Public Sector (Data Sharing) Act 2016

The Act builds around a few organising legal concepts that determine who may share what, for what purposes, and with what safeguards.

• Public sector data, data provider, data recipient, data analytics work. The Act defines "data" broadly as facts, statistics, instructions, concepts or other information capable of being communicated, analysed or processed (s 3). "Public sector data" is any data a public sector agency controls (s 3). The actor roles are data provider (the public sector agency that controls the data) and data recipient (the public sector agency receiving it) (s 3). "Data analytics work" is examination and analysis of data to draw conclusions, including conclusions about policy efficacy, program management, or service delivery (s 3).

• Trusted access principles. The Act sets a fourfold assessment framework: safe projects (assessment of purpose and public interest), safe people (recipient capability and motivations), safe data (de‑identification and data quality), safe settings (storage, security and handling), and safe outputs (assessment of publication and re‑identification risk) (s 7(2)-(6)). Regulations may add further principles (s 7(7)).

• Authorisation regimes. There are three pathways for lawful sharing between public sector agencies:

  1. General authorisation for sharing non‑exempt public sector data where the provider applies the trusted access principles and records the purpose in writing (s 8(1)-(3)).
  2. Ministerial direction compelling a provider to share specified data including exempt public sector data, subject to specification of nature and purpose and the Minister having regard to the trusted access principles (s 9(1)-(3)).
  3. ODA directions where ODA, with the Minister’s written approval, can direct an agency to provide data to ODA (s 6(4)-(6)).

• Exempt public sector data. The Act contemplates categories of exempt public sector data that are defined or prescribed by regulation (s 3). The Minister may nonetheless direct sharing of exempt data under s 9, subject to procedural guards.

• Interaction with FOI and State Records regimes. The Act modifies Freedom of Information consequences where a document is provided by a data provider to a data recipient: the data recipient must not release the document under FOI, must refer FOI requests to the provider and transfer the application as if under s 16(1)(b) of the Freedom of Information Act 1991, but the data recipient is not required to forward a copy of the document (s 5(3)). The Act also requires compliance with legal custody and control obligations such as those under the State Records Act 1997 (s 5(2)(b), s 11(1)-(2)).

• Ministerial agreements with external entities. Part 6 allows the Minister to enter agreements with "relevant entities" which may include Commonwealth agencies, other States, councils, or prescribed bodies, and to direct agencies to provide data to those entities in accordance with agreements (s 13). Agreements may set conditions including the use of trusted access principles and may make sharing lawful despite contrary legislation (s 13(2), (4)-(5)). Certain FOI exclusions apply when a relevant entity provides documents under such agreements (s 13(7)).

• Safeguards and accountability. The Act imposes confidentiality obligations to respect contractual or equitable confidentiality (s 10), custody and control duties to comply with statutory records obligations (s 11), requirements for contractual protections where non‑public sector contractors perform analytics (s 11(2)), and further regulatory safeguards (s 12). The Minister must report annually on directions, ODA directions and agreements, and submit to a statutory review by a retired judicial officer after three years (ss 17, 19).

• Liability. Individuals acting honestly in administration of the Act incur no civil or criminal liability; civil actions instead lie against the Crown save in certain corporate contexts (s 16). The Act expressly excludes that protection for relevant entities that enter into agreements under Part 6 (s 13(6)).

These concepts combine a permissive authorisation structure with a set of administrative and technical safeguards. The law grants broad discretion through Ministerial powers, delegated ODA directions and regulations, while imposing procedural controls such as written records, application of trusted access principles, Gazettal and parliamentary tabling of directions and approvals, and reporting requirements.

The Act affects a defined set of actors directly, and several categories indirectly.

Directly affected persons and bodies

• Public sector agencies. The Act applies to public sector agencies as defined in the Public Sector Act 2009, subject to any regulations that exclude or include particular persons or bodies (s 3). Agencies that control data are liable as data providers and agencies receiving data are data recipients. Agencies must apply the trusted access principles before sharing, keep written records of purpose (s 8(2)), comply with custody and confidentiality safeguards (ss 10-12), and respond to Ministerial directions (s 9).

• The Minister. The Minister gains express powers to direct agencies to share data including exempt data (s 9), to designate an agency or part thereof as ODA (s 6(1)), to approve ODA directions (s 6(4)-(6)), to enter into data sharing agreements with relevant entities and to direct compliance with such agreements (s 13), to delegate functions (s 15), and to publish notices and lay them before Parliament (ss 9(6), 14(2), 15(3)). The Minister must have regard to the trusted access principles before making certain decisions (s 6(5), s 9(3)) and must publish annual reports (s 17).

• Office for Data Analytics (ODA). If designated, ODA becomes a public sector agency in its own right (s 3(3)). Its functions include conducting data analytics on whole‑of‑government data, making results available to public sector agencies, the private sector and the public, and performing any functions conferred by the Minister (s 6(2)-(3)). With Ministerial approval it can direct agencies to provide data (s 6(4)).

• Relevant entities entering agreements. The Minister may enter into agreements with Commonwealth or other State/Territory agencies, councils, or prescribed persons or bodies (s 13). Relevant entities that enter agreements must comply with conditions of the agreement (s 13(3)), but do not receive the personal liability protection granted by s 16(1) (s 13(6)). Documents provided by many relevant entities under agreements may be exempt from FOI (s 13(7)).

Indirectly affected persons and interests

• Individuals whose personal information is in public sector data. The Act directly addresses personal information by requiring personal information to be de‑identified in most cases before sharing (s 7(4)(a)), and by listing exceptions where identifiable personal information may be shared (e.g. consent, related original purpose, criminal investigations, child protection, urgent threats to life, impracticability of consent) (s 7(4)(a)(i)-(vii)). Individuals have indirect protections through those statutory safeguards, State Records obligations (s 11(1)) and confidentiality obligations (s 10).

• Private sector bodies that may receive outputs. ODA may make analytic outputs available to the private sector (s 6(2)(b)). The Act also contemplates contractual arrangements with non‑public sector contractors to perform data analytics on behalf of a data recipient, but requires that contractual arrangements ensure compliance with the Act, the State Records Act and applicable security policies (s 11(2)).

• Freedom of Information requesters. The Act modifies FOI practice where data are shared internally: a document transferred from a data provider to a data recipient must not be released by the data recipient under FOI and must be referred to the data provider (s 5(3)). For documents provided to the Minister by a relevant entity under agreements, FOI may not apply in certain cases (s 13(7)). These provisions change who is the FOI locus for particular documents.

• Contractors, external analysts and third parties. If a data recipient outsources analytics work to a non‑public sector person or body, the recipient is required to have appropriate contractual protections in place to ensure compliance with this Act, the State Records Act and security policies (s 11(2)). Those third parties therefore must structure contracts and security to meet statutory standards.

Who pays and who decides

• Costs. The Act does not specify fee arrangements for data sharing or analytics. Costs for data management, security, de‑identification, contractual arrangements and compliance will fall on data providers and data recipients and on any agency designated as ODA. The Minister decides many of the operational parameters through approvals, directions and agreements (ss 6, 9, 13), and regulations (s 18) may allocate further responsibilities.

• Decision‑makers. The Minister is the principal decision maker for designating ODA, approving ODA directions, directing agencies to provide data (including exempt data), entering agreements with relevant entities, delegating functions and choosing to publish notices and reports (ss 6, 9, 13, 15, 17). Data providers retain responsibility for release of public sector data outside the public sector under the Freedom of Information Act 1991, as stated among the objects (s 4(d)(iii)).

In effect, the Act reallocates practical decision rights to the Minister and to data providers acting under statutory authorisations, while imposing procedural duties and reporting obligations on agencies and creating formal pathways for cross‑agency and cross‑jurisdictional sharing of data.

The Act imposes a set of procedural duties on agencies and administrative actors, while granting rights or authorisations to share data and to direct sharing. The duties and rights are procedural and relational rather than creating new property rights in data.

Principal rights and authorisations

• Authorisation to provide public sector data. A public sector agency is authorised to provide non‑exempt public sector data it controls to other public sector agencies for listed purposes, including enabling data analytics work and facilitating policy, program management and service delivery (s 8(1)). The authorisation is conditional on compliance with the Act, including trusted access principles and recordkeeping (s 8(2)-(4)).

• Ministerial direction. The Minister may direct an agency to provide any public sector data it controls, including exempt data, for the purposes set out in s 8(1) (s 9(1)). A direction is binding on specified agencies and must specify nature, extent and purpose of data provided (s 9(2)). The Minister must have regard to the trusted access principles before making a direction (s 9(3)).

• ODA powers. When designated, ODA may perform whole‑of‑government analytics and, with the Minister’s written approval, direct agencies to provide data to ODA (s 6(2)-(4)). ODA may also publish results to public sector agencies, private sector and the public (s 6(2)(b)).

• Agreements with relevant entities. The Minister may enter data sharing agreements with relevant entities and may direct agencies to provide data in accordance with those agreements (s 13(1), (4)-(5)). Agreements may lawfully authorise sharing that would otherwise be prohibited by other Acts (s 13(5)).

Principal duties and safeguards

• Trusted access principles. Before sharing, providers and decision makers must apply the trusted access principles covering safe projects, safe people, safe data, safe settings and safe outputs (s 7). The Minister must have regard to those principles before approving ODA directions and before directing agencies to provide data (ss 6(5), 9(3)). The Act requires assessment of necessity, public value, balance of public interest, data quality, de‑identification and technical security measures (s 7(2)-(6)).

• Written record of purpose. Before data is provided under s 8, the data recipient must make a written record of the agreed purpose(s), and the data provider must apply the trusted access principles and be satisfied of appropriateness (s 8(2)).

• Confidentiality and commercial‑in‑confidence. Data recipients must ensure confidential or commercially sensitive information received under Part 3 or Part 4 is dealt with in accordance with any contractual or equitable obligations the data provider has to maintain confidentiality (s 10(1)). The Act defines confidential or commercially sensitive information to include information required to be kept confidential under contract or other information whose disclosure would prejudice legitimate business interests (s 10(2)).

• Data custody and control. Providers and recipients must maintain public sector data in compliance with any legal requirements concerning custody and control, including the State Records Act 1997 (s 11(1)). If analytics are outsourced to a non‑public sector person or body, the recipient must ensure appropriate contractual arrangements are in place to ensure compliance with this Act, the State Records Act and applicable data security policies (s 11(2)).

• Restrictions on further use and disclosure. A data recipient must not use or disclose data received under the authorisations in ss 8 or 9 for a purpose other than that for which it was provided, unless the Minister approves after consulting the data provider, or the use is authorised by law, required to prevent a serious threat to life or public health, or is in accordance with the regulations (s 14(1)). Ministerial approvals must be Gazetted and tabled in Parliament (s 14(2)-(3)).

• FOI procedure on transferred documents. If a document is provided by a data provider to a data recipient, the Freedom of Information Act 1991 treats the document in a specific way: the data recipient must not provide access under FOI, must refer FOI applications to the data provider and the application is treated as transferred to the provider (s 5(3)). This shifts FOI responsibility to the data provider in specified situations.

Administrative duties and transparency

• Publication and tabling. The Minister must publish and table directions, approvals and delegations in the Gazette and before both Houses of Parliament within specified periods (ss 9(6), 14(2), 15(3)). The annual report must include lists of ODA directions, Ministerial directions, and agreements including the identities of providers and recipients, nature of data and whether data contained personal information or was exempt (s 17(2)).

• Regulations and codes. The Governor may make regulations for the Act (s 18). Regulations may delegate decision making to the Minister or a prescribed person (s 18(2)(c)) and may refer to external codes or standards (s 18(2)(d)).

Rights to protection and limitation of liability

• De‑identification and limited sharing of personal information. Personal information carried in shared data must be de‑identified unless certain exceptions apply such as consent, related purpose, criminal investigations, child protection or serious threat to life, or impracticability of using de‑identified data, or if the sharing is for a prescribed purpose (s 7(4)(a)(i)-(vii)). The Act also requires assessment of de‑identification methodology and re‑identification risk (s 7(4)(b)(iii)).

• Personal liability protection. A person acting honestly and in exercise or purported exercise of functions under the Act has no civil or criminal liability; civil actions instead lie against the Crown in most cases (s 16). This protection aims to safeguard administrators who act pursuant to the Act from personal claims. Relevant entities that enter agreements, however, do not receive the benefit of s 16(1) (s 13(6)).

The duties in the Act are prescriptive in process and protective of certain interests, but enforcement and sanctioning for breach is largely through compliance obligations, contractual mechanisms and existing recordkeeping and FOI laws rather than a novel penalty structure created in the Act itself.

The Act does not create a statutory schedule of fines or criminal offences for non‑compliance, nor does it prescribe an independent regulatory enforcement agency to police breaches. Enforcement and remedies under the Act therefore rely on a combination of statutory authorisations and administrative oversight, contractual obligations, interaction with existing laws (for example, the State Records Act 1997 and the Freedom of Information Act 1991), and, where applicable, equitable or contractual relief in the courts.

Key enforcement and deterrent mechanisms in the Act

• Administrative coercive powers. The Minister may direct agencies to provide data, including exempt data (s 9(1)). A direction is binding on the named agencies (s 9(2)(b)) and must specify the data and purpose (s 9(2)(c)). The binding nature of directions is an administrative enforcement mechanism; it is enforced through the hierarchical relationship between agencies and the Minister, publication requirements and parliamentary visibility (s 9(6)). Likewise, the Minister can direct agencies to comply with terms of agreements with relevant entities (s 13(4)).

• Contractual remedies. The Act requires recipients who outsource to non‑public sector contractors to ensure contractual arrangements provide compliance with this Act and the State Records Act and relevant security policies (s 11(2)). Where confidential or commercially sensitive information is shared, data recipients must comply with the data provider’s contractual or equitable confidentiality obligations (s 10(1)). Breaches of those contractual obligations remain enforceable by contractual remedies such as damages or injunction, and equitable remedies if appropriate.

• Statutory obligations under other laws. The Act expressly requires compliance with legal custody and control obligations such as under the State Records Act 1997 (s 11(1)), and modifies FOI processes for transferred documents (s 5(3)). Breaches of those other statutes can attract the enforcement and remedial mechanisms those statutes provide.

• Transparency and parliamentary oversight. The Act requires Gazettal and tabling in Parliament of Ministerial directions, approvals for further use or disclosure, and delegations (ss 9(6), 14(2), 15(3)). The Minister must produce an annual report identifying instances of sharing, directions and agreements, including whether personal information or exempt data were involved (s 17). These transparency requirements create reputational and political accountability pressures.

• Liability allocation. The Act removes civil and criminal liability for persons acting honestly in the administration of the Act, substituting liability against the Crown for civil actions in most cases (s 16(1)-(2)). This reduces the personal enforcement risk for administrators acting under the Act but does not, on its face, remove the ability of the Crown to be sued. Notably, relevant entities that enter agreements under Part 6 are not covered by s 16(1) (s 13(6)), meaning they remain potentially exposed to civil or criminal liability for their actions under ordinary law.

What the Act does not provide

• No express criminal sanctions or civil penalty regime in the Act. There are no specific criminal offences tied to particular breaches of the Act’s safeguards within the text provided. The Act relies on other legal regimes (contract, equity, State Records Act, criminal law where applicable) to provide remedies for breaches of confidentiality or misuse, rather than creating new offences.

• No independent oversight or investigatory body. The Act does not establish an inspectorate or statutory regulator specifically tasked with auditing compliance or imposing sanctions. The ODA, if designated, is an analytics body rather than an enforcement regulator (s 6). Oversight is instead performed by internal agency processes, the Minister’s oversight powers, parliamentary scrutiny via tabling and annual reports, and the scheduled external review by a retired judicial officer after three years (s 19).

Practical enforcement consequences and risks

• Enforcement is predominantly administrative and contractual. Practically, the risk of non‑compliance is addressed by agencies through procedural controls, recordkeeping, contractual indemnities with vendors, and reliance on existing recordkeeping and FOI frameworks.

• Reputational and political enforcement. Because the Minister must publish and table directions and approvals (ss 9(6), 14(2)), and because the annual report must list instances of sharing including use of personal or exempt data (s 17(2)), non‑compliance or controversial sharing decisions become visible to Parliament and the public, which can be a powerful enforcement mechanism.

• Litigation exposure remains grounded in other causes of action. Where a participant in the regime breaches contractual confidentiality, misuses data, or contravenes other laws, it may face contractual claims, equitable remedies, breaches of privacy torts where available, or criminal liability under other statutes. The Act’s personal liability protection for honest administrators shifts civil exposure to the Crown for such administrators (s 16(1)-(2)).

In short, the Act establishes a permissive and administratively enforced data‑sharing regime with transparency obligations and reliance on existing legal frameworks for sanctions and remedies, rather than a novel punitive enforcement apparatus.

The Act is explicitly drafted to interact with and, in limited circumstances, to displace or modify the operation of other legislation. The Act also places obligations on agencies to comply with existing statutes governing records and information. The principal statutory interactions set out in the Act are with the Freedom of Information Act 1991, the State Records Act 1997 and the Public Sector Act 2009, plus the general possibility of interaction with other Commonwealth, State or Territory laws when the Minister enters agreements.

Freedom of Information Act 1991

• Transfer and access rules. When a document is provided by a data provider to a data recipient under the Act, the Act specifies that a person does not have a right to access the document from the data recipient under the Freedom of Information Act and the data recipient must not give access (s 5(3)(a)). Instead, the data recipient must refer any FOI application to the data provider and the application is taken to be transferred to the data provider under s 16(1)(b) of the Freedom of Information Act 1991; the data recipient is not required to forward a copy of the document (s 5(3)(b)). This shifts the locus of FOI responsibilities to the original data provider for transferred documents.

• FOI exclusion for relevant entities. Section 13(7) provides that the Freedom of Information Act 1991 does not apply to or in relation to a document provided by a relevant entity, except where the relevant entity is a person or body prescribed under paragraph (c) of the relevant entity definition. This creates a statutory FOI exclusion for many documents provided under Part 6 agreements, subject to regulatory prescription.

State Records Act 1997

• Custody and control. The Act requires data providers and recipients to maintain and manage shared public sector data in compliance with any legal requirements concerning custody and control, giving the State Records Act 1997 as an example (s 11(1)). When outsourcing analytics, the recipient must ensure contractual arrangements require the third party to comply with the State Records Act 1997 and applicable data security policies (s 11(2)). This preserves the application of the State Records framework to data shared under the Act.

Public Sector Act 2009

• Definition of public sector agency. The Act adopts the definition of "public sector agency" from the Public Sector Act 2009, subject to regulations that can exclude or include specific persons or bodies (s 3). This links the identities of data providers and recipients to the broader public sector governance framework.

Other Acts that would otherwise prohibit disclosure

• Lawfulness despite prohibitions. The Act provides that the provision of public sector data by an agency to another is lawful for the purposes of any other Act or law that would otherwise prohibit that provision if the sharing is authorised by this Act and the data is used only for the authorised purpose (s 5(1)). This is a limited statutory displacement: the Act operates as a specific authorisation that can override otherwise applicable prohibitions on disclosure, but only in the context of authorised sharing and limited to the authorised purpose.

Ministerial agreements with other jurisdictions and entities

• Data sharing agreements and cross‑jurisdictional sharing. Part 6 authorises the Minister to enter into agreements with Commonwealth agencies, other States, Territories and councils, or prescribed bodies (s 13(1), (8)). The Act makes data provision under such agreements lawful despite other prohibitions, if provided in accordance with the agreement (s 13(5)). This allows interstate and intergovernmental data cooperation and data sharing with local government, subject to agreement conditions.

Regulations and external codes

• Regulations may confer discretion, prescribe further safeguards, and incorporate external standards. Section 18 allows the Governor to make regulations that are necessary or expedient for the Act, including providing for matters to be determined in the discretion of the Minister or a prescribed person (s 18(2)(c)) and referring to or incorporating external codes or standards (s 18(2)(d)). Where regulations incorporate external documents, the regulations must make those documents available for inspection (s 18(3)). This mechanism allows the operational interfaces with other technical or sectoral standards to be incorporated by regulation.

FOI and accountability tradeoffs

• FOI transfer and exclusion provisions change access routes. By shifting FOI access responsibility to data providers for transferred documents (s 5(3)) and by excluding FOI rights for documents provided by relevant entities under certain agreements (s 13(7)), the Act modifies who is the proper FOI recipient and in some cases limits FOI access. Those interactions alter the balance between transparency and confidentiality as prescribed in the Freedom of Information Act.

No creation of overriding criminal immunities

• Liability interplay. The Act provides personal liability protection for honest administrators (s 16) but does not purport to exclude the operation of criminal laws generally. The Act leaves intact the potential for criminal liability under other statutes for unlawful conduct, except it immunises persons acting honestly in administration from civil and criminal liability in consequence of so acting (s 16(1)). Relevant entities that enter into agreements do not receive that protection (s 13(6)).

In sum, the Act is designed to sit alongside and in some cases modify the operation of existing statutes. Practitioners must read the Act together with the Freedom of Information Act 1991, the State Records Act 1997, the Public Sector Act 2009 and any regulations made under s 18 to understand fully how a particular sharing arrangement will operate legally.

The text provided records the primary legislative history for the Public Sector (Data Sharing) Act 2016 as enacted in South Australia but does not show subsequent amending Acts in the excerpt. The legislative history in the Act identifies the principal Act as:

• Public Sector (Data Sharing) Act 2016, No 61 of 2016, assented on 8 December 2016 and commenced by proclamation on 30 May 2017 (Gazette 30.5.2017 p1982).

The Act itself anticipates that subordinate legislation and regulations will be made under s 18, including prescription of exempt public sector data, extension or limitation of the definition of public sector agency, and the prescription of additional trusted access principles (s 3(1) definition of "exempt public sector data", s 3(2) power to exempt certain persons, and s 7(7) for prescribed trusted access principles). Those regulatory powers represent the primary vehicle for future amendment of operational detail without amending the principal Act.

Statutory review requirement

• The Act mandates a formal review process: the Minister must, as soon as practicable after the third anniversary of commencement, appoint a retired judicial officer to conduct a review of the operation of the Act (s 19(1)). The review must be completed within six months of appointment and the report must be laid before Parliament (ss 19(3)-(4)). This review mechanism ensures there is at least one legislatively required point for evaluating the Act’s operation and could lead to legislative amendments or regulatory changes following the review.

Scope for future change via regulations

• Section 18 gives the Governor a broad power to make regulations that are necessary or expedient for the Act, including incorporating external codes or standards and delegating discretions to the Minister or another prescribed person (s 18(2)(c)-(d)). Thus, much of the Act’s detailed operational regime is expected to be fleshed out by regulations and subordinate instruments. Practitioners should therefore monitor the relevant regulations and any standard‑setting instruments incorporated by reference.

No amendments recorded in the provided excerpt

• The supplied legislative history does not list subsequent amending Acts or modifications to the principal Act beyond the commencement note. For current legal practice, users must consult the consolidated statute and the South Australian legislation website to identify any enacted amendments, replacing or updating regulatory instruments, and any instruments made under s 18 since commencement.

In practice, because the Act entrusts significant operational detail to regulations and Ministerial practice, the amendment history will be meaningful both in statutory amendments and in the body of subordinate instruments and administrative practice that implement the Act’s powers.

The text of the Act itself contains no references to judicial decisions, and the provided legislative history lists only the principal Act’s assent and commencement dates. The Act does not set out precedent or identify any litigation. Therefore, as drafted, there is no litigation history recorded in the statutory text provided.

What practitioners should note

• No cases are cited in the Act. The statute is new and self‑contained in the form provided. It embeds administrative powers and procedural duties but creates few direct causes of action; disputes arising from data sharing will likely be litigated under other legal heads such as contract, equity, tort (where applicable), privacy statutes, or under other specific legislation on records or confidentiality.

• Likely litigation pathways. Absent express penalties in the Act, potential litigation stemming from the operation of the Act could include:

  • Contract and equitable claims for breach of confidentiality where confidential or commercially sensitive information is disclosed contrary to contractual equitable duties referred to in s 10(1).
  • Judicial review proceedings challenging the exercise of Ministerial powers (for example, s 9 directions or s 13 agreements), on customary public law grounds such as jurisdictional error, failure to have regard to mandatory considerations (for instance the trusted access principles where the Act requires the Minister to have regard to them, ss 6(5), 9(3)), procedural unfairness, or irrationality.
  • Actions under the State Records Act 1997 or other statutory regimes in cases of failure to comply with records or custody obligations as flagged in s 11(1).
  • FOI review or administrative law challenges if there is dispute about the proper handling of FOI applications under the Act’s transfer/exclusion provisions (s 5(3), s 13(7)).

• Precedent will develop in time. Because the Act gives the Minister and agencies broad discretion, and because it modifies FOI and records interactions, litigation is most plausibly directed at the boundaries of those discretions and at whether the statutory safeguards (for example, application of trusted access principles) have been properly applied.

Practical recommendation for lawyers researching litigation issues

• Search jurisdictions’ consolidated legislation and case law databases for post‑2017 decisions referencing the Act. The Act requires a statutory review after three years (s 19), and that review and subsequent reporting may have generated administrative or legal disputes that are not reflected in the Act text.

• Examine FOI review tribunal or administrative decisions for disputes about the Act’s s 5 and s 13 FOI‑related provisions. Disputes about whether a document was properly transferred or excluded from FOI may produce case law clarifying the Act’s operation.

Because the text supplied contains no litigation record, a practitioner must conduct a jurisdictional case law search to identify any reported decisions interpreting or applying the Act since commencement.

This Act contains several features that are practically consequential but may be overlooked if one reads it superficially. Below are practical points that frequently create compliance or governance risks.

Ministerial direction over exempt data

• The Minister can direct sharing of exempt public sector data, including data that regulations might otherwise shield (s 9(1)). Although the Minister must have regard to the trusted access principles (s 9(3)), the statutory power to direct is broad and binding on agencies (s 9(2)(b)). Practitioners should note that exemption under the Act’s definition does not block a Ministerial directive; it only changes the procedural posture.

FOI shifting and exclusions

• Transfer of FOI responsibility. When a document is provided by a data provider to a data recipient, the data recipient must not provide access under FOI and must refer an FOI application to the data provider; the application is treated as transferred under the Freedom of Information Act 1991 (s 5(3)). This changes the practical FOI access point and can confuse requesters and agencies about where to apply.

• FOI carve‑out for relevant entities. Documents provided by relevant entities under Part 6 agreements may not be subject to FOI (s 13(7)), subject to regulatory prescription. That can create an accountability blind spot if the agreement covers material that would otherwise be accessible.

De‑identification and re‑identification risk

• De‑identification is required for personal information in most cases but permissible exceptions exist (s 7(4)(a)). The Act imposes duties to assess re‑identification risk and to document methods (s 7(4)(b)(iii)). Practitioners should avoid assuming de‑identification eliminates all risk; the Act requires assessment and evaluation of re‑identification pathways.

ODA publication of results

• ODA may make results public and supply them to the private sector (s 6(2)(b)). Data providers and recipients must consider that analytic outputs may be published and thus subject to the safe outputs assessment (s 7(6)). That means internal data sharing could indirectly expose data subjects if outputs are published without adequate mitigation.

Delegations and discretion

• The Minister may delegate functions and those delegations may be further delegated if the instrument so provides (s 15(2)(c)). Delegations must be published and tabled (s 15(3)). Delegation chains can make accountability tracing more complex; ensure delegation instruments are clear and examine whether delegated decision‑makers are applying mandated considerations such as the trusted access principles.

Liability shield exceptions

• Broad personal liability protection for honest actors exists (s 16(1)), but relevant entities that enter into Part 6 agreements do not get that protection (s 13(6)). Entities from the private sector or other jurisdictions need to appreciate they remain directly exposed to normal civil and criminal liability.

Outsourcing risks

• If a data recipient uses a non‑public sector person or body to conduct analytics, the recipient must ensure contracts require compliance with this Act, the State Records Act and data security policies (s 11(2)). Failure to contract appropriately could leave the recipient exposed to breaches of confidentiality, records obligations and security incidents.

Regulatory and standards gaps

• The Act leaves high dependence on regulations and incorporated codes or standards (s 18). Many operational rules are therefore not in the principal Act; absence of regulations at the time of implementation could create legal uncertainty. Check whether regulations and any incorporated standards have been made and are publicly accessible as required by s 18(3).

FOI and public access expectations

• The annual report must list instances where personal information was shared and whether data was exempt at the time of direction or sharing, but the Act does not require detailed disclosure of content (s 17(2)). Public expectations of transparency may be frustrated by the combination of FOI exclusions, Ministerial approvals and the limited disclosure required in the annual report.

No express penalties in the Act

• The Act does not create specific offences or civil penalties for breaches of its safeguards. Enforcement instead relies on contractual remedies, other statutory regimes and reputational accountability. Agencies should not assume that the absence of express penalties means there is no practical legal risk; breaches may trigger other legal consequences.

For practitioners these "gotchas" mean that the Act requires careful governance, documentation and contractual discipline. The statutory framework creates powerful administrative paths for sharing but leaves many implementation details to subordinate instruments and administrative practice; those are the areas that generate most compliance risk.

Compliance under the Act requires a combination of procedural controls, technical measures, contractual provisions and governance steps. The Act prescribes clear points where paperwork, security and decision records are mandatory; complying agencies should embed those into operational processes.

1. Governance and decision records

• Document purposes and approvals. Before providing public sector data under s 8, the data recipient must make a written record of the purpose or purposes for which the data is proposed to be provided and used as agreed with the data provider, and the data provider must apply the trusted access principles and be satisfied of appropriateness (s 8(2)(a)-(b)). Establish standard templates to record purpose, legal basis, assessment outcomes under the trusted access principles and approvals. Retain the records for audit and reporting.

• Ministerial approvals and directions. If a sharing arrangement requires Ministerial approval or a Ministerial direction (s 6(4), s 9(1)), ensure records capture the Minister’s assessment of the trusted access principles, and retain the Gazetted notices and parliamentary tabling proof (s 9(6)). Update governance registers when directives are published.

2. Apply the trusted access principles (s 7)

• Safe projects. Record necessity, public value, public interest balancing, and whether lack of sharing would cause community harm (s 7(2)). Use a risk‑based template to capture public interest balancing and alternatives analysis.

• Safe people. Carry out capability assessments of the data recipient and any third party, include evidence of security clearances, staff vetting, and limit access to authorised persons (s 7(3)). Document collaboration arrangements with data providers and record motivations of invested third parties (s 7(3)(c)-(d)).

• Safe data. Perform and document de‑identification assessments and methodologies where personal information is involved; use the statutory exceptions only where justified and recorded (s 7(4)(a)-(b)). Test for re‑identification risk and document mitigations (s 7(4)(b)(iii)).

• Safe settings. Ensure storage location, linked data sets, encryption, authentication and physical security are appropriate and documented (s 7(5)). Capture how data will be handled after the project ends (s 7(5)(e)).

• Safe outputs. Assess proposed publication, the likely audience, and re‑identification linkages (s 7(6)). If outputs will be published or supplied to the private sector, involve the data provider in auditing where appropriate (s 7(6)(d)).

3. Contractual and procurement controls

• Outsourcing analytics. If analytics are outsourced, ensure contracts require compliance with this Act, the State Records Act 1997 and applicable data security policies (s 11(2)). Specify technical standards, access restrictions, breach reporting requirements, audit rights, return/destruction obligations and indemnities.

• Confidentiality and commercial‑in‑confidence. Where shared data includes confidential or commercially sensitive information, ensure recipients are contractually bound to respect the data provider’s contractual and equitable confidentiality obligations (s 10(1)). Create clauses that map the data provider’s obligations into the contract.

4. Records and State Records Act compliance

• Custody and control. Maintain data in compliance with legal custody and control requirements such as the State Records Act (s 11(1)). Implement recordkeeping retention schedules that align with State Records obligations and the sharing purpose.

• FOI handling. For documents transferred under the Act, ensure FOI applications are referred to the data provider rather than released by the recipient, and document the transfer steps under s 5(3). Establish a protocol for dealing with FOI requests where the FOI exclusion under s 13(7) may apply.

5. Security and technical measures

• Implement technical security as called for in the safe settings principle, including secure login, multi‑factor authentication, encryption, logging and monitoring, supervised use, and data minimisation (s 7(5)(c)-(d)). Keep a security control inventory linked to the trusted access assessment.

• De‑identification and re‑identification monitoring. Apply standardised de‑identification techniques, document them, and run re‑identification risk assessments. Consider periodic re‑identification testing and audits, especially if datasets are linked.

6. Reporting and transparency

• Annual report inputs. Maintain a register of all instances of data sharing, Ministerial directions, ODA directions and Part 6 agreements so the Minister can perform the annual reporting obligations (s 17). Ensure entries capture provider and recipient identities, nature of data, whether personal information or exempt, and purposes for sharing (s 17(2)(a)-(e)).

• Gazettal and parliamentary notices. For directions, approvals or delegations, ensure publication in the Gazette and tabling before Parliament within required timeframes (s 9(6), s 14(2), s 15(3)).

7. Legal and privacy counsel and training

• Legal review. Have legal counsel assess sharing proposals for compliance with this Act, the Freedom of Information Act 1991, the State Records Act 1997 and any sectoral legislation that may still constrain uses despite the Act’s authorisation (s 5(1)-(2)).

• Staff training. Train staff involved in data handling on the trusted access principles, de‑identification standards, contractual requirements, FOI referral obligations and breach reporting processes.

8. Monitor regulation and standards updates

• Track regulations. The Act allows substantial detail to be prescribed by regulation and for external codes to be incorporated (s 18). Monitor the Gazette and central legislative registers for regulations under s 18 and any codes that are incorporated by reference, and ensure organisational policies are updated accordingly.

9. Incident response and breach processes

• Prepare incident plans. Establish incident response plans that address unauthorised access, re‑identification incidents, inadvertent disclosure, breaches by contractors, and obligations under the State Records Act and other regimes. Ensure contractual clauses with third parties require immediate notification and cooperation.

10. Ministerial and governance interface

• Engagement with data providers. Ensure data providers are engaged early in project design, as the provider must be satisfied before sharing and retains FOI responsibilities for transferred documents (s 8(2), s 5(3)). Build cross‑agency governance committees for complex projects and for projects involving ODA or relevant entity agreements.

Compliance under the Act therefore requires an operational programme combining legal, technical and governance controls, careful recordkeeping for statutory reporting and transparency, and contract drafting that maps statutory duties into enforceable obligations with third parties.