Data

Overview

• At present, the regulation of public sector data in Australia (i.e. access to and usage of Australian Government data) is subject to significant reform, as set out in the proposed Data Availability and Transparency Act scheme.
• For the regulation of data in the private sector, see Consumer Data Right under Consumer Rights.

Background

• In December 2020, the Australian Government introduced the Data Availability and Transparency Bill (Cth) (the DATA scheme), which seeks to modernise and streamline data sharing arrangements between government agencies to: improve government service delivery; inform and evaluate government policy development; and support research and development. The DATA scheme is to be managed by a new National Data Commissioner.
• See DAT Bill - Issues Paper, Discussion Paper, Exposure Draft and Accredited Discussion Paper
• See DAT Bill - Explanatory Memorandum
• Note that Australian companies processing or controlling the data of individuals in the European Union (EU) are subject to a ‘security of processing’ obligation and data breach notification requirements under the General Data Protection Regulation (GDPR).
• Note that the Commonwealth Government, in its 2023-2030 Australian Cyber Security Strategy, discussed the possibility of amending the Security of Critical Infrastructure Act 2018 (Cth) to clarify data protection obligations.

Legal Framework

Data Availability and Transparency Bill 2020 (Cth)

• The Data Availability and Transparency Bill 2020 authorises and regulates controlled access to and sharing of Australian Government data through a principles-based scheme accompanied by regulations, rules and data codes. Here, 'sharing' means providing controlled access to data, as opposed to open release to public.
• Key personnel in the scheme:
  • 'National Data Commissioner' is an independent regulator responsible for overseeing the scheme and issuing non-legislative guidelines and data codes.
  • 'Data custodians' are Commonwealth bodies that control public sector data.
  • 'Accredited users' are entities accredited by the Commissioner to access public sector data once certain security, privacy, infrastructure and governance requirements are satisfied.
  • 'Accredited data service providers (ADSPs) are entities accredited by the Commissioner to perform data services such as data integration.
• ‘Public sector data’ is defined as data lawfully created, collected or held by or on behalf of Commonwealth bodies or data custodians. These data custodians may share such data to ‘accredited users’ either directly or indirectly through an ADSP. Accredited users do not necessarily need to be Commonwealth bodies. An accredited user can be any entity that satisfies the accreditation criteria and that has applied and has been approved by the National Data Commissioner.
• There are several criteria for accreditation of both accredited users and ADSPs, such as the ability to: manage data accountably and responsibly; apply the data sharing principles; minimise risk of unauthorised access, sharing or loss of data; commit to continuous improvement to ensure privacy and security of the data and comply with obligations under the scheme.
• The scheme will control the sharing of data in three ways: sharing only for a 'permitted data sharing purpose', sharing only in accordance with the 5 prescribed data sharing principles; and via formalised data sharing agreements.
• Section 23 of the Bill provides data custodians with limited statutory authority to override other laws which would otherwise prevent sharing, collection, and use of public sector data that are authorised by the scheme. The relationship between the Bill and the Privacy Act 1988 (Cth) - especially Australian Privacy Principle 6: Use or disclosure of personal information - is the subject of ongoing debate.
  • See Privacy Impact Assessment on DAT Bill (8 March 2021)

Security of Critical Infrastructure Act 2018 (SOCI)(Cth)

• Data processing and storage industry functions and assets have been recently defined in the SOCI legislation. Under SOCI, ‘data storage’ implies the use of information technology and includes data back-up. A ‘data storage or processing provider’ means an entity that provides a ‘data storage or processing service’: that is, a service that enables end-users to store or back-up data; or a data processing service.
• Data storage or processing (DSoP) has been designated a critical infrastructure sector under SOCI. One consequence of this designation is that positive security obligations under SOCI, such as implementing a risk management plan, attach to the assets of some of these providers. The DSoP sector is unique among critical infrastructure sectors as it is the only sector that is a critical sector because it is a part of other sectors’ supply chains. The obligations will not apply to every critical infrastructure sector; rather, defined asset classes will attract the obligations.

SOCI and Cloud Computing

• Of relevance is whether DSoP and its customers have obligations under SOCI if they own or operate assets in the sectors and asset classes identified in the legislation and rules. For example, which cloud infrastructure providers does a Software as a Service (SaaS) provider engage with for hosting services? These kinds of questions lead to other sources of law, policy, and regulation, such as those set out in the assessment and authorisation frameworks providing a SaaS provider’s authority to operate.
• It is possible that SaaS providers could in the future be declared a System of National Significance (SoNS), if the service had a large share of government and critical infrastructure provider customers and met the threshold in SOCI. Additionally, SaaS providers may be part of the critical infrastructure supply chain – that is, providing services to owners and operators of other critical infrastructure assets. In this scenario, application of SOCI to cloud providers is uncertain. SaaS providers will interact with critical infrastructure providers at the level of sectoral regulation, such as energy (electricity), financial markets and services, water, and transport (freight). Each of these sectors is subject to their own regulations, which may impact SaaS providers.

Regulatory & Policy Framework

Relevant Organisations

• Office of the National Data Commissioner
• National Data Advisory Council
• The Data Sector Group of the Trusted Information Sharing Network (TISN)

Inquiries & Consultations

• Productivity Commission
  • Data Availability and Use: Final Report (8 May 2017)
  • Australian Government Response - Data Availability and Use
• Office of the National Data Commissioner - Data Availability and Transparency Bill (Cth)
  • Issues Paper
  • Discussion Paper
  • Exposure Draft of DAT Bill
  • Accreditation Discussion Paper
  • Submissions to Issues Paper, Discussion Paper and Exposure Draft
    • Submission by Office of the Australian Information Commissioner on Exposure Draft
  • Privacy Impact Assessment on DAT Bill (8 March 2021)
• Commonwealth Senate Finance and Public Administration Legislation Committee - Report on DAT Bill (April 2021)

Industry Materials

• Data Availability and Transparency Bill 2020, AGS (22 December 2020)
• Release of the Data Availability and Transparency Bill, Minter Ellison (27 October 2020)
• Lyria Bennett Moses et al, 'Inquiry into the Data Availability and Transparency Bill 2020 and the Data Availability and Transparency (Consequential Amendments) Bill 2020', UNSW Law Research Paper No 21-37 (12 March 2021)
• The Data Availability and Transparency Bill 2020: What you need to know and current status, Gilbert + Tobin (14 May 2021)
• Chris Culnane and Kobi Leins, 'Misconceptions in Privacy Protection and Regulation' (2020) 36(2) Law in Context 1

Related Topics

• Consumer Rights
• Privacy Law
• Security of Critical Infrastructure