap. The Commissioner takes time to assess applications, so an application lodged in June 2025 may not be processed before the sunset. If accreditation is renewed, the transition period ends at the start of the renewed accreditation, meaning the entity must cease providing services under the transitional regime immediately, but can continue under the renewed accreditation. If the Commissioner cancels accreditation (e.g., for breach of conditions), the entity must cease all ADSP services at the start of the cancellation day. Fourth, keep records of how each project complies with the conditions. This will assist in any audit by the Commissioner. Fifth, review the definitions in s 4 to confirm the entity's identity. If administrative changes occur (e.g., a department is renamed), seek legal advice on whether the entity still falls within the definition. Finally, communicate with data users: inform researchers and partner agencies about the service restrictions so they can plan accordingly. For users outside the entity, compliance involves verifying that the entity is within its transition period and that the service being provided is not prohibited. Users should request written confirmation from the entity at the start of each project.