Victorian Data Sharing Act 2017

The statutory architecture rests on a small set of defined concepts which determine who can be asked to provide data, what data can be requested, how it can be used, and what protections apply.

• Data sharing bodies and designated bodies. The Act defines "data sharing body" broadly to include public service bodies, public entities and Victoria Police, and permits regulations to add others (s 3 definitions; s 32(2)(a)). "Designated body" covers exempt bodies, special bodies, Boards of Inquiry, Formal Reviews and Royal Commissions, and associated office-holders (s 3 definitions). A data analytics body is a subset and includes the Secretary to a Department and other prescribed bodies; the Act notes a data analytics body is also a data sharing body (s 3 definitions).

• Types of data. The Act distinguishes between identifiable data and de-identified data. "Identifiable data" includes health information, personal information, identifiers and unique identifiers (s 3 definitions). "De-identified" is defined as data that no longer relates to an identifiable individual or to an individual who can reasonably be identified (s 3 definitions). The Act also creates the category of "restricted data" for specific sensitive classes, examples include confidential law enforcement sources, witness protection identities, national security material and investigative methodologies, and allows regulations to add classes of restricted data (s 3 definitions; s 32(2)(c)).

• Data integration versus data analytics work. Data integration is defined as the combination or collation of data contained in two or more datasets (s 3 definitions). Data analytics work is the examination and analysis of data to draw conclusions, but expressly excludes data integration (s 3 definitions). This separation matters because the Act permits identifiable data to be used for integration (s 17) but requires de-identification before data analytics work (s 18(1)) and requires results disclosed to be de-identified (s 19).

• Requests and responses. The Chief Data Officer may issue written notices requesting specified data or information about holdings, and must specify the data requested, the reasons and how the data will be handled (s 8(2); s 11(3)). Responsible officers of data sharing bodies must respond within 10 business days by providing the data or giving written notice of refusal with reasons (s 9(2)-(3); s 12(2)-(3)). Designated bodies are not required to respond (s 10; s 13). The Chief Data Officer is forbidden from requesting restricted data (s 8(3)).

• Secrecy provisions and authorisations. The Act creates a mechanism where disclosures and uses made in accordance with the Act do not contravene secrecy provisions (s 20, s 22). However, for the Chief Data Officer to disclose data to which a secrecy provision applies, authorisation by the Minister responsible for the secrecy provision is required, and for some taxation secrecy provisions the Commissioner of State Revenue must also authorise (s 23(1)(a)-(b)).

• FOI exclusion and reporting. Documents in possession of the Chief Data Officer or a data analytics body that contain data provided under the Act, and datasets created following data integration, are excluded from the Freedom of Information Act 1982 (s 25(1)(a)-(b)). Reporting obligations require periodic reports to the Information Commissioner and the Health Complaints Commissioner (s 28-29), and the Minister must commission a review of the Act after five years (s 30).

• Governance tools. The Chief Data Officer may issue policies and guidelines covering privacy preserving procedures, security safeguards, technology platforms, risk mitigation frameworks and protocols for projects; parties must have regard to these (s 33(1)-(4)). The Chief Data Officer can delegate many powers within the Department, and responsible officers can delegate duties under the Act (s 31).

These concepts create a system in which the Chief Data Officer functions as a centralised requester and integrator of public sector data, constrained by de-identification requirements before analytics, by secrecy provision authorisations for certain disclosures, by FOI exclusions, and by reporting and criminal penalties for misuse. The statutory definitions control the perimeter: what counts as a data sharing or analytics body, what amounts to identifiable data, and what is restricted or secret.

The Act identifies specific institutional actors and classes of individuals whose conduct, rights and obligations are shaped by the statute.

• Chief Data Officer and the Centre. The Secretary to the Department may employ a Chief Data Officer and staff (s 6). The Centre means persons employed or engaged by the Secretary to support the Chief Data Officer (s 3 definitions). The Chief Data Officer holds functions including conducting data integration and analytics, building capability, coordinating cross-jurisdictional sharing, making integrated datasets and analytics results available, and collaborating with other bodies (s 7(1)(a)-(f)). The Chief Data Officer can delegate many powers to Department employees (s 31(1)).

• Data sharing bodies. The Act imposes primary obligations on "data sharing bodies" , public service bodies, public entities and Victoria Police are explicitly included, and the regulations may prescribe additional bodies (s 3 definitions; s 32(2)(a)). The responsible officer for a data sharing body has statutory duties to respond to Chief Data Officer notices, to disclose identifiable data in accordance with the Act, to inform the Chief Data Officer about applicable secrecy provisions, and to refuse or provide reasons where appropriate (s 8-15; s 21; s 14).

• Data analytics bodies. A "data analytics body" includes the Secretary to a Department and any bodies prescribed by regulation (s 3). Data analytics bodies may receive identifiable data for integration (s 15(2); s 16). They must take steps to de-identify data prior to analytics work (s 18) and ensure analytics results disclosed are de-identified (s 19).

• Designated bodies. Designated bodies such as exempt bodies, exempt body officials, special bodies, heads, Boards of Inquiry and Royal Commissions are explicitly named in the defined category (s 3 definitions). The Act treats them differently: they may provide data but are not required to respond to requests (s 10; s 13).

• Responsible officers and Departmental Secretaries. Defined to be the head of the relevant organisation, these persons carry the duty to respond to requests and to decide whether to provide data, including making statutory refusals and informing the Secretary where they intend not to provide requested data (s 3 definitions; s 9(3); s 12(3); s 14).

• Oversight and regulators. The Information Commissioner and the Health Complaints Commissioner are recipients of mandatory periodic reports from the Chief Data Officer about personal information handling and health information handling respectively, including steps taken to ensure compliance with the Privacy and Data Protection Act 2014 and the Health Records Act 2001 (s 28-29). The Act also requires the Chief Data Officer or data analytics body to inform the Information Commissioner or Health Complaints Commissioner if they become aware a breach of the Act, the Privacy and Data Protection Act 2014 or the Health Records Act 2001 has occurred while data was in their control (s 24(3)).

• The Crown. The Act explicitly binds the Crown in right of Victoria and other capacities to the extent permitted (s 4). That signals that data holdings of the state and Crown entities fall within the Act’s scope where defined as data sharing bodies or by regulation.

• Individuals whose data is held. Individuals whose personal or health information is contained in public sector records are affected because their identifiable data may be transferred to the Chief Data Officer or analytics bodies for integration and analytics prior to de-identification. While the Act requires de-identification for analytics work (s 18) and limits disclosure of analytics results to de-identified data (s 19), identifiable data may be used for integration (s 17) and temporarily held by the Chief Data Officer or data analytics bodies (s 16-17).

• Ministers and the Commissioner of State Revenue. Ministers administering secrecy provisions and the Commissioner of State Revenue have an active decision role when the Chief Data Officer seeks to disclose data subject to secrecy provisions; ministerial authorisation and, for taxation secrecy provisions, Commissioner authorisation, are required before the Chief Data Officer can disclose such data (s 23).

• Third parties and the public. The Act removes FOI access to many documents held by the Chief Data Officer or data analytics bodies (s 25), which affects journalists, researchers and the public seeking access to integrated datasets or analytics outputs. It also affects contractors and technology providers who may handle data on behalf of data analytics bodies as they will be subject to the Act’s criminal offences for unauthorised access, use or disclosure if they obtain data under the Act (s 26-27).

Overall, the Act creates an administrative ecosystem spanning departmental secretaries, responsible officers, the Chief Data Officer and oversight regulators. It shifts the locus of some data handling and decision rights to the Centre and the Chief Data Officer while preserving certain refusal rights for data sharing bodies and imposing ministerial consent requirements where secrecy provisions apply.

This section lays out the principal positive obligations, discretions and entitlements the Act creates for each class of participant.

Chief Data Officer

• Power to request data and information. The Chief Data Officer may give written notices requesting data held by data sharing bodies or designated bodies (s 8(1)) or information about data holdings (s 11(1)). Notices must specify the data or information requested, the reasons for the request and how the data will be handled (s 8(2); s 11(3)).

• Management and disclosure functions. The Chief Data Officer may conduct data integration and analytics work, build capability across public sector agencies, coordinate cross-jurisdictional sharing, make integrated datasets and analytics results available, and collaborate with bodies (s 7(1)(a)-(d)). The Chief Data Officer may disclose identifiable data received to a data analytics body for integration (s 16), and may use identifiable data for integration (s 17).

• De-identification obligations. The Chief Data Officer must take reasonable steps to ensure data no longer relates to identifiable individuals before using it for analytics work (s 18(1)-(2)) and must ensure that any results disclosed include only de-identified data (s 19).

• Reporting duties. Annual reports to the Information Commissioner (personal information) and Health Complaints Commissioner (health information) are required, covering compliance steps and project details including numbers of requests and refusals (s 28-29). The Chief Data Officer must also inform regulators where aware of likely breaches of relevant privacy and health records laws while data was in their control (s 24(3)).

Data sharing bodies and responsible officers

• Duty to respond to requests. If the Chief Data Officer requests specified data or information, the responsible officer must respond in writing within 10 business days by providing the data or by giving written notice they will not provide some or all of it, stating reasons (s 9(2)-(3); s 12(2)-(3)).

• Right to refuse. Responsible officers may refuse to provide data or information where provision would constitute a breach of legal professional privilege, contract, equitable obligation of confidence, court order, or, subject to Part 4, a law of the Commonwealth, State or Territory. They may also refuse where provision would prejudice investigations, coronial inquiries, court proceedings, or endanger health, safety or welfare (s 14). Where refusing, the response must also be given to the Secretary to the Department (s 9(3)(a); s 12(3)(a)).

• Obligation to inform of secrecy provisions. If aware that a secrecy provision applies to data disclosed, the responsible officer must inform the Chief Data Officer (s 21).

Designated bodies

• Discretionary participation. Designated bodies may provide data or information but are not required to respond to notices (s 10; s 13). They may disclose identifiable data in accordance with s 5 (s 15(1)).

Data analytics bodies

• Use for integration and analytics. Data analytics bodies may receive identifiable data for integration (s 15(2); s 16). They may collect, hold, manage and use identifiable data for integration (s 17).

• De-identification and disclosure limits. Like the Chief Data Officer, a data analytics body must ensure reasonable steps are taken to de-identify data before analytics work (s 18) and that results disclosed are de-identified (s 19). Policies and guidelines issued by the Chief Data Officer must be taken into account (s 33(4)).

Secrecy provisions and ministerial authorisation

• Non-contravention in certain uses. Where secrecy provisions apply to data disclosed to the Chief Data Officer, disclosure and use in accordance with the Act do not contravene the secrecy provision (s 20, s 22). However, the Chief Data Officer’s disclosure of such data requires the Minister’s authorisation and, for taxation secrecy provisions in the Taxation Administration Act 1997, the Commissioner of State Revenue’s authorisation (s 23(1)(a)-(b)).

FOI rights and limits

• FOI exclusions. Documents in possession of the Chief Data Officer or a data analytics body that contain data provided under the Act, or datasets created following integration, are outside the Freedom of Information Act 1982 (s 25(1)(a)-(b)). This reduces avenues for external access to integrated datasets and analytics outputs held by these entities.

Criminal offences and defences

• Unauthorised access/use/disclosure. Persons who obtain data under the Act must not access, use or disclose it other than in accordance with the Act or to perform functions under the Act; breach attracts a summary offence penalty up to 240 penalty units or two years imprisonment (s 26(1)). A reasonable excuse defence exists where reasonable steps were taken not to access, use or disclose (s 26(2)).

• Aggravated criminality. Access, use or disclosure that the person knows or is reckless as to whether it may endanger life, facilitate commission of an indictable offence, or impede justice, carries higher penalties up to 600 penalty units or five years imprisonment and is an indictable offence (s 27(1)-(2)).

Delegation, regulation and guidance

• Delegation powers. The Chief Data Officer, the Secretary and responsible officers may delegate most powers to employees, preserving administrative flexibility (s 31).

• Regulatory powers. The Governor in Council may prescribe bodies as data sharing or analytics bodies, prescribe classes of restricted data and prescribe secrecy provisions to which Division 2 does not apply (s 32(2)(a)-(d)). Regulations may confer discretionary authority or impose duties (s 32(3)(c)).

• Guidance and policies. The Chief Data Officer may issue policies and guidelines on privacy preserving procedures, security safeguards, secure platforms, risk mitigation frameworks and protocols for projects; relevant bodies must have regard to them and the Chief Data Officer may publish them (s 33(1)-(4)).

These duties and rights create a scheme of centralised request and integration powers balanced by refusal rights for data sharing bodies, statutory de-identification obligations for analytics, reporting and regulatory oversight, and criminal sanctions for misuse.

The Act provides criminal enforcement for unauthorised conduct, administrative reporting obligations, regulatory authorisation processes and delegated accountability mechanisms. Enforcement instruments fall into three groups: criminal offences, reporting and notification duties, and administrative controls.

Criminal offences

• Summary offence (s 26). A person must not, without reasonable excuse, access, use or disclose any data or information obtained under the Act other than in accordance with the Act or in connection with the performance of functions under the Act. The penalty is 240 penalty units or imprisonment for two years or both (s 26(1)). The provision also recognises a reasonable excuse defence where a person took reasonable steps not to access, use or disclose the data (s 26(2)). The provision includes a note pointing to s 72 of the Criminal Procedure Act 2009 on evidential burden (s 26 note).

• Indictable offence (s 27). A higher-tier offence applies if a person accesses, uses or discloses data obtained under the Act knowing or being reckless as to whether the data may be used to endanger life, to commit or assist in an indictable offence, or to impede administration of justice. The penalty is 600 penalty units or imprisonment for five years or both (s 27(1)-(2)). This offence is expressly indictable (s 27(2)).

The Act applies these offences to any person who obtains data under the Act. That extends liability beyond public servants to contractors, consultants and third parties who might receive or handle data under the Act.

Reporting and notification

• Breach notification to regulators (s 24(3)). If the Chief Data Officer or a data analytics body becomes aware that the Act, the Privacy and Data Protection Act 2014 or the Health Records Act 2001 has been or is likely to have been breached in relation to data handled under the Act while in their control, they must, as soon as practicable, inform the Information Commissioner for privacy breaches, the Health Complaints Commissioner for health records breaches, and in any case the data sharing body or designated body that provided the data (s 24(3)(a)-(c)). This creates administrative reporting obligations that tie the Centre into the state’s existing privacy and health oversight regimes.

• Annual reporting obligations (s 28-29). The Chief Data Officer must report at intervals no longer than 12 months to the Health Complaints Commissioner on health information handling (s 28(1)-(2)) and to the Information Commissioner on personal information handling (s 29(1)-(2)). Reports must include compliance steps, project details, numbers of requests, refusals and assessments of issues and challenges. These reports create transparency to specific oversight offices and provide a compliance feedback loop.

Administrative controls and constraints

• Secrecy provision authorisation (s 23). If data received by the Chief Data Officer is subject to a secrecy provision, the Act allows the data to be used or held without contravening the secrecy provision where done in accordance with the Act (s 22). However, the Chief Data Officer may only disclose such data if the Minister responsible for the secrecy provision authorises it and, for taxation secrecy, the Commissioner of State Revenue also authorises the disclosure (s 23(1)(a)-(b)). This imposes political and administrative checks before disclosure of secret material beyond the Act’s internal uses.

• FOI exclusion (s 25). Documents in possession of the Chief Data Officer or a data analytics body that contain data provided under the Act, or that contain datasets created following integration, are not subject to the Freedom of Information Act 1982 (s 25(1)(a)-(b)). The FOI exclusion reduces external legal avenues to compel disclosure and thus shifts enforcement emphasis onto the criminal provisions, regulator reporting and ministerial authorisations.

• Delegation and guidance obligations (s 31; s 33). Delegation powers and mandatory "have regard" obligations in respect of Chief Data Officer policies mean that compliance is partly governed by administrative directives and internal governance mechanisms rather than statute alone (s 31(1); s 33(4)). The Act leaves design and implementation of privacy-preserving and security safeguards to policy, which the Chief Data Officer can publish (s 33).

Enforcement architecture and practical implications

• Who enforces? Criminal enforcement would be by relevant prosecuting authorities; the Act itself does not create a civil enforcement scheme or private right of action. Administrative oversight is channelled through the Information Commissioner and Health Complaints Commissioner via reporting and notification duties (s 24(3), s 28-29). Ministerial authorisation for disclosure of secret data means Ministers exercise a gatekeeper role (s 23).

• Evidentiary burden. The Act’s note references the Criminal Procedure Act 2009 s 72 on evidential burden for defences in summary proceedings, which potentially eases prosecution thresholds in summary matters (s 26 note).

• Range of liable parties. The criminal offences apply to any person who obtains data under the Act; this means contractors, Department staff, staff of data sharing and analytics bodies, and designated body personnel may be criminally liable for unauthorised conduct (s 26-27). Delegations do not remove personal liability for unauthorised acts, though they structure administrative responsibility (s 31).

Together, the enforcement regime relies on a combination of criminal deterrence for misuse, reporting and regulator oversight for compliance and transparency, ministerial controls for secret material, and internal policy requirements for security and de-identification. The FOI exclusion shifts enforcement emphasis away from public transparency towards internal regulation and external oversight through the Information and Health Complaints Commissioners.

The Act deliberately situates itself in a legal field that involves secrecy provisions, privacy law and freedom of information, and it both excludes and supplements parts of those regimes. The Act references several other Acts by definition or interaction; these interactions determine what obligations remain, which are superseded and where cross-checks occur.

Privacy and Health Records Acts

• Non-displacement except where expressed (s 24(1)-(2)). The Act states that Part 4 does not affect the handling of data that would otherwise be permitted by or under the Privacy and Data Protection Act 2014 (PDPA) or the Health Records Act 2001, and except as expressly provided, the Act does not affect obligations under the PDPA or the Health Records Act in relation to identifiable data (s 24(1)-(2)). Therefore, the Chief Data Officer and data analytics bodies remain subject to those Acts unless the Data Sharing Act explicitly provides otherwise.

• Mandatory breach notifications to regulators (s 24(3)). The Chief Data Officer or a data analytics body must inform the Information Commissioner of a breach of the Act or PDPA, and the Health Complaints Commissioner of a breach of the Health Records Act, as soon as practicable after becoming aware of the breach (s 24(3)(a)-(b)). This ties the Act into the existing privacy and health oversight regimes.

Secrecy provisions and ministerial authorisations

• Non-contravention carve-out (s 20, s 22). If a secrecy provision applies to data disclosed under the Act, the disclosure or use does not contravene the secrecy provision provided it is in accordance with and for the purposes of the Act (s 20; s 22). This is an enabling clause that allows certain statutory secrecy requirements to be set aside for Act purposes.

• Ministerial and Commissioner authorisation for disclosure (s 23). Despite s 20 and s 22, the Chief Data Officer may only disclose data that is subject to a secrecy provision if the Minister responsible for administering the secrecy provision authorises the disclosure. For secrecy provisions under the Taxation Administration Act 1997 a further authorisation by the Commissioner of State Revenue is required (s 23(1)(a)-(b)). The Act therefore creates a two-step mechanism: the Act permits handling without contravention, but transfer or outward disclosure may require ministerial and sometimes administrative agency consent.

Freedom of Information

• Exclusion of documents (s 25). The Act makes specific classes of documents held by the Chief Data Officer or data analytics bodies exempt from the Freedom of Information Act 1982, including: data provided under the Act, information about data holdings provided under the Act, data sets created following data integration, and analogous documents held by data analytics bodies (s 25(1)(a)-(b)). The net effect is to limit FOI scrutiny over data provided under the Act and datasets derived from integration.

Criminal law and evidentiary rules

• Criminal sanctions (s 26-27). The Act creates summary and indictable offences for unauthorised access, use or disclosure of data or information obtained under the Act. The note in s 26 references s 72 of the Criminal Procedure Act 2009 about evidential burden, which governs procedural aspects of proving defences.

Statutory definitions and cross-reference

• Definitions rely on other Acts. The Act imports definitions and concepts from the Public Administration Act 2004, Health Records Act 2001, Freedom of Information Act 1982, Privacy and Data Protection Act 2014, Victoria Police Act 2013 and Inquiries Act 2014, among others (s 3). That means the meaning of "public service body", "exempt body", "health information" and other terms are set externally and can change with amendment of those other Acts.

Regulations and executive power

• Regulations may extend or limit scope (s 32). The Governor in Council may prescribe additional bodies as data sharing or analytics bodies, prescribe classes of restricted data, or prescribe secrecy provisions to which Division 2 of Part 4 does not apply (s 32(2)(a)-(d)). Regulations can therefore materially affect the Act’s reach and its interplay with statutory secrecy and restricted categories.

Administrative policies

• Chief Data Officer policies interact with statutory duties (s 33). The Chief Data Officer’s policies and guidelines on privacy, security, platforms, risk mitigation and project protocols are not mere recommendations; relevant bodies must have regard to them (s 33(4)). Those policies will operate within the constraints of the PDPA, Health Records Act, secrecy authorisations and regulation.

Practical points of interaction

• Situations of overlapping obligations. Where a data sharing body believes producing data would contravene a court order, legal professional privilege, contract, or other law, s 14 permits refusal (s 14(a)(i)-(v)). Where secrecy provisions exist, s 21 requires the responsible officer to inform the Chief Data Officer, and s 23 sets out the authorisation path for disclosure. These clauses create a chain of administrative checks before data moves from one legal regime to another.

• FOI and secrecy. The FOI exclusion in s 25 reduces one mechanism by which the public or media might obtain integrated datasets or analytics outputs. At the same time ministerial authorisation for disclosure of secret data retains executive control. Accountability therefore primarily flows through reporting and regulator oversight under s 24, s 28 and s 29 rather than FOI.

In short, the Act is designed to operate alongside, and where expressly authorised, to displace or carve out elements of, existing privacy, secrecy and FOI regimes. The key interactions are statutory: the Act preserves obligations under privacy and health records law unless expressly stated otherwise (s 24), authorises non-contravention of secrecy provisions for Act purposes but requires ministerial and sometimes administrative authorisation for further disclosure (s 20-23), and removes FOI access to datasets and documents created or held under the Act (s 25). Regulations and Chief Data Officer policies are the mechanisms by which the Act’s interface with other laws will be operationalised (s 32; s 33).

The source document includes a formal table of amendments and endnotes. The Act as published here incorporates amendments as at 6 December 2018. Key chronological and amendment facts recorded in the source are:

• Assent and commencement. The Victorian Data Sharing Act 2017 received Royal Assent on 5 December 2017 and came into operation on the day after Royal Assent, that is 6 December 2017 (s 2; Endnotes). The Minister’s second reading speech dates are recorded in the endnotes (Legislative Assembly 18 October 2017; Legislative Council 2 November 2017), included for context in the legislative record.

• Part 8 repeal. The endnotes record that s 36 repealed Part 8 (ss 34-36) on 6 December 2018. The Table of Amendments notes s 36 repealed Pt 8 on that date. The publication notes that s 36 itself (heading and ss 34-36) was repealed by No. 60/2017 s 36; the practical detail in the endnotes indicates style and schedule changes. The text available to this analysis states "Pt 8 (Heading and ss 34-36) repealed by No. 60/2017 s. 36." There are no other amendments noted in the "Amendments Not in Operation" section at the date of publication (Endnotes, pt 3).

• No other amendments recorded in the source. The "Table of Amendments" in the endnotes reproduces the status of the Act and records the repeal of Part 8 as the only entry. The edition of the Act used here states "This publication incorporates amendments made to the Victorian Data Sharing Act 2017 by Acts and subordinate instruments" and indicates the current state relates to the provisions amending the Act, but no further amendment entries are present in the included endnotes.

• Explanatory details. The endnotes include an "Explanatory details" heading but state "No entries at date of publication." The other endnotes set out interpretative details (for example, about headings and notes being part of the Act) but do not supply material amendments.

Implication for practitioners

• Limited amendment history in source. For those researching legislative evolution, the source shows a narrow amendment history in the immediate legislative record presented. The repeal of Part 8 is the only change the document expressly records. Users seeking subsequent amendments after 6 December 2018 must consult the current consolidated legislation on the official Victorian legislation website cited in the endnotes.

• Regulatory potential. The Act itself contains extensive delegation to regulations (s 32), enabling future adjustments by the Governor in Council, for example to prescribe additional data sharing or analytics bodies or to carve out secrecy provisions from Division 2 of Part 4. The statutory architecture therefore anticipates future expansion or contraction through subordinate instruments even if primary legislation has not been further amended.

• Monitoring the Ministerial review. The Minister must cause a review after the first five years (s 30). That statutory review is an anticipated mechanism for potential policy changes and legislative amendment recommendations. The review report must be laid before each House of Parliament within 12 months after its completion (s 30(b)). The presence of this mandatory review provides an institutional check point where Parliament may be presented with proposed amendments based on early operation experience.

This section is constrained to recorded amendments and the instrument’s design for future change. The source contains no further historical amendment narrative or records of later statutory changes beyond what is set out above.

The Act text and the endnotes supplied do not list any cases or litigation concerning the Victorian Data Sharing Act 2017. The source does not name judicial decisions, and therefore there are no statutes, reported cases or tribunal decisions contained within this document to cite.

Absent appellate or trial authority in the source, practitioners should note the following potential litigation vectors grounded in the Act’s text and the statutory framework:

• Judicial review of refusals to produce data. Section 14 gives a responsible officer discretion to refuse requests on enumerated grounds, including legal professional privilege, contract, court orders, secrecy provisions and prejudice to investigations. Because refusals are administrative decisions and are recorded as required (s 9(3)(a); s 12(3)(a)), they may be amenable to judicial review on standard public law grounds such as unlawfulness, irrationality or failure to take into account mandatory considerations. The Act itself does not define judicial review limits or procedures for internal appeal.

• Challenges to FOI exclusions. Section 25 excludes certain documents from the Freedom of Information Act 1982. Challenges might in theory arise where individuals or bodies dispute that a document falls within the s 25 categories, or that the Chief Data Officer or a data analytics body improperly classified material. The Act creates the statutory exclusion, but disputes over characterization and the factual record could be litigated.

• Privacy and health law disputes. The Act preserves obligations under the Privacy and Data Protection Act 2014 and the Health Records Act 2001 except as expressly provided (s 24(1)-(2)). Litigation could arise in relation to alleged breaches of those Acts in the context of data handled under the Data Sharing Act, for example where a person alleges improper de-identification or disclosure. The Act places notification duties on the Chief Data Officer where breaches are likely (s 24(3)), which may provide a paper trail for enforcement by regulators, but civil or administrative proceedings under the PDPA or Health Records Act could follow.

• Criminal prosecutions for unauthorised disclosure or use. Sections 26 and 27 create summary and indictable offences for unauthorised access, use or disclosure of data obtained under the Act. Prosecutions would proceed in the ordinary way through criminal courts; the Act references evidential burden provisions in the Criminal Procedure Act 2009 (s 26 note). The Act itself does not provide further procedural variations for criminal proceedings.

• Ministerial authorisation disputes. Section 23 requires ministerial authorisation to disclose data subject to secrecy provisions. Litigation could arise if a Chief Data Officer discloses without required authorisations, or if a Minister refuses authorisation where the Act or policy reasons might favour disclosure. The Act does not create a statutory appeal against ministerial decisions.

Practitioners must check subsequent case law and tribunal decisions beyond the date of this source to determine whether any of these potential litigation paths have been pursued and how courts have interpreted the Act. The current source does not supply any judicial interpretation, precedent or litigation outcomes.

The Act contains multiple provisions and structural choices that create unexpected effects or operational pitfalls for agencies, counsel and data custodians. The following are specific points to watch, grounded in the Act text.

FOI exclusion scope and practical transparency implications (s 25)

• Documents containing data provided under the Act, information about data holdings provided under the Act, and datasets created following data integration are excluded from the Freedom of Information Act 1982 (s 25(1)(a)(i)-(iii); s 25(1)(b)(i)-(iii)). That means integrated datasets and information held in the Centre are not subject to FOI. Practitioners often expect FOI as a transparency route; here FOI will not permit access to many outputs of the Chief Data Officer or data analytics bodies. The exclusion extends to data analytics bodies as well as the Chief Data Officer (s 25(1)(b)).

Designated bodies need not respond (s 10; s 13)

• The Chief Data Officer’s notices carry mandatory response obligations for data sharing bodies but not for designated bodies. Designated bodies, including exempt bodies, Boards of Inquiry and Royal Commissions, may provide data but are not required to respond to requests for data or for information about holdings (s 10; s 13). If you are the Chief Data Officer, the statute provides no compulsory enforcement route for designated bodies. If you represent a designated body, you have statutory flexibility to decline to engage.

Regulatory substitution of "restricted data" and secrecy exemptions (s 8(3); s 32(2)(c)-(d))

• The Chief Data Officer must not request restricted data (s 8(3)). But "restricted data" includes classes that can be prescribed by regulation (s 3 definitions; s 32(2)(c)). The Governor in Council may also prescribe secrecy provisions to which Division 2 does not apply (s 32(2)(d)). That means the regulations can materially alter what data is within reach, and the Secretary’s request powers can be narrower depending on subordinate instruments. Practitioners must check the regulations and any prescriptions.

De-identification obligations without express technical standard or retention rule (s 18-19)

• The Act requires "reasonable steps" to ensure data no longer relates to identifiable individuals before using it for data analytics work and requires analytics results disclosed to be de-identified (s 18(1); s 19). The Act does not specify technical de-identification standards, minimum risk thresholds or retention/destruction requirements for identifiable data used for integration. De-identification is to be guided by de-identification techniques, technical and administrative safeguards, and guidelines issued by the Chief Data Officer (s 18(2)). In practice this leaves considerable discretion to the Chief Data Officer to set standards, but it also creates legal uncertainty for data custodians deciding whether their de-identification steps are "reasonable".

Principled refusal but procedural obligations (s 14; s 9(3); s 12(3))

• Responsible officers may refuse for a wide range of legal and practical reasons (s 14). However, if they refuse they must send the response also to the Secretary to the Department (s 9(3)(a); s 12(3)(a)) and state reasons (s 9(3)(b); s 12(3)(b)). The obligation to provide reasons to the Secretary introduces administrative visibility and potential political or departmental pressure to justify refusals.

Scope of who is criminally liable (s 26-27)

• The criminal offences extend to "a person" who obtains data under the Act (s 26-27). That captures external contractors, consultants, IT providers and other third parties who obtain data in the course of work. Organisations should therefore align contracts and access controls with the Act to manage criminal risk for individuals.

Secrecy provision authorisation process can be multi-step and political (s 21; s 23)

• If a responsible officer knows a secrecy provision applies, they must inform the Chief Data Officer (s 21). The Chief Data Officer cannot disclose data to which a secrecy provision applies without ministerial authorisation, and for taxation secrecy the Commissioner of State Revenue must also authorise (s 23(1)(a)-(b)). Practically this adds time, layers and political discretion to any plan involving secret material. The Act does not mandate timeframes for ministerial or Commissioner authorisations.

"Documents in possession or control" extends extraterritorially in practice (s 3(2))

• For the purposes of the Act, a body "holds data" if the data is contained in a document in the possession or under the control of the body, irrespective of where the document is situated, whether in or outside Victoria (s 3(2)). This means materials stored offshore or in cloud infrastructure may still be within the Act’s reach, and data custodians must consider cross-border storage and compliance implications.

Chief Data Officer policies are mandatory in practice (s 33(4))

• While the Act leaves technical standards and governance arrangements to policies, the Chief Data Officer may publish policies and guidelines and a data sharing body, designated body or data analytics body must have regard to them (s 33(1)-(4)). Failure to have regard can create administrative risk and may be relevant in regulator investigations or judicial review claims.

No explicit duty to destroy or return identifiable data after integration

• The Act contains no express retention or destruction obligation for identifiable data once integration is completed. The absence of an explicit statutory retention rule creates operational risk and reliance on Chief Data Officer policies and PDPA/Health Records Act obligations to determine lifecycle management.

Interaction with other Acts depends on express language (s 24)

• The Act states it does not affect handling permitted by the PDPA or Health Records Act, and does not affect obligations under those Acts except as expressly provided (s 24(1)-(2)). Practitioners must trace express provisions carefully to see where the Data Sharing Act limits, permits, or supplements pre-existing obligations.

These gotchas signal areas where operational practice and legal risk may diverge from initial expectations. Agencies and legal advisers should map requests, secrecy provisions, regulatory prescriptions and Chief Data Officer guidance against these clauses to reduce compliance risk.

This section sets out concrete steps and programme elements that data sharing bodies, designated bodies, data analytics bodies and the Chief Data Officer should implement to meet statutory obligations. The guidance is grounded in the Act’s provisions and the administrative structures the Act creates.

1. Maintain an up-to-date inventory of data holdings and designated secrecy flags

• Create and maintain a searchable inventory that records dataset descriptions, whether they contain personal or health information (s 3 definitions), identifiers and unique identifiers, and whether secrecy provisions may apply. The Chief Data Officer may request information about holdings (s 11(2)) and responsible officers must be able to respond within 10 business days (s 12(2)). Where secrecy provisions apply, responsible officers must inform the Chief Data Officer (s 21). An inventory reduces response time and ensures accurate notifications.

2. Design a clear legal review workflow for requests

• When a s 8 notice is received, initiate an internal legal and operational review to determine whether the dataset contains restricted data, whether release would breach legal professional privilege, contract, equitable confidentiality, court orders or other laws (s 14(a)(i)-(v)). If refusing, prepare a written notice stating reasons, and send it both to the Chief Data Officer and to the Secretary to the Department as required (s 9(3)(a); s 12(3)(a)). Document the basis for refusals to create an auditable record.

3. Map secrecy provisions and ministerial authorisation processes

• For data subject to statutory secrecy, develop a protocol to notify the Chief Data Officer (s 21), and a process for obtaining ministerial authorisation if disclosure by the Chief Data Officer is contemplated (s 23(1)(a)). For taxation secrecy under the Taxation Administration Act 1997, coordinate with the Commissioner of State Revenue where their authorisation is required (s 23(1)(b)). Establish timelines and stakeholder contacts to avoid procedural delay.

4. Establish technical de-identification and access controls

• Implement de-identification protocols that meet the "reasonable steps" standard and reference the de-identification techniques and safeguards set out in s 18(2). Because the Act leaves technical specification to the Chief Data Officer’s guidelines, align your technical approach with published Chief Data Officer policies (s 33), and document the risk assessment and techniques used. Ensure technical safeguards include access logging, role-based access, encryption at rest and in transit, and segregation between integration environments and analytics environments.

5. Prepare contracts and third-party arrangements to reflect criminal liability

• Contractors, cloud providers and consultants who obtain data under the Act are within the Act’s scope and could be liable for unauthorised use or disclosure (s 26-27). Include contractual provisions requiring adherence to the Act, mandatory training, clear delineation of permitted uses, security requirements aligned with the Victorian protective data security framework (referenced in s 3 definitions), auditing rights, and obligations to notify the Chief Data Officer and the data sharing body of suspected breaches.

6. Document retention, destruction and recordkeeping practices

• The Act does not prescribe retention or destruction requirements for identifiable data following integration. To reduce legal risk, adopt explicit policies on data lifecycle management consistent with PDPA and Health Records Act obligations (s 24). Retain decision and consent records, de-identification logs, linkage keys (secured separately), and any ministerial authorisations obtained under s 23. The Chief Data Officer’s policies may provide further mandatory directions (s 33(2)).

7. Put in place robust breach detection and notification procedures

• If the Chief Data Officer or a data analytics body becomes aware a breach of the Act or relevant privacy or health records law has occurred while data was in their control, they must inform the Information Commissioner or Health Complaints Commissioner and the data sharing body (s 24(3)). Establish incident response processes to meet the "as soon as practicable" timeframe in s 24(3), including templates for regulator notifications and internal escalation.

8. Prepare for reporting obligations

• The Chief Data Officer must report annually to the Health Complaints Commissioner and the Information Commissioner on health information and personal information handling respectively (s 28-29). Build systems to record numbers of requests, the number and basis of refusals, compliance steps, project summaries and assessments of issues and challenges so that reports can be compiled on schedule and meet the statutory content requirements.

9. Train personnel on permissible uses and criminal exposures

• Provide mandatory training to all personnel who may handle data under the Act on permitted uses under the Act (s 5; s 15-19), the distinction between integration and analytics work (s 3 definitions; s 17-18), the FOI exclusion (s 25), secrecy provision rules (s 20-23), and the criminal offences (s 26-27). Emphasise the two-tier offence structure and the reasonable steps defence in s 26(2).

10. Engage with the Chief Data Officer’s policies and governance

• The Chief Data Officer may issue policies and guidelines covering privacy-preserving procedures, security safeguards, technology platforms and protocols (s 33(2)). Bodies must have regard to these policies (s 33(4)). Participate in consultations where possible and integrate published guidelines into internal procedures.

11. Manage intergovernmental and cross-jurisdictional data sharing

• The Chief Data Officer has a function to lead and coordinate cross-jurisdictional sharing (s 7(1)(c)). Where data from other jurisdictions or Commonwealth bodies is involved, check whether other statutory constraints or Commonwealth secrecy provisions apply, and whether ministerial authorisation under s 23 will be required.

12. Use the delegation powers appropriately

• Responsible officers and the Chief Data Officer may delegate powers to employees (s 31). Ensure delegations are formally documented, that delegates have appropriate training and authority, and that oversight and audit trails are in place to demonstrate lawful exercise of delegated powers.

Following these steps aligns operational practice with the Act’s statutory architecture and reduces legal, operational and reputational risk. Because many compliance details are left to Chief Data Officer policies and regulations, organisations should monitor and input into those soft-law instruments and keep their processes adaptable to regulatory or policy change.