Data Availability and Transparency (Consequential Amendments) Transitional Rules (Transitional Entity) Amendment Rule 2023

EXPLANATORY STATEMENT

Issued by the authority of the Minister for Finance

Data Availability and Transparency (Consequential Amendments) Transitional Rules (Transitional Entity) Amendment Rule 2023

The Data Availability and Transparency (Consequential Amendments) Transitional Rules (Transitional Entity) Amendment Rule 2023 (‘the instrument’) amends the Data Availability and Transparency (Consequential Amendments) Transitional Rules 2022 (‘the DATCA Rules’).

The instrument is made under item 4 in Schedule 3 of the Data Availability and Transparency (Consequential Amendments) Act 2022 (‘the Act’); for the purposes of the definition of transitional entity in subitem 1(1) in Schedule 3 of the Act, and subitem 2(2) in Schedule 3 of the Act. Subsection 33(3) of the Acts Interpretation Act 1901 provides that a power to make a legislative instrument includes a power to amend or repeal that instrument in the same manner, and subject to the same conditions, as the power to make the instrument.

The instrument commences on the day after it is registered on the Federal Register of Legislation. The instrument is a legislative instrument for the purposes of the Legislation Act 2003 (‘Legislation Act’) and is subject to disallowance under section 42 of the Legislation Act.  

Purpose

The purpose of the instrument is to amend the DATCA Rules to add Queensland Health as a prescribed transitional entity.

The Act supports the operation of the Data Availability and Transparency Act 2022 (‘the DAT Act’) by enabling the Minister, by legislative instrument, to make rules to prescribe an entity as a transitional entity (see item 4 in Schedule 3 of the Act). Currently, the rules made for this purpose are the DATCA Rules. For the purpose of the data sharing scheme, a transitional entity is taken to be accredited as an Accredited Data Service Provider (‘ADSP’) under the DAT Act for the duration of its transition period (see subitem 2(1) in Schedule 3 of the Act).

Under the DAT Act, most Australian Government departments and agencies that control Australian Government data are ‘data custodians’, and may share the data they control with ‘accredited users’ under a data sharing agreement, subject to specific limitations and controls in the DAT Act. Data may be shared with accredited users directly, or through ADSPs, acting as intermediaries. ADSPs are entities that have particular expertise in data sharing and the provision of data services.

The term ‘transitional entity’ is defined in subitem 1(1) in Schedule 3 of the Act as an Australian entity prescribed by the rules. ‘Australian entity’ is defined in section 9 of the DAT Act as an entity that is a Commonwealth body, a State body or a Territory body; the Commonwealth, a State or a Territory; or an Australian University. Queensland Health is a State body (a department of the State of Queensland) and is eligible to be prescribed as a transitional entity.  

ADSPs may only collect and use data under the data sharing scheme established by the DAT Act in accordance with conditions of accreditation. Section 30 of the DAT Act requires ADSPs to comply with conditions of accreditation. Subitem 2(2) in Schedule 3 of the Act allows the Minister to prescribe in rules conditions of accreditation applicable to a transitional entity. The instrument prescribes the following conditions on Queensland Health:

• the entity must not provide complex data integration services as part of a project unless those services are provided by the Statistical Services Branch undertaking data linkage activities only;
• the entity must not provide secure access data services as part of a project; and
• the entity must not provide de-identification data services as part of a project.

Subitem 2(2) in Schedule 3 of the Act also provides that such conditions of accreditation are taken to have been imposed by the National Data Commissioner (‘Commissioner’) under section 78 of the DAT Act, and the Commissioner may therefore vary or remove such conditions under the DAT Act, or impose additional conditions of accreditation.

Eligible Australian entities are not prescribed as transitional entities indefinitely but rather for the duration of its transitional period. The instrument provides that the transitional period for Queensland Health will commence on the day the instrument commences.

Subitem 2(3) in Schedule 3 of the Act provides for the end of the transitional period as being no later than the earlier of of the following:

• if the Commissioner cancels the entity’s accreditation as an ADSP under section 81 of the DAT Act – the day the cancellation takes effect;
• the end of the period of forty months beginning on the day the Act received the Royal Assent.

The Act received the Royal Assent on 31 March 2022, so the transition period for a transitional entity must end no later than the end of 30 July 2025.

During the applicable transition period, a transitional entity has the same obligations under the DAT Act as an entity accredited by the Commissioner as an ADSP. The Commissioner has regulatory oversight over transitional entities and, if required, the Commissioner may suspend or cancel the ADSP accreditation of a transitional entity under section 81 of the DAT Act. Subitem 2(3) of Schedule 3 to the Act provides that, if the Commissioner cancels the ADSP accreditation of a transitional entity, the transition period for that transitional entity ends.

Consultation

Consultation on this instrument was undertaken in accordance with section 17 of the Legislation Act.

External consultation was undertaken before the instrument was made, via an exposure draft published on the Office of the National Data Commissioner (‘ONDC’) website from 30 October 2023 to 13 November 2023. This consultation was open to the public and key stakeholders were informed of the consultation and invited to make submissions. No formal submissions on the instrument were received during this consultation.

The Office of Impact Analysis (‘OIA’) was also consulted and advised that an Impact Analysis is not required (OIA23-05857). The transitional arrangements continue previous accreditation arrangements for data service providers handling Australian Government data. This instrument is technical and machinery in nature. The instrument will not impact business activity and will have no, or minimal, compliance costs or competition impact.

Explanation of provisions

Section 1 provides that the name of the instrument is the Data Availability and Transparency (Consequential Amendments) Transitional Rules (Transitional Entity) Amendment Rule 2023.

Section 2 provides that the instrument commences the day after it is registered on the Federal Register of Legislation.

Section 3 provides that the instrument is made under Schedule 3 of the Act. Item 4 in Schedule 3 provides that the Minister may, by legislative instrument, make rules prescribing matters required or permitted to be prescribed by the Schedule. Items 1 and 2 in Schedule 3 provide that the Minister may prescribe Australian entities (as defined in the DAT Act) as transitional entities, and prescribe conditions of accreditation and the transition period for such transitional entities.

Section 4 provides that Schedule 1 to the instrument amends the Data Availability and Transparency (Consequential Amendments) Transitional Rules 2022 (‘DATCA Rules’).

Item 1, Schedule 1 amends section 4 of the DATCA Rules by adding a definition for ‘Queensland Health’. The definition clarifies that references to Queensland Health in the instrument are references to the department of government called Queensland Health, a department of the State of Queensland.

Item 2, Schedule 1 amends the table in section 5 of the DATCA Rules by adding a new item 4A after item 4 in the table. The new item 4A adds Queensland Health to the list of transitional entities in the table. The new item prescribes the conditions that apply to Queensland Health as a transitional entity. These conditions limit the data services that may be provided by Queensland Health as follows:

• it must not provide complex data integration services as part of a project unless those services are provided by the Statistical Services Branch undertaking data linkage activities only;
• it must not provide secure access data services as part of a project; and
• it must not provide de-identification services as part of a project.

Data linkage is a subset of complex data integration involving the initial steps in data integration; namely the matching of identifiable information from data sources so it is linked in order to create anonymised linkage keys.

The new item also prescribes that the transitional period for Queensland Health commences on the day the instrument commences.

Statement of Compatibility with Human Rights

Prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011

Data Availability and Transparency (Consequential Amendments) Transitional Rules (Transitional Entity) Amendment Rule 2023

This instrument is compatible with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.

Overview of the legislative instrument

The purpose of the Data Availability and Transparency (Consequential Amendments) Transitional Rules (Transitional Entity) Amendment Rule 2023 (‘the instrument’) is to amend the Data Availability and Transparency (Consequential Amendments) Transitional Rules) 2022 (the ‘DATCA Rules’) to add Queensland Health as a prescribed transitional entity.

The instrument is made under item 4 in Schedule 3 of the Data Availability and Transparency (Consequential Amendments) Act 2022 (‘the Act’); for the purposes of the definition of transitional entity in subitem 1(1) in Schedule 3 of the Act, and subitem 2(2) in Schedule 3 of the Act. Subsection 33(3) of the Acts Interpretation Act 1901 provides that a power to make a legislative instrument includes a power to amend or repeal that instrument in the same manner, and subject to the same conditions, as the power to make the instrument.

The Act supports the operation of the Data Availability and Transparency Act 2022 (‘the DAT Act’) by enabling the Minister, by legislative instrument, to make rules to prescribe an entity as a transitional entity (see item 4 in Schedule 3 of the Act). Currently, the rules made for this purpose are the DATCA Rules. For the purpose of the data sharing scheme, a transitional entity is taken to be accredited as an Accredited Data Service Provider (‘ADSP’) under the DAT Act for the duration of its transition period (see subitem 2(1) in Schedule 3 of the Act).

Under the DAT Act, most Australian Government departments and agencies that control Australian Government data are ‘data custodians’, and may share the data they control with ‘accredited users’ under a data sharing agreement, subject to specific limitations and controls in the DAT Act. Data may be shared with accredited users directly, or through ADSPs, acting as intermediaries. ADSPs are entities that have particular expertise in data sharing and the provision of data services.

The term ‘transitional entity’ is defined in subitem 1(1) in Schedule 3 of the Act as an Australian entity prescribed by the rules. ‘Australian entity’ is defined in section 9 of the DAT Act as an entity that is a Commonwealth body, a State body or a Territory body; the Commonwealth, a State or a Territory; or an Australian University. Queensland Health is a State body (a department of the State of Queensland) and is eligible to be prescribed as a transitional entity. 

ADSPs may only collect and use data under the data sharing scheme established by the DAT Act in accordance with conditions of accreditation. Section 30 of the DAT Act requires ADSPs to comply with conditions of accreditation. Subitem 2(2) in Schedule 3 of the Act allows the Minister to prescribe in rules conditions of accreditation applicable to a transitional entity. The instrument prescribes the following conditions on Queensland Health:

• the entity must not provide complex data integration services as part of a project unless those services are provided by the Statistical Services Branch undertaking data linkage activities only;
• the entity must not provide secure access data services as part of a project; and
• the entity must not provide de-identification data services as part of a project.

Subitem 2(2) in Schedule 3 of the Act also provides that such conditions of accreditation are taken to have been imposed by the National Data Commissioner (‘Commissioner’) under section 78 of the DAT Act, and the Commissioner may therefore vary or remove such conditions under the DAT Act, or impose additional conditions of accreditation.

Eligible Australian entities are not prescribed as transitional entities indefinitely but rather for the duration of its transitional period. The instrument provides that the transitional period for Queensland Health will commence on the day the instrument commences.

Subitem 2(3) in Schedule 3 of the Act provides for the end of the transitional period as being no later than the earlier of of the following:

• if the Commissioner cancels the entity’s accreditation as an ADSP under section 81 of the DAT Act – the day the cancellation takes effect;
• the end of the period of forty months beginning on the day the Act received the Royal Assent.

The Act received the Royal Assent on 31 March 2022, so the transition period for a transitional entity must end no later than the end of 30 July 2025.

During the applicable transition period, a transitional entity has the same obligations under the DAT Act as an entity accredited by the Commissioner as an ADSP. The Commissioner has regulatory oversight over transitional entities and, if required, the Commissioner may suspend or cancel the ADSP accreditation of a transitional entity under section 81 of the DAT Act. Subitem 2(3) of Schedule 3 to the Consequential Amendments Act provides that, if the Commissioner cancels the ADSP accreditation of a transitional entity, the transition period for that transitional entity ends.

Human rights implications

This instrument engages the right to protection from arbitrary or unlawful interference with privacy, because the DAT Act authorises ADSPs (including transitional entities) to collect and use personal information (as defined in the Privacy Act 1988) in certain limited circumstances.

The right to protection from arbitrary or unlawful interference with privacy is recognised in Article 17 of the International Covenant on Civil and Political Rights (ICCPR). This right encompasses the right to respect for informational privacy, including with respect to the storing, use and sharing of private and confidential information.

The right to privacy is also recognised in Article 16 of the Convention on the Rights of the Child, which states that no child shall be subjected to arbitrary or unlawful interference with his or her privacy, family, home or correspondence, nor to unlawful attacks on his or her honour and reputation.

All data sharing under the DAT Act must be consistent with the Privacy Act 1988 because sharing that is inconsistent with the Privacy Act 1988 is barred by subsection 17(5) of the DAT Act.

The DAT Act imposes a range of protections in relation to data shared under the DAT Act, including personal information shared under the DAT Act. A transitional entity taken to be an ADSP may only collect and use shared data as authorised by section 13B of the DAT Act. A transitional entity may only collect and use personal information under the DAT Act as an ADSP if it is subject to privacy obligations in relation to the information (paragraph 13B(e) and section 16E of the DAT Act). Personal information may only be shared under the DAT Act if the sharing is consistent with the privacy protections in sections 16A and 16B of that Act. These protections set out the requirements for consent regarding the sharing of personal information, prohibit any personal information from being shared, stored, or accessed outside Australia, and ensure that any de-identified data remains de-identified.

The effect of this instrument is that the department of government, Queensland Health, may operate as an ADSP under the DAT Act without the Commissioner having assessed the entity as meeting the accreditation criteria in section 77 of the DAT Act. There are a number of mitigations for this risk. The transition period for the entity cannot extend beyond 30 July 2025. The entity is a State government department that has been assessed under non‑statutory arrangements as being suitable to perform data services in relation to Australian Government data. The Commissioner has regulatory oversight over transitional entities and, if necessary, the Commissioner may suspend or cancel the ADSP accreditation of a transitional entity, or vary or impose additional conditions of accreditation on the ADSP accreditation of a transitional entity.

The transitional arrangements implemented by this instrument reduce risks to privacy because they enable departments and agencies with a high level of expertise in data sharing and the provision of data services to act as intermediaries in the data sharing scheme established by the DAT Act.

Conclusion

This instrument is consistent with human rights because any limitation on the right to protection from arbitrary or unlawful interference with privacy is reasonable, necessary and proportionate.

Senator the Hon. Katy Gallagher, Minister for Finance