the obligations of Australia under international law, including obligations under any international agreement binding on Australia; and

any law of the Commonwealth giving effect to such an agreement.

providing another entity with access to the data; and

(b) providing open access to the data (releasing the data).

the entity that provides access is taken to retain a copy of the data; and

the entity to which access is provided is taken to collect a copy of the data.

data custodians of public sector data;

accredited entities.

is a Commonwealth body; and

is not an excluded entity; and

either:

controls public sector data (whether alone or jointly with another entity), including by having the right to deal with that data; or

has become the data custodian of output of a project in accordance with section 20F.

the National Data Commissioner and any APS employee made available to the National Data Commissioner under section 47;

the National Anti-Corruption Commission;

the Inspector of the National Anti-Corruption Commission;

(b) the agency known as the Australian Criminal Intelligence Commission established by the Australian Crime Commission Act 2002;

the Australian Federal Police;

that part of the Defence Department known as the Australian Geospatial-Intelligence Organisation;

the Australian National Audit Office;

the Australian Secret Intelligence Service;

the Australian Security Intelligence Organisation;

the Australian Signals Directorate;

that part of the Defence Department known as the Defence Intelligence Organisation;

the Inspector-General of Intelligence and Security;

the Office of the Commonwealth Ombudsman;

the Office of National Intelligence.

(a) accredited user (an accredited user); or

(b) ADSP (short for accredited data service provider) (an ADSP);

is an accredited entity.

(a) an entity (the sharer) shares data with another entity (the user), either directly or through another entity (the intermediary);

(b) the user collects the data and uses the output of the project, which is:

the copy of the data collected by the user; and

any data that is the result or product of the user’s use of the shared data.

the sharer shares the data with the intermediary;

(b) the intermediary collects the data and uses the ADSP-enhanced data of the project, which is:

the copy of the data collected by the intermediary; and

any data that is the result or product of the intermediary’s use of the shared data.

the copy retained by the user continues to be output of the earlier project; and

the copy collected by the user in the later project is output of the later project in accordance with paragraph (1)(b); and

if the sharing in the later project is done through an intermediary—the copy collected by the intermediary in the later project is ADSP-enhanced data of the later project in accordance with paragraph (3)(b).

the constitutional requirements in subsection (4) are met;

the data custodian requirements in subsection (2) are met;

the project the sharing is part of is covered by a registered data sharing agreement that is in effect and that meets the requirements of this Act;

the sharing is in accordance with the data sharing agreement;

the sharer is satisfied that the project is consistent with the data sharing principles;

the user is an accredited user and its accreditation is not suspended;

if the data shared with the user includes personal information—the privacy coverage condition in section 16E is met in relation to the user;

if the sharer shares through an intermediary—the intermediary is an ADSP and its accreditation is not suspended;

if the data shared with the intermediary includes personal information—the privacy coverage condition in section 16E is met in relation to the intermediary.

the data is public sector data and the sharer is the data custodian of the data;

if the sharer is not the only data custodian of the data—authority to share the data has been given by each other data custodian;

the sharing is not barred by section 17;

the sharing is consistent with the general privacy protections in section 16A and the purpose-specific privacy protections in section 16B;

if the data shared does not include personal information—only the minimum amount of data necessary for the project to proceed is shared;

if the requirement in subsection 16C(2) or 16D(2) applies—the requirement is met.

an authorised officer of that data custodian;

if another data custodian is authorised to act as the agent of that data custodian—an authorised officer of the agent data custodian.

the data is shared with a Commonwealth body or Territory body, or the Commonwealth or a Territory;

the data is shared with a State body or a State, as part of a project that:

relates to a matter of national interest that requires national cooperation to achieve an identified national objective; or

addresses an immediate need to take coordinated action in an area that will have significant national and cross-jurisdictional effect; or

occurs in the context of the Commonwealth otherwise facilitating cooperation with or between the States;

the data is shared as part of a project that is for a data sharing purpose set out in paragraph 15(1)(a) (delivery of government services) or (b) (informing government policy and programs), if the government concerned is or includes the Commonwealth;

the data is shared with a constitutional corporation as part of a project that is for the data sharing purpose set out in paragraph 15(1)(c) (research and development);

the data is shared by means of electronic communication;

the data is shared to enable analysis for statistical purposes;

the data is statistical information.

the entity provides access to data; and

the provision of access is purportedly under section 13; and

the provision of access is not authorised by section 13.

the individual or body corporate uses data; and

the use is a provision of access to the data by an entity under, or purportedly under, section 13; and

the individual has a designated relationship with the entity, or the body corporate is party to an approved contract with the entity; and

the individual or body corporate’s use is not authorised by this Act.

Offences

the entity provides access to data; and

the provision of access is purportedly under section 13; and

the provision of access is not authorised by section 13 and the entity is reckless with respect to that circumstance.

the individual or body corporate uses data; and

the use is a provision of access to the data by an entity under, or purportedly under, section 13; and

the individual has a designated relationship with the entity, or the body corporate is party to an approved contract with the entity; and

the individual or body corporate’s use is not authorised by this Act and the individual or body corporate is reckless with respect to that circumstance.

the entity collects or uses data; and

the data is ADSP-enhanced data, or output, of a project involving sharing data with the entity under, or purportedly under, section 13; and

the collection or use is not authorised by this Act.

300 penalty units; or

if subsection (2) applies—600 penalty units.

the sensitivity of the data;

the consequences of the contravention for entities, groups of entities or things to which the data involved in the contravention relates;

the level of care taken by the contravening entity in relation to the entity’s responsibilities under the data sharing scheme in relation to the collection or use.

the individual or body corporate uses data; and

the data is ADSP-enhanced data, or output, of a project involving sharing data with an entity under, or purportedly under, section 13; and

the individual has a designated relationship with the entity, or the body corporate is party to an approved contract with the entity; and

the individual or body corporate’s use of the data is not authorised by this Act.

Offences for user or intermediary

the entity collects or uses data; and

the data is ADSP-enhanced data, or output, of a project involving sharing data with the entity under, or purportedly under, section 13; and

the collection or use is not authorised by this Act and the entity is reckless with respect to that circumstance.

the individual or body corporate uses data; and

the data is ADSP-enhanced data, or output, of a project involving sharing data with an entity under, or purportedly under, section 13; and

the individual has a designated relationship with the entity, or the body corporate is party to an approved contract with the entity; and

the individual or body corporate’s use of the data is not authorised by this Act and the individual or body corporate is reckless with respect to that circumstance.

Defence

the entity collects or uses data submitted to the entity under, or purportedly under, section 13A or 13B; and

the collection or use is not authorised by this Act.

the individual or body corporate uses data; and

the data was submitted to an entity under, or purportedly under, section 13A or 13B; and

the individual has a designated relationship with the entity, or the body corporate is party to an approved contract with the entity; and

the individual or body corporate’s use is not authorised by this Act.

Offences for sharer

the entity collects or uses data submitted to the entity under, or purportedly under, section 13A or 13B; and

the collection or use is not authorised by this Act and the entity is reckless with respect to that circumstance.

the individual or body corporate uses data; and

the data was submitted to an entity under, or purportedly under, section 13A or 13B; and

the individual has a designated relationship with the entity, or the body corporate is party to an approved contract with the entity; and

the individual or body corporate’s use is not authorised by this Act and the individual or body corporate is reckless with respect to that circumstance.

Relationship of collection and use civil penalty provisions and offences with other laws

delivery of government services;

informing government policy and programs;

research and development.

Delivery of government services

providing information;

providing services, other than services relating to a payment, entitlement or benefit;

determining eligibility for a payment, entitlement or benefit;

paying a payment, entitlement or benefit.

Precluded purposes

an enforcement related purpose;

(b) a purpose that relates to, or prejudices, national security within the meaning of the National Security Information (Criminal and Civil Proceedings) Act 2004;

a purpose prescribed by the rules for the purposes of this paragraph.

detecting, investigating, prosecuting or punishing:

an offence; or

a contravention of a law punishable by a pecuniary penalty;

detecting, investigating or addressing acts or practices detrimental to public revenue;

detecting, investigating or remedying serious misconduct;

conducting surveillance or monitoring, or intelligence-gathering activities;

conducting protective or custodial activities;

enforcing a law relating to the confiscation of proceeds of crime;

preparing for, or conducting, proceedings before a court or tribunal or implementing a court/tribunal order.

a data sharing purpose; and

a purpose that:

is with respect to matters that relate only in a general way to a purpose mentioned in paragraph (2)(a) or (b); and

does not involve any person undertaking an activity mentioned in a paragraph of subsection (3).

Preparing data for a later project

the project can reasonably be expected to serve the public interest;

the parties observe processes relating to ethics, as appropriate in the circumstances.

People principle

access to data is only provided to individuals who have attributes, qualifications, affiliations or expertise appropriate for the access;

(b) the entity sharing the data considers the following matters in relation to the entity collecting the data (the collector):

the collector’s experience with projects involving the sharing of public sector data, under this Act or otherwise;

the collector’s capacity to handle public sector data securely;

any data breaches, or breaches of the law relating to data, by the collector;

any other matters specified in a data code.

Setting principle

the means by which the data is shared, collected and used are appropriate, having regard to the type and sensitivity of the data, to control the risks of unauthorised use;

reasonable security standards are applied when sharing, collecting and using data.

Data principle

the final output; and

output the creation of which is reasonably necessary or incidental to creation of the final output.

the data custodian of the data and the accredited user consider:

the nature and intended use of the output of the project; and

requirements and procedures for use of the output of the project;

the final output contains only the data reasonably necessary to achieve the applicable data sharing purpose or data sharing purposes.

Application of data sharing principles

one or more of the following apply:

the service being delivered is a service mentioned in paragraph 15(1A)(a) or (b) and is delivered to the individual;

the individual consents to the sharing of their personal information;

(iii) the sharing would be a disclosure authorised under Privacy Act 1988 (dealing with personal information in emergencies and disasters); andPart VIA of the

the service being delivered is identified in the data sharing agreement for the project; and

only the minimum amount of personal information necessary to properly deliver the service is shared.

both of the following apply:

the individual consents to the sharing of their personal information;

only the minimum amount of personal information necessary for the project to proceed is shared; or

all of the following apply:

the project cannot proceed without the personal information;

the public interest served by the project justifies the sharing of personal information about individuals without their consent;

only the minimum amount of personal information necessary for the project to proceed is shared;

a permitted circumstance for the project’s data sharing purpose exists (see subsections (4) and (5)).

it is unreasonable or impracticable to seek the individual’s consent;

(b) the data is to be collected and used in the course of medical research and in accordance with guidelines under subsection 95(1) of the Privacy Act 1988;

the sharing is with an ADSP as an intermediary, to enable the ADSP to prepare ADSP-enhanced data that does not involve personal information about the individual;

the sharing is ADSP-controlled access (see subsection (6));

the accredited user is a Commonwealth body (other than a Commonwealth body excluded from this paragraph by the rules) and the final output of the project includes only de-identified information;

(f) the sharing is a disclosure authorised under Privacy Act 1988 (dealing with personal information in emergencies and disasters).Part VIA of the

an ADSP is sharing the data on behalf of the data custodian with an accredited user; and

the data is shared by means of the ADSP providing access to the data:

by use of systems controlled by the ADSP; and

to particular identified designated individuals for the entity, each of whom has appropriate experience, qualifications or training; and

the ADSP has implemented controls to prevent or minimise the risk of the data being used to identify individuals.

a statement that personal information is being shared without consent of individuals because it is unreasonable or impracticable to seek their consent; and

an explanation of the data custodian’s reasons for so concluding.

the data sharing purpose of the project is informing government policy and programs or research and development; and

the project involves performing a de-identification data service (see subsection (3)) or a secure access data service (see subsection (4)).

the data custodian of the data, if the data custodian is not an ADSP but is satisfied that it has the appropriate skills and experience to perform the service;

the data custodian of the data, if the data custodian is an ADSP able to perform such a service consistently with its conditions of accreditation;

an ADSP able to perform such a service consistently with its conditions of accreditation.

the service of providing ADSP-controlled access; or

any other service that enables an entity to access data under the control of another entity and that includes controls to prevent or minimise the risk of the data being misused.

the data sharing purpose of the project is informing government policy and programs or research and development; and

the project involves performing a complex data integration service (see subsection (3)); and

a decision that subsection (4) applies to the service has not been made.

the data custodian of the data, if the data custodian is an ADSP able to perform such a service consistently with its conditions of accreditation;

an ADSP able to perform such a service consistently with its conditions of accreditation.

2 or more entities control the data being integrated; and

the data is at the unit or micro level; and

any of the following subparagraphs applies to any of the data to be integrated, or to the integrated data:

the data includes personal information;

the data includes commercially sensitive information (including trade secrets) about the business, commercial, or financial affairs of an organisation;

the data includes information that is not publicly available about an industry or sector that forms part of the Australian economy;

the data includes information about one or more persons or things the data custodian of the data considers to be vulnerable or sensitive;

the data is to be used for more than one project;

the data meets conditions prescribed by the rules; and

the data to be integrated, or the integrated data, has any of the characteristics prescribed by the rules (if any).

the size of the data sets;

whether the data relates to a significant proportion of the population of people or things to which the data relates;

the detail of the individual records included in the data;

how current the data is and whether it will be updated;

the quality of the metadata and documentation for the data sets;

whether entities that collected data to be integrated, or on whose behalf data to be integrated was collected, are aware of the proposed use of the data;

if the data includes personal information—whether a person qualified to assess the ethics of the proposed use of the data has conducted such an assessment;

whether the data custodian of the integrated data will control the technical environment in which the integrated data will be accessed;

any other matters prescribed by the rules.

an authorised officer of a data custodian of data that is to be integrated; or

an individual authorised under subsection 137(4) for the data custodian of data that is to be integrated.

the entity is an APP entity; or

(b) the Privacy Act 1988 applies to the entity, in relation to its collection and use of data as part of the project, as if the entity were an organisation within the meaning of that Act; or

the entity is subject to an APP-equivalence term of the data sharing agreement in relation to its collection and use of data as part of the project; or

a law of a State or Territory that provides for all of the following applies in relation to the entity’s collection and use of data as part of the project:

protection of personal information comparable to that provided by the Australian Privacy Principles;

monitoring of compliance with the law;

a means for an individual to seek recourse if the individual’s personal information is dealt with in a way contrary to the law.

(a) an interference with the privacy of the individual for the purposes of the Privacy Act 1988; and

covered by sections 13, 13G and 13H of that Act.

an act or practice of the entity has contravened, or may have contravened, the APP-equivalence term in relation to an individual; and

(b) the act or practice is the subject of a complaint to, or an investigation by, the Information Commissioner under Part V of the Privacy Act 1988.

the data is held by, or originated with or was received from, an excluded entity; or

the data is operational data that is held by, or originated with or was received from, any of the following:

(i) AUSTRAC (within the meaning of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006);

the Australian Federal Police;

(iii) the Department administered by the Minister administering the Australian Border Force Act 2015; or

an excluded entity would be a data custodian of the data, if paragraph 11(2)(b) were disregarded.

Contravention or infringement of rights etc.

sharing the data contravenes or infringes:

copyright or other intellectual property rights to which the data is subject; or

a contract or agreement to which a data custodian of the data is party; or

a common law duty or privilege; or

(iv) a privilege or immunity of a House of the Parliament, a member of a House of the Parliament, or a committee within the meaning of the Parliamentary Privileges Act 1987; or

the data is commercial information and sharing it founds an action by a person (other than the Commonwealth or a Commonwealth body) for breach of confidence.

Prescribed by the regulations

any of the following prohibits the data custodian, or any of the individuals to whom the data custodian’s authorisation would extend under section 124, from disclosing the data in the circumstances in which the sharing is done:

a provision of a law prescribed by the regulations for the purposes of this subparagraph;

an order, direction, certificate or other instrument made by an officer of the Commonwealth (including a Minister) under a provision of a law prescribed by the regulations for the purposes of this subparagraph; or

the data custodian of the data is prescribed by the regulations as an entity that must not share data in the capacity of data custodian; or

any other circumstances prescribed by the regulations for the purposes of this paragraph exist.

International matters

sharing the data is inconsistent with:

the obligations of Australia under international law, including obligations under any international agreement binding on Australia; or

any law of the Commonwealth giving effect to such an agreement; or

unless the foreign government, or agency of the foreign government, has agreed to the sharing—the data was collected from a foreign government, or an agency of a foreign government.

Evidence and court/tribunal orders

the copy of the data to be shared is being held as evidence before a court; or

the copy was obtained by a tribunal, authority or other person using a power to require the answering of questions or the production of documents and is being held as evidence before the tribunal, authority or other person; or

the data:

is subject to a court/tribunal order that manages, prohibits or restricts publication or other disclosure of the data; or

relates to the existence or content of such a court/tribunal order and a law of the Commonwealth prohibits or restricts disclosure of that existence or content.

the agreement relates to the sharing of public sector data; and

the parties to the agreement include a data custodian of public sector data and an accredited user; and

the agreement is in the approved form (if any) or in writing (if there is no approved form); and

any requirements specified in a data code are met in relation to the agreement.

(a) the public sector data that the data custodian is to share (including any ADSP-enhanced data an ADSP is to share on behalf of the data custodian) (the source data); and

the output of the project that the data custodian and accredited user agree is to be the final output.

specify the data custodian of the source data; and

if the agreement appoints a Commonwealth body as data custodian of output of the project in accordance with section 20F—specify the output and explain why the appointment has been made.

specify:

the data sharing purpose, or data sharing purposes, of the project; and

if, under the agreement, the accredited user is to be allowed to use output of the project for any purpose incidental to that purpose or those purposes—any such incidental purpose; and

except in relation to any use of the output allowed in accordance with section 20D—prohibit the accredited user from collecting and using output of the project for any of the following:

any purpose not specified;

any precluded purpose.

the final output; and

output the creation of which is reasonably necessary or incidental to creation of the final output.

describing how the public interest is served by the project; and

specifying the actions the party will take to give effect to the principles.

specify any data services the ADSP is to perform in relation to public sector data shared with the ADSP by the data custodian; and

specify the circumstances in which the ADSP is to share, with the accredited user on behalf of the data custodian, ADSP-enhanced data of the project; and

prohibit the ADSP from providing access to, or releasing, the ADSP-enhanced data in any other circumstances other than circumstances (if any) specified in the agreement.

describe in general terms the use to be made by the accredited user of the output of the project; and

prohibit the accredited user from using the output in a way that is inconsistent with the description; and

prohibit the accredited user from providing access to, or releasing, the output in any circumstances other than circumstances (if any) specified in the agreement.

its duration;

the intervals at which the parties must review it.

allows the access to be provided to:

an entity that carries on a business, or is a not-for-profit entity, to which the output relates, for the purpose of validating or correcting the output; or

(ii) an individual to whom the output relates, or a responsible person (within the meaning of the Privacy Act 1988) for such an individual, for the purpose of validating or correcting the output; or

another person in circumstances prescribed by the rules that relate to validating or correcting the output; and

requires the data custodian of the source data to be satisfied, before access is provided, that the access will be an authorised use of the output under section 13A.

allows the provision of access, or release, in specified circumstances that do not contravene any other law of the Commonwealth or a law of a State or Territory (disregarding section 23 of this Act); and

if the output includes personal information about an individual—prohibits provision of access or release unless the individual consents; and

requires the data custodian of the source data to be satisfied, before the access is provided or the release occurs, that the access or release will be an authorised use of the output under section 13A.

a use of the output authorised by section 13A or 135 or required by a direction under section 112; and

not a submission of the output; and

not a sharing of data under section 13 allowed as mentioned in section 20D.

required by a direction under section 112; or

authorised by section 135.

Exit on collection etc. if sharing is for purpose of delivery of government services

the data is personal information about an individual; and

the data sharing purpose of the project is delivery of government services; and

before the data was shared with the accredited user, the individual expressly consented to their personal information:

being shared by the data custodian with the accredited user; and

being used by the accredited user without the requirements of this Act applying to the use.

the time the user collected the copy of the shared data; or

if the individual’s consent as mentioned in paragraph (4)(c) specified a later time—that later time.

the agreement appoints the user as data custodian of the output under subsection 20F(2); and

subparagraph 20F(2)(c)(i) does not apply; and

the conditions in subsection 20F(3) for exit of the output are met.

if subparagraph (2)(c)(i) applies—at the time the output is created; or

if subparagraph (2)(c)(ii) applies—at the time the output exits the data sharing scheme under subsection 20E(7); or

if subsection (5) applies—at the time the entity is provided with access to the output in accordance with section 13A.

the user is a Commonwealth body; and

the output is public sector data and not a copy of the shared data collected by the user; and

either:

the agreement allows the user to provide access to the data in circumstances allowed by section 20C or 20D; or

if subparagraph (i) does not apply—the conditions in subsection (3) for exit of the output are met.

provision of access to, or release of, the output by the user would not contravene any other law of the Commonwealth or a law of a State or Territory (disregarding section 23 of this Act); and

if the output includes personal information about an individual—the individual has expressly consented to their personal information being used by the user without the requirements of this Act applying to the use; and

the agreement requires the data custodian of the source data to be satisfied that all requirements in the agreement relating to exit of the output are met before the time specified in the agreement for the exit.

the entity is a Commonwealth body; and

the entity is not an excluded entity; and

the output is public sector data and not a copy of the shared data collected by the user; and

the agreement allows the user to provide the entity with access to the output in circumstances allowed by section 20C.

by an accredited user; and

in the approved form (if any) or in writing (if there is no approved form).

the exercise of the Commissioner’s regulatory functions or the Minister’s functions as the accreditation authority for the entity;

the entity’s accreditation or conditions of accreditation.

information or a document that is false or misleading; or

information that omits any matter or thing without which the information is false or misleading.

information or a document that is false or misleading; or

information that omits any matter or thing without which the information is false or misleading.

an electronic copy of the agreement; and

if the agreement is varied—an electronic copy of the variation, or the agreement as varied;

no later than 30 days after the day the agreement or variation is made.

whether it received requests from accredited users to share data under this Act;

if it received any such requests—the number of requests and the reasons it agreed to or refused them;

if it refused any such requests—the number of requests that were refused where reasons for the refusal were not given within the time required by subsection 25(3);

whether it received complaints relating to the data sharing scheme or its conduct in relation to it, and if it did, the number of complaints and information about the subject matter of the complaints;

whether it entered into any data sharing agreements and if it did, the number entered into.

the period applicable under a data code; or

if there is no period applicable under a data code—as soon as practicable.

a data custodian reasonably suspects or becomes aware that a data breach of an accredited entity has occurred; and

the data breach involves scheme data that is output, or ADSP-enhanced data, of a project in which the data custodian shared public sector data with or through the accredited entity;

the data custodian must, within the period applicable under subsection (3), take reasonable steps to prevent or reduce any harm resulting from the breach to entities, groups of entities and things to which the data involved in the breach relates.

the period applicable under a data code; or

if there is no period applicable under a data code—as soon as practicable after the breach occurs.

a data custodian of public sector data that is personal information about one or more individuals has shared the personal information with or through an accredited entity under section 13; and

the accredited entity holds the personal information.

Deemed holding of personal information by data custodian

the personal information were held by the data custodian; and

the data custodian were required under section 15 of that Act not to do an act, or engage in a practice, that breaches Australian Privacy Principle 11.1 in relation to the personal information.

in sufficient time; and

containing sufficient detail;

to enable the data custodian to comply with its obligations under Privacy Act 1988 as that Part applies because of subsection (2) of this section.Part IIIC of the

(a) the accredited entity is an APP entity that is required under Privacy Act 1988 not to do an act, or engage in a practice, that breaches Australian Privacy Principle 11.1 in relation to the personal information; andsection 15 of the

the data sharing agreement under which the personal information was shared with the entity provides that subsections (2) and (3) are not to apply in relation to the personal information.

Copy of eligible data breach statements given to Information Commissioner

the entity reasonably suspects or becomes aware that a data breach of the entity has occurred; and

data involved in the breach is not personal information about one or more individuals.

the period applicable under a data code; or

if there is no period applicable under a data code—as soon as practicable after the end of the financial year in which the breach occurs.

the kind or kinds of data;

the sensitivity of the data;

whether the data is protected by one or more security measures and, if so, the nature of those measures;

the persons, or the kinds of persons, who have obtained, or who could obtain, the data;

the nature of the harm;

any other relevant matters.

ethics;

balancing data availability with privacy protection;

trust and transparency;

technical best practice;

industry and international developments;

any other matters.

sharing of data under, or purportedly under, section 13 and the use of data in relation to such sharing;

matters incidental to the execution of any of the legislative powers of the Parliament or the executive power of the Commonwealth.

the Commissioner;

the Australian Statistician;

the Information Commissioner;

the Chief Scientist;

(e) at least 5, and no more than 8, other members appointed by the Commissioner (the appointed members).

Chair

designate himself or herself as the Chair of the Council; or

by written instrument, designate an appointed member to be the Chair for the period specified in the instrument.

is or was the accreditation authority for the entity; and

reasonably suspects that the entity has breached, is breaching or is proposing to breach this Act or a data sharing agreement.

for an investigation under subsection (1)—the Commissioner is satisfied that a ground exists for not dealing with the complaint to which the investigation relates (see section 92); or

for an investigation under subsection (1A):

the Minister no longer reasonably suspects that the entity has breached, is breaching or is proposing to breach this Act or a data sharing agreement (as the case requires), and informs the Commissioner of that fact; or

the Commissioner otherwise considers it appropriate to cease the investigation; or

for an investigation under subsection (2)—the Commissioner:

no longer reasonably suspects that the entity has breached this Act or a data sharing agreement; or

otherwise considers it appropriate to cease the investigation.

the Commissioner’s opinion as to whether the entity has breached this Act or a data sharing agreement, or is breaching or proposing to breach this Act or a data sharing agreement, and the reasons for that opinion; and

if the Commissioner is satisfied that the entity has breached this Act or the data sharing agreement, or is breaching or proposing to breach this Act or the data sharing agreement—an indication of any action the Commissioner has decided to take, or advise the Minister as accreditation authority to take, in relation to the entity’s accreditation, or under Part 5.5 (regulatory powers and enforcement) of this Act or the Regulatory Powers Act as it applies in relation to this Act.

must give the entity the determination made under the Commissioner decides to make the determination publicly available, notice of the entity’s review rights under Part 6.2 in relation to that decision; andsection 102 in relation to the investigation together with, if

if the investigation relates to a complaint under section 88 or 94—may also give the complainant that determination.

a person is given a notice under subsection (1); and

the notice relates to an investigation under section 101;

the person must comply with the notice.

the person is given a notice under subsection (1); and

the notice relates to an investigation under section 101; and

the person fails to comply with the notice.

may take possession of, and may make copies of, or take extracts from, the document; and

may retain possession of the document for any period necessary for the purposes of the investigation; and

must, during that period, permit any person who would be entitled to inspect the document if it were not in the Commissioner’s possession to inspect the document at any reasonable time.

legal advice given to a Minister or a Commonwealth body; or

a communication between a designated individual for a Commonwealth body, if the communication is within the actual or apparent scope of the individual’s designation, and another person or body.

the information given or document produced; and

the giving of the information or production of the document;

are not admissible in evidence against a person in any civil or criminal proceedings.

must withdraw the notice unless satisfied that it is reasonably necessary and proportionate to the investigation to require the person to give the information or produce the document; and

must ensure that the information and documents are held securely and destroyed when the investigation ends; and

may disclose the information or documents to a person if:

the person is a member of the staff mentioned in the Commissioner; andsection 47, or engaged as a contractor or consultant as mentioned in section 48 or 49, or otherwise providing services to

the Commissioner is satisfied that the disclosure is reasonably necessary for the purposes of the investigation; and

must not disclose the information or documents except in accordance with paragraph (c).

prejudice the security, defence or international relations of Australia;

involve the disclosure of communications between a Minister of the Commonwealth and a Minister of a State or Territory, being a disclosure that would prejudice relations between the Commonwealth government and the government of a State or Territory;

involve the disclosure of deliberations or decisions of the Cabinet or of a Committee of the Cabinet;

involve the disclosure of deliberations or advice of the Executive Council;

prejudice the conduct of an investigation or inquiry into crime or criminal activity that is currently being pursued, or prejudice the fair trial of any person;

disclose, or enable a person to ascertain, the existence or identity of a confidential source of information in relation to the enforcement of the criminal law;

prejudice the effectiveness of the operational methods or investigative practices or techniques of agencies responsible for the enforcement of the criminal law;

endanger the life or physical safety of any person.

Parliamentary privilege

the information or document was collected by the Commissioner or staff member in the course of performing functions under this Act; and

the Commissioner is satisfied that the information or document will assist the agency or body to perform any of its functions or exercise any of its powers; and

subsection 105(4) does not apply in relation to the information.

the Information Commissioner;

a State body, or a Territory body, whose functions include functions that correspond to those of the Information Commissioner;

the Commonwealth Ombudsman;

a State body, or a Territory body, whose functions include functions that correspond to those of the Commonwealth Ombudsman;

the Australian Securities and Investments Commission;

the Australian Competition and Consumer Commission;

a regulatory authority of a foreign country whose functions include functions that correspond to those of a person mentioned in paragraph (a), (c), (e) or (f);

the Australian National Audit Office;

the Australian Federal Police;

the police force, or police service, of a State or Territory;

the National Anti-Corruption Commission;

the Inspector of the National Anti-Corruption Commission;

(l) AUSTRAC (within the meaning of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006);

the Australian Security Intelligence Organisation;

the Inspector-General of Intelligence and Security;

an agency or body prescribed by the rules for the purposes of this paragraph.

Receive

a civil penalty provision;

an offence against section 14 or 14A (penalties for unauthorised sharing, collection and use) and subsection 104(3) (failure to comply with notice given under subsection 104(1));

a provision of Chapter 3 (responsibilities of data scheme entities).

Information subject to monitoring

there are no related provisions; and

the Commissioner is an authorised applicant; and

the Commissioner is an authorised person; and

any judicial officer within the meaning of the Regulatory Powers Act is an issuing officer; and

the Commissioner is the relevant chief executive; and

each of the following is a relevant court:

the Federal Court;

the Circuit Court;

a court of a State or Territory that has jurisdiction in relation to matters arising under this Act.

Person assisting

a civil penalty provision;

an offence against this Act;

a provision of Chapter 3 (responsibilities of data scheme entities).

Related provisions, authorised applicant, authorised person, issuing officer, relevant chief executive and relevant court

there are no related provisions; and

the Commissioner is an authorised applicant; and

the Commissioner is an authorised person; and

any judicial officer within the meaning of the Regulatory Powers Act is an issuing officer; and

the Commissioner is the relevant chief executive; and

each of the following is a relevant court:

the Federal Court;

the Circuit Court;

a court of a State or Territory that has jurisdiction in relation to matters arising under this Act.

Person assisting

either of the following situations exists:

the entity, or another entity, has acted or is likely to act in a way that is inconsistent with this Act or a data sharing agreement;

an emergency or high risk situation has arisen or is likely to arise; and

for a requirement to take specified actions—it is necessary, to address the situation or prevent it arising again, for the entity to take the actions immediately or as soon as practicable; and

for a requirement not to take specified actions—the entity is taking the actions or may take them imminently and it is necessary, to address the situation or prevent it arising again, for the entity not to take the actions.

Directions in other situations

the entity, or another entity, has acted or is likely to act in a way that is inconsistent with this Act or a data sharing agreement; and

for a requirement to take specified actions—it is necessary, to address the situation mentioned in paragraph (a) or prevent it arising again, for the entity to take the actions; and

for a requirement not to take specified actions—the entity is taking the actions or may take them and it is necessary, to address the situation mentioned in paragraph (a) or prevent it arising again, for the entity not to take the actions.

the accreditation authority for the entity intends to cancel the entity’s accreditation (whether at the entity’s request or otherwise); and

for a requirement to take specified actions—it is necessary, to ensure that the entity does not hold scheme data after the cancellation, for the entity to take the actions; and

for a requirement not to take specified actions—it is necessary, to ensure that the entity does not hold scheme data after the cancellation, for the entity not to take the actions.

Specified actions

the Commissioner is an authorised applicant in relation to the civil penalty provisions in this Act; and

each of the following is a relevant court in relation to the civil penalty provisions of this Act:

the Federal Court;

the Circuit Court;

a court of a State or Territory that has jurisdiction in relation to the matter.

the Commissioner is an infringement officer in relation to the provisions mentioned in subsection (1); and

the Commissioner is the relevant chief executive in relation to the provisions mentioned in subsection (1).

Single infringement notice may deal with more than one contravention

2 or more alleged contraventions of a provision mentioned in subsection (1); or

alleged contraventions of 2 or more provisions mentioned in subsection (1).

However, the notice must not require the person to pay more than one amount in respect of the same conduct.

the Commissioner is an authorised person in relation to the provisions of this Act; and

each of the following is a relevant court in relation to the provisions of this Act:

the Federal Court;

the Circuit Court;

a court of a State or Territory that has jurisdiction in relation to the matter.

Enforceable undertaking may be published on the Commissioner’s website

a civil penalty provision;

a provision of Chapter 3 (responsibilities of data scheme entities).

the Commissioner is an authorised person in relation to the provisions mentioned in subsection (1); and

each of the following is a relevant court in relation to the provisions mentioned in subsection (1):

the Federal Court;

the Circuit Court;

a court of a State or Territory that has jurisdiction in relation to matters arising under this Act.

a decision under the Commissioner, or to refuse to accredit the entity;section 74 to accredit an entity with conditions of accreditation imposed by

a decision under section 78 to impose conditions of accreditation on an accredited entity, or vary them;

a decision under subsection 81(1), (2), (3) or (4) to suspend or cancel an entity’s accreditation;

a decision under the Commissioner, or to refuse to renew an entity’s accreditation;section 84 to renew an entity’s accreditation with conditions of accreditation imposed by

a decision under subsection 91(2), or paragraph 101(4)(a), not to deal with a complaint;

a decision under subsection 102(2) to make a determination publicly available;

a decision under subsection 112(2) or (3) to give an entity a written direction.

The Commissioner is the reviewer for the decision.

a decision to accredit an entity with conditions of accreditation imposed by the Minister, or to refuse to accredit the entity;

a decision under section 78 to impose conditions of accreditation on an accredited entity, or vary them;

a decision under subsection 81(1), (2), (3) or (4) to suspend or cancel an entity’s accreditation.

The Minister is the reviewer for the decision.

be in an approved form (if any); and

set out the reasons for the application.

affirm the decision;

vary the decision;

revoke the decision and substitute a new decision.

must not have been involved in making the reviewable decision; and

must hold a position, or perform duties, of at least the same level as the delegate who made the reviewable decision.

the entity is an accredited entity and party to a data sharing agreement; and

the contract is authorised by, or approved under, the data sharing agreement in accordance with any requirements in a data code.

conditions of accreditation imposed on or applicable to the entity;

the data sharing agreement that covers the sharing, collection or use.

Bodies corporate

conditions of accreditation imposed on or applicable to the entity;

the approved contract;

the data sharing agreement for the project to which the collection or use relates.

Access to data by designated individuals and certain bodies corporate

the entity is taken to have engaged in any conduct engaged in:

by a designated individual for the entity, if the conduct is within the actual or apparent scope of the individual’s designation; or

by a body corporate that is party to an approved contract with the entity, if the conduct is within the actual or apparent scope of the approved contract; and

if it is necessary to establish the entity’s state of mind, it is sufficient to establish the state of mind of an individual who has engaged in conduct as mentioned in subparagraph (a)(i).

a Commonwealth body;

a State body, or a Territory body, that is not a body corporate;

the Commonwealth, a State or a Territory.

Interaction with Regulatory Powers Act

set out how the definitions in sections 9, 10, 11 and 11A, and provisions of Chapters 2 and 3, are to be applied or complied with;

impose additional requirements to those imposed by Chapters 2 and 3, so long as the additional requirements are not contrary to, or inconsistent with, those Chapters;

deal with the internal handling of complaints;

deal with the management of complaints under Part 5.3 and impose additional requirements to those set out in that Part, so long as the additional requirements are not contrary to, or inconsistent with, that Part;

deal with any other matters the Commissioner considers necessary or convenient to deal with for carrying out or giving effect to the data sharing scheme.

the data sharing principles in section 16; and

the general privacy protections in section 16A; and

the purpose-specific privacy protections in section 16B.

consent by individuals to the sharing and use of their personal information and circumstances in which it is unreasonable or impracticable to seek individuals’ consent;

principles to be applied by data custodians when determining:

whether it is necessary to share personal information to properly deliver a government service; or

the circumstances, or categories of circumstances, where the public interest to be served by a project justifies the sharing of personal information without consent.

any aspect of the data sharing scheme; and

any matters incidental to the data sharing scheme, including:

data release; and

data management and curation; and

technical matters and standards; and

emerging technologies.

the name of the ADSP;

contact details for the ADSP;

conditions of the ADSP’s accreditation;

at any time while the ADSP’s accreditation is suspended—the duration of the suspension (which may be indefinite);

any other details prescribed by the rules to be included in the publicly accessible part of the register.

prescribed for the purposes of subsection (3); or

prescribed by the rules to be included in the part of the register that is not publicly accessible.

the name of the accredited user;

contact details for the accredited user;

conditions of the accredited user’s accreditation;

at any time while the accredited user’s accreditation is suspended—the duration of the suspension (which may be indefinite);

any other details prescribed by the rules to be included in the publicly accessible part of the register.

prescribed for the purposes of subsection (3); or

prescribed by the rules to be included in the part of the register that is not publicly accessible.

the entities that are parties and the capacity in which each entity is a party;

the date the parties entered into the agreement;

the date the Commissioner registered the agreement;

a description of the project the agreement covers;

the data sharing purpose of the project;

a description of the data to be shared;

whether personal information is to be shared;

if personal information is to be shared—a statement in the approved form (if any) relating to the privacy obligations applicable to the accredited user in relation to its use of output of the project and the person or body to whom individuals may complain about use inconsistent with those obligations;

if subsection 16B(7) applies in relation to the agreement—a copy of the statement and explanation required by that subsection;

if subsection 16B(8) applies in relation to the agreement—a copy of the statement required by that subsection;

if, but for section 23, sharing, collecting or using data under the agreement would contravene another law—the title of the other law;

a statement of how the project will serve the public interest;

a description of the final output of the project;

if output of the project may exit the data sharing scheme under section 20E—the circumstances in which the exit may occur;

if the agreement has an expiry date—the expiry date;

whether the agreement is in effect or has expired or been terminated;

if any details are affected by a variation of the agreement—the details as varied and the date the variation was registered;

any other details prescribed by the rules to be included in the publicly accessible part of the register.

copies of data sharing agreements and variations given to the Commissioner under section 33; and

any details prescribed for the purposes of subsection (3); and

any details prescribed by the rules to be included in the part of the register that is not publicly accessible.

a data scheme entity or a class of data scheme entities; or

a specified purpose.

must take the following aspects of the scheme into account:

accessibility;

independence;

fairness;

accountability;

efficiency;

effectiveness; and

may take into account any other matter the Commissioner considers relevant.

specify a period for which the recognition of an external dispute resolution scheme is in force; and

make the recognition of an external dispute resolution scheme subject to specified conditions, including conditions relating to the conduct of an independent review of the operation of the scheme; and

vary or revoke:

the recognition of an external dispute resolution scheme; or

the period for which the recognition is in force; or

a condition to which the recognition is subject.

required or permitted by this Act to be prescribed by the rules; or

necessary or convenient to be prescribed for carrying out or giving effect to this Act.

create an offence or civil penalty;

provide powers of:

arrest or detention; or

entry, search or seizure;

impose a tax;

set an amount to be appropriated from the Consolidated Revenue Fund under an appropriation in this Act;

directly amend the text of this Act.

the data custodian continues to be the data custodian of the data; and

the National Archives of Australia is not a data custodian of the data.