EXPLANATORY STATEMENT
Issued by the authority of the National Data Commissioner
Data Availability and Transparency Act 2022
Data Availability and Transparency Amendment (No. 1) Code 2025
Purpose
This explanatory statement accompanies the Data Availability and Transparency Amendment (No. 1) Code 2025 (the instrument).
The Data Availability and Transparency Act 2022 (the Act) commenced on 1 April 2022. The Act established a new data sharing scheme (the scheme) for sharing safely Australian Government data with entities accredited under the scheme. The National Data Commissioner (the Commissioner) is appointed under the Act as an independent regulator of the scheme. The Commissioner is authorised to make (and in some cases is required to make) codes of practice about the scheme (data codes). Data codes may set out how definitions in the Act are to be applied and may impose additional requirements on data scheme participants so long as those requirements are not contrary to, or inconsistent with, the Act. Section 26 of the Act provides that a data scheme entity must comply with a data code. The instrument prescribes a number of requirements for data sharing agreements for the purposes of subsection 19(16) of the Act.
The purpose of the instrument is to prescribe additional requirements for data sharing agreements made under the Act. These requirements ensure that if state or territory data obtained by a Commonwealth body from a State or Territory body under a contract or agreement is shared by the Commonwealth body, who is a data custodian under the Act, the data sharing agreement explicitly recognises rights and obligations that the State or Territory body may have in respect of the data by specifying certain information about any conditions on sharing and use of the data.
Authority
The instrument is made by the Commissioner under section 126 of the Act and subsection 33(3) of the Acts Interpretation Act 1901 (the AIA).
Subsection 33(3) of the AIA provides that where an Act confers a power to make a legislative instrument, the power shall be construed as including a power exercisable in the like manner and subject to the like conditions (if any) to repeal, rescind, revoke, amend or vary any such instrument.
The instrument is a legislative instrument that is subject to disallowance.
Background
The sharing of data under the scheme can occur for projects that meet one or more of three data sharing purposes (the delivery of government services, informing government policy and programs, and research and development). Under the Act, most Australian Government departments and agencies that control Australian Government data are ‘data custodians’ of public sector data and may share the data they control with ‘accredited users’ under a data sharing agreement, subject to specific limitations and controls in the Act.
As data custodians under the Act, Commonwealth bodies may hold data obtained from a State or Territory body. While State or Territory bodies are not data custodians for the purposes of the Act, they may nevertheless be the custodians of the data they have provided to the Commonwealth in a more general sense. State or Territory bodies may also set the scope of a Commonwealth body’s right to deal in the data by imposing conditions on a Commonwealth body’s use of the data (including on the Commonwealth body’s ability to share the data).
For a data custodian to be authorised to share data with an accredited user, the project the sharing is part of must be covered by a registered data sharing agreement that is in effect and meets the requirements of the Act. These include the matters specified in section 19, which among other things requires an agreement to identify the parties to the agreement, to describe the relevant project and specify that the Act applies to the agreement, and to meet any applicable privacy obligations. In addition, subsection 19(16) requires compliance with any additional requirements that are specified in a data code.
Failure to comply with requirements in section 19 may result in sharing not being authorised by section 13 and collection and use not being authorised under section 13A, which can result in penalties for unauthorised sharing or unauthorised collection or use under sections 14 and 14A respectively.
In conjunction with the requirements for data sharing agreements, sharing data under the Act is barred in certain circumstances. These include sharing that would contravene or infringe a contract or agreement to which the data custodian of the data is a party (see subparagraph 17(3)(a)(ii) of the Act). Conditions on the use of data held by a data custodian can prevent the data custodian from sharing that data with another entity, or restrict the sharing to certain purposes or under certain arrangements.
How the instrument operates
The instrument applies where a data custodian shares data that it has obtained from a State or Territory body. Specifically, it applies to a data sharing agreement under which the source data is, or includes data that is state or territory data, and the data custodian of the source data obtained the data from a State or Territory body under a contract or agreement (a provisioning agreement).
The instrument requires the data sharing agreement to specify certain particulars to ensure that the rights of State or Territory bodies over data provided to a data custodian, and any obligations on data custodians in sharing such data, are explicitly recognised and protected in the agreement.
Commencement
This instrument commences the day after it is registered on the Federal Register of Legislation.
Consultation
Before the instrument was made, the Commissioner was satisfied that consultation was undertaken to the extent appropriate and reasonably practicable, in accordance with section 17 of the Legislation Act 2003.
Between 27 March to 1 May 2025, the Commissioner consulted publicly on an exposure draft of a data code that included provisions equivalent to those in the instrument, which was available on the Office of the National Data Commissioner’s website. The exposure draft was also distributed to various Commonwealth as well as State and Territory bodies likely to be affected by the instrument. A total of 3 submissions were received as part of this consultation process. The instrument reflects changes made following consultation to remove ambiguity around circumstances where a data sharing agreement under the scheme and the provisioning agreement under which data custodian obtained the data from a State or Territory body could be the same agreement.
Explanation of provisions
Section 1 provides that the name of the instrument is the Data Availability and Transparency Amendment (No. 1) Code 2025.
Section 2 provides that the instrument commences the day after it is registered on the Federal Register of Legislation.
Section 3 provides that the instrument is made under section 126 of the Act. Section 126 of the Act provides that the Commissioner may, by legislative instrument, make codes of practice about the data sharing scheme (data codes) including data codes setting out how the provisions of Chapters 2 and 3 of the Act are to be applied or complied with, and dealing with matters the Commissioner considers necessary or convenient to deal with for carrying out or giving effect to the data sharing scheme.
Section 4 provides that each instrument that is specified in Schedule 1 to this instrument is amended or repealed as set out in the applicable items in the Schedule, and any other item in the Schedule to this instrument has effect according to its terms. This instrument specifies the Data Availability and Transparency Code 2022 (the Code).
Item 1 of Schedule 1 repeals paragraph (p) of the note to section 4 of the Code and substitutes paragraphs (p) – (v). The note to section 4 lists a number of expressions used in the Code that are defined in the Act. These changes reflect the additional expressions in the Act that are used by the amendments inserted by the instrument.
Item 2 of Schedule 1 inserts the definition of state or territory data in section 4 of the Code. It defines state or territory data to mean data collected, created or held by or on behalf of a State body or a Territory body.
This new definition is broadly consistent with the definition of ‘public sector data’ for Commonwealth bodies in the Act but does not include a requirement that data be lawfully collected. While this is an important element of the definition of public sector data, it also reflects a reasonable expectation that data custodians understand the basis on which they have collected data. In contrast, a data custodian will not always be in a position to determine the basis on which another entity (for example, a State body or a Territory body) has collected data that is then provided to the data custodian.
Item 3 of Schedule 1 renumbers Part 4 – Miscellaneous as Part 9 of the Code.
Item 4 of Schedule 1 renumbers section 24 of the Code as section 90.
Item 5 of Schedule 1 renumbers section 25 of the Code as section 91.
The renumbering introduced by items 3 to 5 ensures that existing ‘miscellaneous’ provisions in the Code can continue to be located at the end of the Code. This allows the amendments to be introduced through a new Part 4, while allowing for future parts to be introduced into the Code before the miscellaneous provisions to reflect the order of related provisions in the Act, if it is necessary to do so in the future.
Item 6 of Schedule 1 substitutes Part 4 – Requirements to be met by all data sharing agreements after Part 3 of the Code. Part 4 substitutes sections 24 and 25 of the Code. Section 24 provides that the purpose of Part 4 is to set out additional requirements that a data sharing agreement must meet for the purposes of the Act. It states that the project the sharing is part of must be covered by a registered data sharing agreement that is in effect and meets the requirements of the Act, for an entity to be authorised to share data with another entity under the Act.
Section 25 prescribes the requirements that must be met, for the purposes of subsection 19(16) of the Act, by a data sharing agreement under which the source data is, or includes, data that is state or territory data. The amendments use the term ‘source data’, which is defined in the Act as the data that is to be shared under a data sharing agreement by a data custodian (see paragraph 19(3)(a) of the Act).
The requirements apply where the data custodian of the source data obtained the state or territory data from a State body or a Territory body (a state or territory data provider) under a contract or agreement (a provisioning agreement) that is separate to the data sharing agreement.
This ensures the requirements apply to arrangements under which a data custodian obtains state or territory data directly from a state or territory data provider under a formal arrangement. The requirements also complement the ‘barring’ provisions in subparagraph 17(3)(a)(ii) of the Act, which prohibit data from being shared under the Act where doing so is prohibited by a contract or agreement to which the data custodian is a party. This approach means the requirements do not apply where a data custodian obtains data relating to a State or Territory through other mechanisms (for example, under Commonwealth legislation or through private sector entities), reflecting that in such circumstances the State or Territory will not have imposed conditions on the data custodian’s use of the data.
The requirements also do not apply where a data custodian obtains and shares state or territory data through the same agreement, rather than obtaining under one agreement (the provisioning agreement) and sharing through another agreement (being a data sharing agreement). In such cases, it is not necessary to require specific particulars regarding the state or territory data and any conditions related to the data in such a data sharing agreement as the state or territory data providers will also be a party to the agreement.
The provisioning agreement does not have to strictly precede the data sharing agreement for the requirements to apply. The requirements also apply where the agreements are made at the same time.
Where the above conditions are met, the requirements are that the data sharing agreement specify:
- the state or territory data included in the source data; and
- the state or territory data provider of the data; and
- whether there are any conditions in the provisioning agreement related to the data custodian sharing the state or territory data; and
- if there are such conditions, how the sharing of the source data under the agreement is consistent with those conditions.
These requirements apply even where there are no conditions imposed on the sharing of state or territory data. In such circumstances, it is still necessary for an agreement to provide details about the state or territory data, the state or territory data provider, and the fact there are no conditions.
Where there are conditions relating to state or territory data, they do not necessarily need to be strictly reproduced in the data sharing agreement. Instead, it is sufficient for the agreement to explain how it is consistent with any such conditions. However, if parties prefer to replicate conditions in a data sharing agreement, then doing so would ensure the agreement is consistent with those underlying conditions (because it would apply in a manner that is consistent with those conditions). Providing flexibility about how this requirement is satisfied is intended to ensure parties to a data sharing agreement have some discretion in meeting the requirements, reflecting that there may be sensitivities (including commercial sensitivities) with requiring conditions to be replicated in full in a data sharing agreement. Even where the parties prefer to document all the conditions in a data sharing agreement, this flexibility allows them to reflect changes in context between the provisioning agreement and the data sharing agreement. Such changes may render a direct replication of the conditions inappropriate. For example, this could include situations where the parties to the agreements differ because the state or territory data provider is not a party to the data sharing agreement and, therefore, some references to the state or territory provider in the conditions need to be amended accordingly.
Where there are multiple sets of state or territory data or multiple state or territory data providers, an agreement must provide particulars of each of the data sets and providers.
Item 7 of Schedule 1 inserts Part 10—Application, saving and transitional provisions and Division 1—Application provisions relating to the Data Availability and Transparency Amendment (No. 1) Code 2025 at the end of the Code. Division 1 sets out sections 100 and 101. Section 100 provides that amending instrument means the Data Availability and Transparency Amendment (No 1) Code 2025 for Division 1 purposes. Section 101 provides that the amendments made by Schedule 1 to the amending instrument apply in relation to data sharing agreements entered into on or after 1 July 2025.
This application rule grandfathers existing data sharing agreements and provides a transition period for agreements that are entered into shortly after the new requirements commence. Agreements that are entered into during the transition period do not need to satisfy the new requirements. This is intended to allow Scheme participants a reasonable period to adjust to the new requirements.
Statement of Compatibility with Human Rights
Prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011
Data Availability and Transparency Amendment (No. 1) Code 2025
This disallowable legislative instrument is compatible with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.
Overview of the disallowable legislative instrument
This disallowable legislative instrument prescribes additional requirements for data sharing agreements made under the Data Availability and Transparency Act 2022 (the Act). These requirements ensure that if a Commonwealth body shares data obtained from a State or Territory body under a contract or agreement with an accredited entity, the governing data sharing agreement explicitly recognises the rights and obligations of the State or Territory body in relation to the data. Additionally, the requirements ensure certain information about any conditions on sharing and use of the data are included in the agreement.
The Act establishes a data sharing scheme (DATA Scheme) that, in specified circumstances, authorises the provision of controlled access to Australian Government data. Under the Act, most Australian Government departments and agencies that control Australian Government data are ‘data custodians’ and may share the data they control with ‘accredited users’ under a data sharing agreement, subject to specific limitations and controls in the Act. Data may be shared with accredited users directly, or through accredited data service providers (ADSPs), acting as intermediaries. Only Commonwealth, State and Territory bodies, the Commonwealth, a State or a Territory and Australian universities (as defined in the Act) may be accredited as users or ADSPs under the Act.
The Act establishes the statutory office of the National Data Commissioner (Commissioner). The Commissioner has responsibility for regulating the data sharing scheme established by the Act.
Under the Act, for an entity to be authorised to share data with another entity under the Act, the project the sharing is part of must be covered by a registered data sharing agreement that is in effect and meets the requirements of the Act.
This instrument sets out additional requirements that a data sharing agreement must meet for the purposes of the Act where the source data is state or territory data. It defines ‘state or territory data’ as data that is collected, created or held by or on behalf of a State or Territory body. In addition, it recognises a ‘state or territory data provider’ as the State or Territory body from which the Commonwealth data custodian obtained the state or territory data.
This disallowable instrument applies where state or territory data obtained by a data custodian under a contract or agreement is shared by the data custodian as part of a data sharing project governed by a data sharing agreement that meets the requirements of the Act.
Projects can also involve state or territory data being shared directly with a user by a State or Territory body outside of the DATA Scheme. Direct sharing arrangements outside of the DATA Scheme are not covered by this instrument but would generally be subject to any conditions imposed by the State or Territory provider. This instrument also does not cover projects where a data custodian obtains data relating to a State or Territory through other mechanisms (for example, under Commonwealth legislation or through private sector entities), reflecting that in such circumstances the State or Territory will not have imposed conditions on the data custodian’s use of the data.
Human rights implications
This legislative instrument engages the right to protection from arbitrary or unlawful interference with privacy because the Act authorises entities to collect and use personal information (as defined in the Privacy Act 1988) in certain limited circumstances.
The right to protection from arbitrary or unlawful interference with privacy is recognised in Article 17 of the International Covenant on Civil and Political Rights (ICCPR). This right encompasses respect for informational privacy, including the right to respect the storing, use and sharing of private and confidential information.
The right to privacy is also recognised in Article 16 of the Convention on the Rights of the Child, which states that no child shall be subjected to arbitrary or unlawful interference with his or her privacy, family, home or correspondence, nor to unlawful attacks on his or her honour and reputation.
All data sharing under the Act must be consistent with the Privacy Act 1988. Sharing that is inconsistent with the Privacy Act 1988 is barred by subsection 17(5) of the Act.
The Act imposes a range of protections in relation to data shared under the Act, including personal information shared under the Act. Personal information may only be shared under the Act if the sharing is consistent with the privacy protections in sections 16A and 16B of that Act.
The effect of this instrument is that if data obtained by a Commonwealth data custodian from a State or Territory body under a contract or agreement is then shared by the data custodian with an accredited entity, the data sharing agreement under which the data is shared must specify:
- the state or territory data included in the source data; and
- the state or territory data provider of the data; and
- whether there are any conditions in the provisioning agreement related to the data custodian sharing the state or territory data; and
- if there are such conditions, how the sharing of the source data under the agreement is consistent with those conditions.
These requirements apply even where there are no conditions imposed on the sharing of state or territory data. In such circumstances, it is still necessary for an agreement to provide details about the state or territory data, the state or territory data provider, and the fact there are no conditions.
Given the existing privacy controls in the Act, the current requirements under section 19 for data sharing agreements and the proposed additional requirements on the use of state or territory data, this instrument should not have an impact on the privacy of individuals whose data may be shared under the DATA Scheme.
This legislative instrument does not engage any other applicable rights or freedoms recognised or declared in the other international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.
Conclusion
This instrument is compatible with human rights because it does not raise any human rights issues.