Public Sector (Data Sharing) Regulations 2017

The regulations operate within the conceptual framework of the Public Sector (Data Sharing) Act 2016, which establishes a permissive data sharing regime for South Australian public agencies. The central concept is that data held by one public sector agency may be shared with, or disclosed to, another agency or a relevant entity for prescribed purposes, subject to trusted access principles and safeguards. The regulations flesh out the boundaries of that regime.

The first key concept is “exempt public sector data”. This is data that cannot be shared or disclosed under the Act at all, unless another law authorises or requires it. The Act defines this term by reference to two limbs: agencies prescribed by regulation and categories of data prescribed by regulation. The regulations use both. The exempt agencies are oversight and accountability bodies, which the drafters considered should not have their data drawn into the sharing system because of potential conflicts with independence or confidentiality. The exempt data categories protect legal professional privilege, mediation confidentiality, criminal intelligence, court processes, parliamentary privilege and national security. These exclusions reflect a deliberate choice to prioritise existing legal protections over the benefits of sharing.

The second key concept is “prescribed data sharing purposes”. The Act provides that data may be shared or disclosed for the purposes for which it was collected, for a purpose directly related to that purpose, or for a prescribed purpose. The regulations prescribe a limited set of additional purposes that are not directly related to the original collection. These purposes are law enforcement, emergency planning and response, and the specific use of motor vehicle photographs for firearms, harbors and navigation, and passenger transport licences. The inclusion of law enforcement and emergency response as prescribed purposes allows data to be used for these ends even where the original collection was for a different purpose. The photograph purpose is very narrow: it only covers the inclusion of an existing motor vehicle photo in a licence or identity document under three specific Acts. This suggests the drafters wanted to avoid a broad “administration of government” purpose and instead specified concrete, limited uses.

The third concept is “trusted access principles”. Under the Act, data may only be shared or disclosed in accordance with trusted access principles published by the Minister. The regulations add to those principles by requiring prior approvals for certain data types. The requirement for Ministerial approval before sharing prescribed health information means that even where the Minister’s published principles would otherwise permit sharing, the health data cannot flow without an additional sign‑off. This creates a control point for health data that is subject to specific statutory secret provisions. Similarly, the SA NT DataLink approval requirement protects data contributed to that linkage consortium by non‑government entities.

The fourth concept is “relevant entity”. The Act allows data to be shared with entities that are not public sector agencies if they are prescribed as relevant entities. The regulations prescribe a mixed group: the Local Government Association, essential service providers, government contractors, community service providers and higher education providers. These entities receive data subject to the Act’s restrictions on further use and disclosure. The concept expands the data sharing ecosystem beyond government to include private and non‑profit actors that deliver public services or have a public function.

The fifth concept is the “safeguard” imposed by regulation 8. Unlike the Act’s general safeguards, which are about security and access controls, this is a labelling requirement. Data recipients must mark the data as having been provided under the Act. This is a simple procedural step that makes the provenance of the data visible, which in turn supports audit, compliance and potential legal challenges. The cost is administrative: someone must physically or digitally mark the data each time it is received.

The final concept is the limited secondary use power for ODA. Regulation 9 carves out a narrow exception to the general rule that data may only be used for the purpose for which it was provided. ODA may use it for another purpose if that purpose is consistent with the Act’s objects and the circumstances match what the provider was told. This is not a blanket authorisation: it requires ODA to make a judgment about consistency and to check what was represented to the provider. This imposes an evidentiary and record‑keeping burden on ODA, but gives it some flexibility to derive additional value from data without going back to the provider for fresh authorisation, provided the original sharing was sufficiently transparent about potential uses.

The regulations affect a range of parties, each in different ways. The primary groups are public sector agencies, data providers, data recipients, oversight bodies and non‑government entities.

First, public sector agencies that hold data are directly affected by the exemptions and the purposes. Those agencies that are caught by the definition in the Act must comply with the data sharing framework if they wish to share data. However, regulation 4 exempts four specific agencies: the Auditor‑General, the Crown Solicitor, the Director of Public Prosecutions and the Ombudsman. These agencies are effectively carved out of the entire regime: they cannot volunteer data under the Act, and other agencies cannot compel them to share data under the Act. Their data is not available for the prescribed purposes. This affects how other agencies design data‑dependent projects: they cannot rely on these four agencies as sources or recipients under the Act, and may need to rely on other legal bases for data flows involving those bodies.

Second, all public sector agencies that are not exempt are potentially data providers. They must ensure that any data they share under the Act falls within the prescribed purposes and that they comply with any applicable trusted access principles, including the additional approvals for health data and SA NT DataLink data. The regulations impose a compliance burden: before sharing, an agency must determine whether the data is exempt under regulation 4(2), whether any prior approvals are needed, and whether the purpose is prescribed. They must also inform the recipient of the circumstances of use, since regulation 9 conditions ODA’s secondary use on what the provider was told.

Third, data recipients are affected. This includes other public sector agencies and relevant entities. Regulation 8 requires them to mark the data as provided under the Act. This is a continuing obligation that applies each time data is received. It is a simple step but adds to administrative overhead, particularly for organisations that receive data from multiple sources under different legal bases. For relevant entities that are not public sector agencies, such as the Local Government Association, essential service providers, government contractors, community service providers and higher education providers, the marking requirement applies equally. They also become subject to the Act’s restrictions on further use and disclosure, which limit what they can do with the data beyond the purpose for which it was provided. This may constrain their normal business practices, especially for private entities that routinely use operational data for multiple purposes.

Fourth, ODA is specifically affected by regulation 9. The regulation gives ODA a power to use data for a secondary purpose, but conditions it on consistency with the Act’s objects and on the provider’s informed expectations. ODA must therefore maintain records of what each provider was told about the circumstances of use at the time of provision. This imposes a record‑keeping and due diligence burden. ODA must also make a subjective judgment about consistency with the objects of the Act, which may be contestable. The regulation does not require ODA to seek fresh approval from the provider, which reduces transaction costs, but if ODA misjudges the consistency or the provider’s expectations, it may breach the Act.

Fifth, the Minister responsible for the Health Care Act 2008 is affected by regulation 6. The Minister must process requests for prior approval to share prescribed health information. This creates a gatekeeping function that may cause delays or denials. The Minister’s decision is not regulated by any criteria in the regulations, giving the Minister broad discretion. This could be used to block sharing that would otherwise be permissible under the published trusted access principles, or to permit sharing subject to conditions. The absence of criteria also creates uncertainty for agencies seeking to share health data.

Sixth, persons or bodies that have contributed data to the SA NT DataLink are affected. If they are not public sector agencies, they must give prior approval before that data can be shared or disclosed under section 8 of the Act. This protects their bargain with the DataLink and prevents the State from unilaterally repurposing data contributed by third parties. However, it also gives those contributors a veto over secondary sharing, which may frustrate the government’s ability to use linked data for policy analysis.

Finally, the regulations affect the community indirectly. By defining purposes and safeguards, they influence what data the government can use for law enforcement, emergency response and licensing, and what data it cannot use. The exemption for national security data and criminal intelligence means that certain data remains opaque to oversight bodies and the public. The inclusion of essential service providers as relevant entities means that private utilities and infrastructure providers can receive government data, potentially to improve service delivery but also raising privacy and commercial sensitivity concerns.

The regulations impose several specific duties and confer limited additional rights.

The duty under regulation 8 falls on every data recipient. Where data is provided to a recipient under the Act, the recipient must ensure that it is clearly indicated on the data that it was provided under the Act. This is a positive obligation. The regulation does not specify the form of indication: it could be a label, a metadata tag, a header, or a covering note. The duty attaches at the time of receipt and likely continues while the data is held. Failure to indicate may not in itself be an offence under the Act, but it could lead to consequences if a later breach of the Act is alleged and the provenance of the data is unclear. The duty is not qualified by practicality: even if the data is voluminous or streaming, the recipient must mark it. In practice, recipients are likely to implement automated tagging or require the provider to mark the data before transmission.

Regulation 6 imposes a duty on ODA and other public sector agencies not to share or disclose prescribed health information without the prior approval of the responsible Minister. This is a prohibition backed by the Act’s general contravention provisions. It also imposes a duty not to share or disclose SA NT DataLink information contributed by a non‑agency without the prior approval of the relevant person or body. These are conditions precedent: sharing without approval is unlawful. The regulation does not specify a time limit for obtaining approval or a process for refusing it. This creates practical uncertainty: an agency planning a data sharing project may need to seek Ministerial approval well in advance and may not know whether it will be granted until a decision is made. For the SA NT DataLink requirement, the relevant person or body may no longer exist, be difficult to identify, or refuse without reasons.

Regulation 9 confers a right on ODA to use public sector data for a purpose other than that for which it was provided, subject to two conditions. This is a limited right: it only applies to ODA, not to other agencies or relevant entities. It only applies to data received under sections 8 or 9 of the Act. It can only be exercised if the proposed use is consistent with the objects of the Act and ODA is satisfied that the circumstances match what the provider was informed. This gives ODA some flexibility to reuse data for multiple purposes without going back to the provider, reducing transaction costs and potentially enabling more efficient analysis. However, the right is not absolute: ODA must make a judgment about consistency and must check its records of what was communicated to the provider. If those records are incomplete or ambiguous, ODA may be unable to use the power safely.

The regulations also create duties on data providers, albeit indirectly. When a provider shares data under the Act, it must inform the recipient of the circumstances in which any proposed use of the data would occur. This is implied by regulation 9, which conditions ODA’s secondary use on the provider’s informed expectations. The provider must therefore communicate those circumstances at the time of provision. If the provider does not, ODA cannot later use the secondary use power. The provider also must ensure that any data it shares is not exempt under regulation 4, and that it complies with any applicable trusted access principles, including obtaining prior approvals if the data is prescribed health information or SA NT DataLink data. These duties are not expressly stated in the regulations but flow from the Act’s requirement that sharing be in accordance with the regulations.

The regulations do not confer any individual rights on citizens or third parties. They do not create a right to access data, a right to object to sharing, or a right to be notified of sharing. The exemptions and approval requirements are structural protections, not individual rights. However, the markings required by regulation 8 may assist individuals who later seek to trace the provenance of data used in decisions about them, and the restriction on ODA’s secondary use may constrain how personal data is used.

The regulations themselves do not create any penalty provisions. Offences and penalties for contraventions are located in the Public Sector (Data Sharing) Act 2016. The regulations define the scope of lawful conduct; a breach of the regulations may result in a breach of the Act. Under section 18 of the Act, a person who contravenes a provision of the Act or the regulations is guilty of an offence. The maximum penalty is a fine of $10,000. This applies to both individuals and bodies corporate, though the Act does not specify higher penalties for corporations. The penalty is modest relative to the potential value of data or the harm from misuse. It may reflect the view that the Act is primarily facilitative and that serious misconduct would be caught by other laws.

Enforcement is by prosecution. The Act does not create a private right of action. A person cannot sue for damages simply because data was shared in breach of the regulations. The only enforcement mechanism is prosecution by the police or the Director of Public Prosecutions. The $10,000 penalty may not be a sufficient deterrent for a large organisation or an individual with high incentives to misuse data. Repeat offences could attract larger cumulative fines, but the Court has discretion.

The regulations also create conditions that, if not satisfied, make subsequent conduct unlawful. For example, if data is shared without the required Ministerial approval under regulation 6, that sharing is outside the Act’s authorisation. The provider may be guilty of an offence. Similarly, if a recipient fails to mark the data as required by regulation 8, that is a breach of a regulation and therefore an offence under section 18 of the Act. The failure to mark data may not directly cause harm, but it could frustrate oversight.

The marking requirement under regulation 8 is difficult to enforce ex post. If data is not marked, it may be difficult to prove that it was provided under the Act unless other evidence exists. The regulation is essentially a procedural requirement that relies on voluntary compliance. The main enforcement risk for recipients is that if they later use or disclose data in a manner that would only be lawful if the data were provided under the Act, and they cannot demonstrate compliance with regulation 8, they may face prosecution.

The SA NT DataLink approval requirement in regulation 6 also has an enforcement dimension. If a public sector agency shares data contributed to the DataLink by a non‑agency without obtaining that entity’s prior approval, the sharing is unlawful. The non‑agency could complain to the police or take other remedial action, but the Act does not give it a direct right to seek an injunction or to stop the sharing.

The restriction on ODA’s secondary use in regulation 9 is self‑enforcing to some extent. If ODA uses data for a purpose that is not consistent with the objects of the Act or that goes beyond what the provider was told, ODA is in breach. The provider may never discover the breach unless ODA publishes its data use or an internal audit reveals it. The penalty is the same as for other offences: $10,000. Given the low penalty, the primary deterrent is likely reputational or political, rather than legal.

Overall, the enforcement framework is light. The regulations rely on the assumption that public sector agencies and relevant entities will comply because they are law‑abiding and because internal governance will catch breaches. There is no independent data sharing regulator with enforcement powers; the police and prosecutors have limited resources for this type of offence. The low maximum penalty suggests that the legislature did not anticipate widespread non‑compliance or high‑value misuse. Entities subject to the regulations should still take compliance seriously, as a single prosecution could cause reputational damage and lead to more stringent controls in future.

The regulations do not operate in a vacuum. They exist alongside a web of other South Australian and Commonwealth laws that govern data handling, privacy, confidentiality and secrecy. The regulations are subordinate to the Act, and the Act itself states that it does not limit or affect other laws, except to the extent that they are inconsistent. The regulations explicitly reference several other statutes, and their operation must be understood in that context.

First, the regulations exempt data that is protected by legal professional privilege, obtained in confidential mediation or dispute resolution, or classified as criminal intelligence under another Act. This means that those other laws continue to apply with full force. The data sharing regime does not override privilege or confidentiality. A public sector agency cannot use the Act to circumvent a court order protecting mediation confidentiality or an intelligence classification by the Commissioner of Police. The regulations take care to preserve those protections.

Second, regulation 6 interacts directly with specific health secrecy provisions. It lists prescribed provisions under the Assisted Reproductive Treatment Act 1988, the Health Care Act 2008, the Health Care Regulations 2008, the Health Practitioner Regulation National Law, the South Australian Public Health Act 2011 and the Transplantation and Anatomy Act 1983. These provisions generally prohibit disclosure of health information, subject to exceptions. The regulations do not override those prohibitions; instead, they require the prior approval of the Minister before sharing is permitted. The Minister’s approval can be seen as an additional exception, but it does not automatically authorise sharing. The underlying secrecy provision remains in force, and the Minister must consider whether to exercise any discretion or power under that provision to allow disclosure. This creates a complex interplay: the sharing agency must navigate both the secrecy provision and the regulation. In practice, the Minister may require the agency to satisfy the secrecy provision before granting approval.

Third, the definition of exempt public sector data includes data whose public disclosure would prejudice national security within the meaning of the Commonwealth National Security Information (Criminal and Civil Proceedings) Act 2004. This ties the regulations to a Commonwealth law. If the Commonwealth law is amended, the reference may change. The regulation does not incorporate State national security laws; it specifically references the Commonwealth Act.

Fourth, the regulations define essential service by reference to the Essential Services Act 1981. This means that the class of relevant entities that are essential service providers is determined by that Act. Changes to the definition in that Act will flow through to the regulations.

Fifth, the regulations interact with the Local Government Act 1999 and other local government legislation. The Local Government Association of South Australia is a relevant entity, but the regulation does not prescribe individual councils. This means councils are not relevant entities unless they are covered by another paragraph, such as being a government contractor or community service provider. The interaction with local government is limited to the Association.

Sixth, the regulations do not interact with the Commonwealth Privacy Act 1988 or the Privacy and Data Protection Act 2014 (SA). There is no reference to privacy principles or to the requirement to handle personal information in accordance with those laws. This does not mean those laws are inapplicable; they continue to apply. An agency that shares personal data under the Act must still comply with the Information Privacy Principles or the Australian Privacy Principles, as applicable. The regulations do not provide a safe harbour from privacy law. The marking requirement under regulation 8 may assist with compliance by making the legal basis for collection visible, but it does not replace privacy obligations.

Seventh, the regulations interact with the Freedom of Information Act 1991 (SA). Data that is shared under the Act may become subject to FOI requests if held by an agency. The regulations do not create an exemption from FOI. The marking requirement could assist an FOI officer in identifying the source and legal basis of data, but it does not affect the outcome of an access request.

Eighth, the regulations interact with the Public Sector Act 2009 code of conduct and employment obligations. Public sector employees who handle data under the Act are subject to their employer’s policies. A breach of the regulations could also be a breach of the code of conduct, leading to disciplinary action in addition to prosecution.

Finally, the regulations interact with the legislation referenced in the prescribed purposes. Regulation 7(1)(c) specifically references the Firearms Act 2015, the Harbors and Navigation Act 1993 and the Passenger Transport Act 1994. This means that data sharing for photograph inclusion must comply with those Acts’ requirements for issuing licences and identity cards. The regulations do not override those Acts’ criteria; they simply permit the use of the photo data.

The regulations have been amended several times since their original commencement on 30 May 2017. The legislative history records six versions: the principal regulations (No 75 of 2017), and five amending instruments (No 316 of 2017, No 271 of 2020, No 54 of 2021, No 15 of 2024 and No 8 of 2026). Each amendment has narrowed, expanded or clarified the framework.

The first amendment, No 316 of 2017, commenced on 28 November 2017. It inserted regulation 8A, which prescribed relevant entities under section 13 of the Act. This was the first time the regulations gave substance to the concept of relevant entities, adding the Local Government Association, essential service providers, government contractors, community service providers and higher education providers. This significantly expanded the pool of non‑government entities that could receive data under the Act.

No 271 of 2020, commencing 24 September 2020, inserted regulation 5A. This regulation links back to the trusted access principles by prescribing that the purposes in regulation 7(1)(c) are prescribed for the purposes of section 7(4)(a)(vii) of the Act. This is a technical amendment that ensures consistency between the trusted access principles and the prescribed purposes. It also varied regulation 7(1) to add the photograph inclusion purpose, which had not been in the original regulations. This expanded the prescribed purposes to include the specific licensing use.

No 54 of 2021, commencing 13 May 2021, varied regulation 8A(1). The amendment inserted a new paragraph, but the legislative history does not specify what was varied. The historical version shows that (a) was already present, and (b) and (c) were originally inserted later. This amendment likely added or refined a category.

No 15 of 2024, commencing 14 July 2024, amended regulation 8A(1) again. This amendment changed the text, but the details are not in the source. Given the subsequent 2026 amendment that deleted (b) and (c), the 2024 amendment may have rewritten those paragraphs or added conditions.

No 8 of 2026, commencing 5 February 2026, deleted paragraphs (b) and (c) from regulation 8A(1). This is a notable contraction of the relevant entity class. Paragraphs (b) and (c) originally covered certain types of persons or bodies. The deletion means those entities are no longer relevant entities and thus cannot receive data under section 13 of the Act. This could reflect a policy decision to limit data sharing to a narrower set of non‑government actors, perhaps due to concerns about compliance, privacy or commercial misuse. The LGA, essential service providers, contractors, community service providers and higher education providers remain.

The historical versions listed in the legislative history show that the regulations have been republished after each amendment, but the source does not provide the full text of earlier versions. The amendments demonstrate that the regulations are not static; they have been adjusted to add new purposes, expand the recipient class, and then contract it. The deletion of paragraphs (b) and (c) in 2026 is the most significant change, as it removes an unknown number of entities from the data sharing ecosystem. Practitioners should check the current version to confirm which entities are prescribed.

The regulations have not been the subject of reported litigation in South Australian courts. The source does not name any cases. This does not mean the regulations are immune to challenge; it simply means there is no publicly available judicial interpretation of their provisions to date. There are several possible reasons.

First, the regulations are relatively new in legal terms, having been in force only since 2017. Data sharing litigation often takes time to develop, as it requires a concrete dispute and a party with standing. Second, the regulations are procedural in nature. They define what is lawful; a litigant would need to show that data was shared in breach of the regulations and that this caused them harm. Privacy harms are often difficult to prove and may be captured by other causes of action, such as breach of confidence or misuse of private information. Third, the low penalties may deter litigation; a plaintiff might not see a financial return from suing for damages if the Act does not provide for compensation. Fourth, the data sharing regime is permissive, not mandatory. Agencies can choose whether to share data. A party aggrieved by a decision not to share data would have no cause of action under the regulations.

Potential future litigation could arise in several areas. A provider could challenge the Minister’s refusal to grant approval under regulation 6 on the grounds of procedural unfairness or unreasonableness. A recipient could challenge a decision by the SA NT DataLink contributor to refuse approval. A citizen could argue that data shared under a prescribed purpose was not actually within that purpose, and that the sharing was therefore unlawful. Such a challenge would likely involve statutory interpretation of regulation 7. For example, the phrase “to assist in law enforcement” could be contested: does it cover a routine administrative check that is not part of a specific investigation? The definition of emergency planning and response is broad, but a court might narrow it if a sharing appears to be for a purely economic purpose.

The marking requirement in regulation 8 could also be litigated. If a recipient fails to mark data and that failure leads to a subsequent misuse, the court may consider whether the breach of regulation 8 contributed to the harm. However, the regulation does not create a duty of care to mark data; it is a regulatory obligation, and its breach does not automatically give rise to a private right.

The lack of litigation does not imply that compliance is unimportant. It may simply mean that the regime is working as intended, or that breaches go undetected or are resolved administratively. Practitioners should not assume that the regulations are immune from future challenge, particularly as data sharing becomes more common and as public awareness of data use grows.

Several provisions in the regulations contain traps or ambiguities that can catch unwary compliance officers, lawyers or data users.

The biggest gotcha is the scope of “prescribed health information” in regulation 6. The definition is functional: it means information the disclosure of which is prohibited under a prescribed provision, whether or not the prohibition is subject to specified qualifications or exceptions. This means that even if the prohibition has exceptions that would otherwise allow disclosure, the mere existence of the prohibition in the prescribed provision makes the information “prescribed health information”. The only way to share it under the Act is to obtain the prior approval of the Minister. This is broader than it appears. For example, section 66 of the Health Care Act 2008 prohibits disclosure of information relating to the treatment of a person at a hospital, but also contains exceptions for disclosure with consent or for research approved by an ethics committee. Under the regulation, those exceptions do not exempt the information from the definition. The Ministerial approval requirement still applies on top of any other exceptions. An agency that relies on a consent exception under the Health Care Act without also obtaining Ministerial approval would breach the regulations. This is a trap.

A second gotcha is that the SA NT DataLink requirement in regulation 6 applies to information disclosed to a public sector agency for the purposes of the DataLink by a person or body that is not a public sector agency. This means that if a university contributes data to the DataLink, and later a public sector agency wants to share that data under section 8, it must obtain the university’s prior approval. But if the university contributed the data years ago and has since ceased to exist or cannot be located, the agency cannot share the data under the Act. The obligation is absolute; there is no fallback if the contributor is uncontactable. The data is effectively frozen under the Act, though it could still be shared under other legal bases.

Third, regulation 9’s secondary use power for ODA is narrower than it might appear. It requires that the proposed use be consistent with the objects of the Act. The objects include improving the delivery of government services, informing policy development, enabling research, ensuring efficient management of state assets and supporting the development of a digital economy. But consistency with objects is a vague standard. If ODA wants to use data for a commercial purpose or for a purpose that has no clear public benefit, a court might find it inconsistent. Moreover, the requirement that ODA be satisfied that the circumstances match what the provider was informed means that the provider must have been given specific information at the time of provision. If the provider was only told “for service delivery improvement” and ODA later wants to use the data for a specific law enforcement purpose, the circumstances are different. ODA must have a record of what was said.

Fourth, the marking requirement in regulation 8 applies to all data provided under the Act. It does not say “clearly indicated on the data or on its container”. In a large database or streaming dataset, physically marking each record may be impossible. ODA and other recipients may need to rely on metadata, but the regulation does not explicitly permit that. A strict reading would require the data itself to bear an indication. This is a practical headache for IT systems.

Fifth, the exemption for national security data in regulation 4(2)(f) uses a Commonwealth definition: “national security” within the meaning of the National Security Information (Criminal and Civil Proceedings) Act 2004 of the Commonwealth. That Act defines national security broadly to include Australia’s defence, security, international relations or law enforcement interests. The regulation does not require that the data be classified; it only requires that disclosure could reasonably be expected to prejudice national security. This is a subjective test. An agency could invoke this exemption to avoid sharing data without having to prove actual prejudice, but it could also be contested.

Sixth, the list of exempt agencies in regulation 4(1) is exhaustive. It includes only four bodies. Other oversight agencies, such as the Ombudsman for other jurisdictions, are not exempt unless they fall under the Crown Solicitor or another category. The Independent Commissioner Against Corruption is not exempt; it is defined as a public sector agency under regulation 5, meaning it can both share and receive data. This may be a surprise for those who assume all integrity bodies are exempt.

Seventh, regulation 7(1)(c) allows the use of a photograph taken under the Motor Vehicles Act 1959 for inclusion in licences under the Firearms Act, Harbors and Navigation Act and Passenger Transport Act. But it does not allow the use of those photographs for any other purpose, even related purposes such as identity verification for voting. The purpose is extremely specific. An agency that uses a motor vehicle photo for a driver’s licence renewal would need a different legal basis, because the Motor Vehicles Act itself may already authorise that use. The regulation is a s. 8(1)(c) prescribed purpose, so it only applies where the original collection purpose is different.

Eighth, the essential service providers listed as relevant entities under regulation 8A(1)(d) are defined by reference to the Essential Services Act 1981. That Act defines essential services broadly to include water, gas, electricity, sewerage, telecommunications and transport. But the regulation does not limit the class to providers currently supplying; it includes those that have provided an essential service in the past. This means a historic provider could still be a relevant entity, even if it no longer operates. The regulation does not specify a time limit.

Finally, regulation 9 allows ODA to use data for another purpose but does not allow ODA to disclose that data for another purpose. The text says “use public sector data”, not “disclose”. So ODA may use data internally for a secondary purpose, but may not share that data with others unless the original authorisation or another provision allows it. This is a subtle distinction that could be missed.

Compliance with the regulations requires a systematic approach by both data providers and data recipients. The steps depend on the role, but several universal measures apply.

First, any agency or relevant entity that intends to share or receive data under the Act must classify the data correctly. This means checking whether the data is exempt under regulation 4. If the data is held by the Auditor‑General, Crown Solicitor, Director of Public Prosecutions or Ombudsman, it is exempt automatically. If the data falls into any of the categories in regulation 4(2) (privileged, mediation, criminal intelligence, court, contempt, national security), it is also exempt. An agency should maintain a list of these categories and train staff to recognise them. If the data is exempt, it cannot be shared under the Act; the agency must use another lawful basis.

Second, if the data is not exempt, the next step is to determine whether the purpose is a prescribed purpose under regulation 7. The agency should confirm that the sharing is for law enforcement, emergency planning and response, or the specific photograph inclusion purpose. The definitions of law enforcement and emergency planning are broad but not unlimited. The agency should document how the sharing fits within the definition. If the purpose is not prescribed and is not the original or a directly related purpose, the Act does not authorise the sharing.

Third, if the purpose is prescribed and the data is not exempt, the agency must check regulation 6 for additional approvals. If the data is “prescribed health information” as defined, the agency must obtain the prior approval of the Minister responsible for the Health Care Act 2008 before sharing. This means the agency must identify the data as health information covered by the listed provisions and then make a request to the Minister. The agency should allow time for the approval process and should not rely on informal authorisation. If the data was disclosed to a public sector agency for the SA NT DataLink by a non‑agency, the agency must obtain the prior approval of the person or body that contributed it. This may require contacting an external organisation and negotiating terms.

Fourth, the data provider must, at the time of provision, inform the recipient of the circumstances in which any proposed use of the data would occur. This is necessary for ODA to later use the secondary use power under regulation 9, but it is also good practice. The provider should document what was communicated, whether in a data sharing agreement, a covering email or a metadata record. The provider should be specific: not just “for policy analysis” but “for analysis of emergency response times within the scope of the SA Emergency Management Act”.

Fifth, the data recipient must comply with the marking requirement in regulation 8. As soon as data is received, the recipient must ensure that it is clearly indicated on the data that it was provided under the Act. In practice, this will likely be achieved by adding a field or tag in a database, or by placing a paper label on a physical record. The recipient should have a standard operating procedure for marking data upon receipt. The marking should be durable and legible.

Sixth, if the recipient is ODA and wishes to use the data for a purpose other than that for which it was provided, ODA must satisfy the two conditions in regulation 9. ODA should maintain a register of each data receipt, including the purpose for which it was provided and the circumstances communicated by the provider. Before using data for a new purpose, ODA must check that the new purpose is consistent with the objects of the Act and that the circumstances match. This should be done in writing and approved by a senior officer. ODA should not reuse data if the provider’s communicated circumstances were vague or if the new use goes beyond what was described.

Seventh, entities that are not public sector agencies but are relevant entities under regulation 8A must comply with the Act’s restrictions on further use and disclosure. They should only use the data for the purpose for which it was provided unless another law allows otherwise. They should not on‑share the data to third parties or use it for unrelated commercial purposes. They should also comply with the marking requirement.

Eighth, agencies and relevant entities should conduct periodic audits to ensure that data marked under regulation 8 is still correctly marked, that health data approvals are still current, and that no exempt data has been inadvertently shared. The regulations do not prescribe an audit cycle, but a reasonable practice would be annual.

Ninth, legal review is advisable before any significant data sharing project under the Act. The interaction with other secrecy laws, privacy laws and confidentiality obligations should be assessed. Obtaining legal advice on whether the prescribed purpose is engaged and whether any Ministerial approvals are needed will reduce the risk of inadvertent breach.

Finally, all parties should keep records of approvals, markings, communications with providers and decisions to use data for secondary purposes. The regulations do not prescribe a retention period, but the low limitation period for summary offences (two years in South Australia) provides a guide. Retention for at least three years after the last use of the data would be prudent.

Compliance is not onerous if built into business processes from the start. The main cost is administrative: the marking requirement and the approval processes. The risk of non‑compliance is a potential fine of up to $10,000 per offence, plus reputational damage. Given the modest penalty and low enforcement history, some organisations may be tempted to cut corners, but that would be unwise given the increasing public and political attention to data governance.