Guide - Data Sharing and Privacy

Read the document below or download it here: Guide - Data Sharing and Privacy July 2020

The sharing of data between public sector agencies and appropriate third parties can support more informed policy making, program management and evaluation, research and service planning. Sharing data safely can facilitate better policy decision-making and more efficient service delivery for citizens and business.

• The Privacy and Personal Information Protection Act 1998 (PPIP Act) establishes controls and obligations on the disclosure of personal information.
• The Health Records and Information Privacy Act 2002 (HRIP Act) governs the management of health information held by organisations (public sector agencies or a private sector person) that are health service providers or that collect, hold or use health information. This includes hospitals both public and private, doctors, other health service providers and any other organisations that handle health information. More specifically the Act applies to public sector agencies, private sector organisations that provide a health service or collects, holds or uses health information, and private sector organisations including some businesses that are related to another business, with an annual turnover of more than $3 million that collect, store or use health information
• Public sector agencies are authorised to share data with another public sector agency for specific purposes under the Data Sharing (Government Sector) Act 2015 (Data Sharing Act).
• Other legislation may contain specific provisions authorising or requiring the sharing of data by an agency with specified bodies or equivalent bodies in another jurisdiction.

This Guidance is issued by the Privacy Commissioner under subsections 36(2)(d) and (g) of the PPIP Act and section 58(e) of the HRIP Act. The Commissioner is to provide assistance to public sector agencies in adopting and complying with the information protection principles and to provide advice on matters relating to the protection of personal information and the privacy of individuals.

Samantha Gavel

Privacy Commissioner

Information and Privacy Commission NSW

 

1. Who has made the request?

How your agency shares data will vary depending on what data is being requested and who is making that request. For example, you will use a different mechanism to share data if your agency receives a request to share data from another government sector agency compared to a request from a non-government entity such as a research centre or industry peak body.

1.1       Sharing with NSW government agencies

The Data Sharing Act authorises NSW government sector agencies to share data with other NSW government sector agencies for specific purposes as set out in the legislation (see section 2.3 below). 

The Act operates to authorise data sharing that might otherwise be prohibited under other legislation. Where the sharing is compliant with the requirements of the Data Sharing Act, the provisions in other legislation prohibiting disclosure of information obtained in connection with the administration of that legislation do not apply. 

However, any sharing that occurs under the Data Sharing Act must be done in accordance with the PPIP Act, HRIP Act and any applicable Public Interest Direction or Privacy Code of Practice made under the privacy legislation.

The Act does not authorise data sharing with Australian Government agencies or the agencies of another State or Territory.

1.2       Sharing with entities outside the NSW Government sector

Agencies may also receive a request for data from an entity or organisation outside the NSW Government sector. A request of this type may come from a government agency in another state or territory or from an Australian Government agency. This type of request might also be received from a non-government organisation such as a research institute or other organisation.

When considering a data sharing request from outside the NSW Government sector, you should carefully consider the matters set out in this guidance, comply with the requirements of the PPIP  Act or HRIP Act where relevant and apply the data sharing principles to guide your consideration.

2. Deciding to Share Data

2.1       Identify the type of data

• Government sector data – this covers any data held or controlled by a government sector agency. Government sector data may be shared to identify issues and solutions regarding Government policy making, program management and service planning and delivery by government sector agencies. Most statistical data useful for analytics would fall into this category.
• Confidential or commercially-sensitive information – this is information that falls under a commercial-in-confidence or contractual agreement or is otherwise confidential or commercially-sensitive. The Data Sharing Act states this data can only be shared in a way that complies with the terms of the agreement or contract.
• Personal information – means any information or an opinion about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.

Examples of information that would be defined as personal information include:

• • names, addresses and other details about an individual
  • photographs, images, video or audio footage of an individual
  • fingerprints, retina prints, blood or DNA samples.

• Health information – this is a type of personal information and includes any data that is information or an opinion about:
  • the physical or mental health or a disability (at any time) of an individual
  • an individual’s express wishes about the future provision of health services to him or her
  • a health service provided, or to be provided, to an individual
  • other personal information collected to provide, or in providing, a health service
  • other personal information about an individual collected in connection with the donation, or intended donation, of an individual’s body parts, organs or body substances
  • other personal information that is genetic information about an individual arising from a health service provided to the individual in a form that is or could be predictive of the health (at any time) of the individual or of a genetic relative of the individual
  • healthcare identifiers.

2.2       Identify whether your agency controls the data

Having identified the type of data being requested, you then need to determine whether this data is in the control of your agency. Section 6 of the Data Sharing Act authorises a government sector agency to share government sector data that it controls with another government sector agency or the DAC.

Your agency will have control of the data if:

• the agency has possession or custody of the data, or
• the agency has the data in the possession or control of another person or body. An example of this is where the data is in storage with a cloud storage provider.

Where your agency receives a request to share data that it has received from another agency, best practice would be for you to refer the request on to the agency which originally provided you with the data. Your agency may not have the relevant authority to release data provided to you by another agency.

2.3       Identify whether you can legally share the data

The next question you will need to consider is whether your agency is legally authorised to share the data.

The Data Sharing Act operates to authorise data sharing with another government sector agency for specific purposes. This Act operates to override secrecy provisions which are contained in other legislation, but does not override your obligations under privacy law. Where the sharing is compliant with the requirements of the Data Sharing Act, the provisions in legislation prohibiting disclosure of information obtained in connection with the administration of that legislation do not apply.[1]

You will need to determine whether the data sharing request under consideration meets the purpose test under section 6 of the Data Sharing Act:

• to enable data analytics to identify issues and solutions regarding Government policy making, program management and service planning and delivery by government sector agencies
• to enable related government sector agencies to better develop Government policy making, program management and service planning and delivery by the agencies
• other purposes prescribed by regulation.

Any sharing under the Data Sharing Act must also be done in accordance with the PPIP Act, HRIP Act and any applicable Public Interest Direction or Privacy Code of Practice made under the privacy legislation

It should be noted that the Data Sharing Act does not authorise, permit or require the sharing of government data that is excluded information under Schedule 1 or Schedule 2 of the Government Information (Public Access) Act 2009 (GIPA Act).[2] [3] Examples include Cabinet information, privileged information, information that is subject to secrecy provisions under specified legislation, etc.

In some circumstances data sharing for specific purposes is authorised by a Public Interest Direction or a Privacy Code of Practice made under the PPIP Act or HRIP Act. Further information on the PIDs and Codes currently in operation can be found on the IPC website.

If the data sharing request is made by an organisation or agency outside the NSW Government sector, you will need to consider whether your agency is authorised to share data in these circumstances. For example, some laws prohibit an agency from disclosing information obtained in connection with the administration of that legislation or may place limits on the organisations or persons with whom an agency can share data.

You will need to be aware of these restrictions before you undertake an assessment of a data sharing request. If you are unsure about whether your agency is subject to legislative restrictions on data sharing, you should seek advice from your agency’s legal unit.

2.4       Identify the purpose for sharing the data

Is the data fit for purpose?

Consideration should be given to whether the data requested are suitable for use in the manner intended by the requesting party. The data custodian will be able to advise whether the data is fit for the intended purpose and can provide you with a data quality statement.

For further information on data quality, see the NSW Government Standard for Data Quality Reporting.

2.5       Follow your agency’s data sharing policy

2.6       Document your specific risks and mitigations

Use considerations

• Is the proposed use of the data appropriate?
• What public benefit will it deliver?
• If the request involved personal  information, could the same outcome be achieved with de-identified information?
• Does the proposed use involve using personal information for a purpose other than for which it was collected?
• Can the recipient be trusted to use the data appropriately?
• Does the recipient have the skills to analyse the data?
• Are there sufficiently robust governance arrangements in place to ensure that the privacy, confidentiality and security of the data will be maintained?

The following hypothetical case study is provided to illustrate how the use consideration may be applied.

Sharing data between government sector agencies The Department of Education is developing a program to increase the rates of recreational fitness among public school students. In order to best target this program, the Department of Education has made requests to local councils to provide playground, aquatic centre and sports facility location information. The Department of Education intends to use this information to tailor the materials it is developing for schools to the particular facilities in each schools’ local area. In return, the Department is sharing aggregated data with local councils about the number of students in their local government areas by age group and gender, which councils can use in their forward civil works planning. The purpose of the data sharing in this instance is to enable better service planning and delivery, which is a permitted purpose under the Data Sharing Act. The Department of Education will develop a data sharing agreement between it and the councils involved which outlines their respective data governance responsibilities as data custodians, thereby satisfying the safeguard requirements. After this has been developed, the data sharing is able to take place. This request is not dealing with information that identifies individuals and as such is not subject to the requirements in either the PPIP or HRIP Acts.

Commercial considerations

• What parties are involved in collecting and using this data?
• Would sharing the data violate any existing contracts or commercial agreements?

Privacy considerations

Will the sharing comply with the disclosure principle?

A public sector agency can only share (disclose) personal information if one of the exceptions under section 18 of the PPIP Act (or another exemption under the Act) applies:

• the disclosure is directly related to the purpose for which the information was originally collected and the agency has no reason to believe the individual whose information is to be shared would object to it being shared
• the individual is likely to be aware or has been made aware that information of that kind is usually shared
• the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual or another person.

Note that different exceptions apply in relation to health information under the HRIP Act.[4]

Sharing personal or health information for purposes that were not disclosed to the individual when the information was collected may result in a breach of the PPIP or HRIP Acts unless one of the exemptions under Part 2 Division 3 of the PPIP Act apply or a Public Interest Direction or Privacy Code of Practice operates to provide an exemption.

There may be additional security or ethics requirements depending on the type of data being shared. For example:

• financial information, or other types of sensitive information, may require certain encryption standards
• approval from an ethics committee may be required where personal or health information is  to be used for research purposes.[5]

Is consent required?

Determine whether consent is required from the individuals who are the subject of the personal information. If the information has not been de-identified and the individuals did not consent to data sharing at the time of collection, or if the shared data is being used for a purpose other than that for which it was collected, consent will generally be required (unless authorised by a Human Research Ethics Committee approval or by another law). Sections 17-19 and 26 of the PPIP Act outline the consent requirements for the use or disclosure of personal information.

Different consent requirements apply to health information and you should review HPP 11 to determine whether any of the listed exceptions apply in the context of the specific data sharing request.

Can access and correction processes be maintained?

Are there existing processes in place which allow people to update, correct or amend their personal or health information where necessary? These processes should be specified in the data sharing agreement and maintained for the life of the agreement. There are obligations in relation to amending personal information in section 15 of the PPIP Act and HPP 8 of the HRIP Act.   

Can the appropriate storage and access controls be maintained?

The sharing agency should confirm that the recipient has the appropriate technical and physical controls in place to keep the data secure.

Section 12 of the PPIP Act addresses the retention and security obligations for personal information and HPP 5 addresses the retention and security obligations for health information.

Will ‘sensitive’ personal information be safeguarded?

Special restrictions apply to certain types of personal information under section 19(1) of the PPIP Act. This includes information about an individual’s ethnic or racial origin, political opinions, religious or philosophical beliefs, sexual activities or trade union membership.[6] An agency cannot share this type of personal information without an individual’s express consent.

Generally, an agency can only disclose this personal information without consent where it is necessary to prevent a serious and imminent threat to any person’s life or health, unless one of the exceptions under the PPIP Act applies or a Public Interest Direction or Privacy Code of Practice operates to provide an exemption.

Note that section 19(1) establishes a high threshold test which must be met before disclosure is permitted. Unlike some other exceptions under the PPIP Act (see for example section 18(1)(c)), section 19(1) requires that the disclosure be ‘necessary to prevent a serious and imminent threat’ rather than requiring that the agency ‘believe on reasonable grounds’ that the disclosure is necessary to prevent or lessen a serious or imminent threat. This is an objectively higher threshold test to meet.

Will data be transferred to an organisation outside of NSW?

Transborder data flows involving personal or health information, including sharing data with Australian Government agencies, are only permitted in certain circumstances. These include:

• where the recipient is in a jurisdiction which upholds principles similar to those in the PPIP/HRIP Act
• where all individuals whose information is to be shared have consented to the sharing
• where the sharing is required for the conclusion or performance of a contract.

If you are considering sharing data that contains personal or health information across borders, ensure that you are complying with the requirements under HPP 14 or section 19(2) of the PPIP Act.

Additional considerations for health information

Is the data being shared for a secondary purpose?

Where health information has been collected for a specific purpose, it should not be shared for another purpose (a secondary purpose) unless a specific exception applies. The secondary purpose exceptions are set out in HPP 10 (use) and HPP 11 (disclosure) of Schedule 1 of the HRIP Act and include:

• the management of health services
• law enforcement purposes
• to lessen or prevent a serious and imminent threat to the life, health or safety of the person or another
• training or research purposes
• to locate a missing person.

Does the data contain healthcare identifiers?

A healthcare identifier is a unique number that has been assigned to an individual patient or a healthcare provider for the purpose of managing or communicating health information.[7] An agency can only assign a healthcare identifier to an individual if it is reasonably necessary to carry out its functions efficiently.[8]

The sharing of health care identifiers is subject to the same disclosure rules as other health care information. HPP 11 in Schedule 1 of the HRIP Act sets out the principles governing disclosure of health information. The IPC recommends that you seek advice from your agency’s legal unit or privacy contact officer before sharing data containing healthcare identifiers.

Does the data sharing involve linkage of health records?

HPP 15 must be complied with if the data sharing involves computerised linkage of health records. HPP 15 requires express  patient consent if data sharing involves computerised  linkage of health records.

The following hypothetical case study is provided to illustrate issues for consideration when sharing personal and health information

Sharing Personal and Health Information A university is conducting a research program into the impact of chronic health conditions on school performance and the effectiveness of early intervention programs. The research program intends to look at school attendance patterns and progression journeys for a cohort with specific chronic conditions. The university has submitted requests to the Ministry of Health and the Department of Education seeking access to identified datasets about the cohort of students which contain their names, dates of birth and addresses, as well as the respective health and school performance information for each student. The university intends for the deidentified research findings to be provided to the agencies involved for their use in policy making, program development and service planning. The purpose of the data sharing is to facilitate better policy making, program development and service planning. As the data involved contains both personal and health information, it needs to satisfy the requirements under the PPIP and HRIP Acts. As an alternative to providing personal and health information, the agencies propose provision of the data after it has been through a linkage process to remove personal identifiers. Data linkage will enable the research team to identify school attendance patterns and progression journeys without revealing the identity of the students in the cohort being studied. A data sharing agreement is developed between the agencies and the research team that sets out the roles and responsibilities of each of the parties in relation to the handling of data.

• Is the data sharing compliant with agency-level polices or enabling-legislation?
• What records are involved and will the records managements program obligations be complied with?
• Is the recipient of the data aware of these obligations?

2.8       Decide whether the data should be shared

• where sharing would breach the disclosure principle under the PPIP Act or HRIP Act and no exceptions or exemptions apply
• if sharing with a non-government organisation, where this would breach any confidentiality or information sharing provisions under legislation applicable to the agency
• where the data requested is information subject to a conclusive presumption of an overriding public interest against disclosure (Schedule 1) or is excluded information (Schedule 2) under the GIPA Act and there has been no consent to disclosure by the relevant agency.

• Does the use or disclosure of the information expressly relate to a proper purpose within the functions and responsibilities of the agency?
• If personal information will be shared, has the individual/s whose personal information is being shared consented or received appropriate notification of how your agency uses or discloses personal information?

2.9       Exemptions and modifications to the IPPs/HPPs

3.1       Clarify the approval process

3.2       Establish data governance arrangements

• the name and contact details of the sharing agency, the recipient of the data and their representatives
• the specific data that is being shared
• whether any personal or health information is being shared and the legal basis for sharing this data
• the purpose for sharing the data
• an acknowledgement that the data is being shared in compliance with all relevant legislation
• the name and contact details of the data owner and/or data custodian within all parties to the agreement. The data owner is a senior officer within the agency who is responsible for the quality of the data set.[9]  Custodianship involves formally assigning rights and responsibilities for data and information assets, including capture and management on behalf of the NSW Government.[10]
• how the data will be shared
• how the data will be stored by the recipient
• how consent arrangements have been addressed - note that consent will only be applicable in some circumstances
• whether there are constraints on the further release of the data
• how any data corrections will be handled
• the details of ongoing audit or monitoring arrangements
• the details of how data will be disposed or returned at the end of the agreement
• the archiving responsibilities of each party in relation to the State Records Act, if applicable[11]
• any other obligations resulting from enabling legislation of either party
• the date, time and duration of the agreement.

3.3       Confirm the receiving environment

3.4       Prepare the data for sharing

Is all of the data relevant to the proposed purpose?

Sharing more data than is actually needed increases risks of unauthorised access and disclosure, so ensure that the data being shared is directly relevant to the agreed purpose. Consider exactly which data elements will need to be shared.

A best practice approach to data sharing involving personal or health information is to share data that is not identifiable where that data can meet the needs of the data user, and only share identifiable data if strictly necessary, and then in accordance with relevant privacy legislation.

Consider whether there are controls or treatments that should be applied to the data prior to release. For example, data minimisation, data aggregation, removal of direct identifiers or suppression of individual records.

Can the information be de-identified?

De-identification is a process that renders personal information into a form that is not identifiable.[13] Information that has undergone an appropriate and robust de-identification process is not personal information and therefore not subject to the PPIP Act or HRIP Act.

If possible, consider de-identifying information – including redaction where appropriate – before it is shared in order to protect the privacy of individuals and facilitate more secure data sharing.

There are risks of re-identification with any dataset. These risks may be heightened when a dataset contains small population sizes and when linking with other datasets. De-identification should not be the only mitigation strategy applied to protect against the risk of unauthorised disclosure of personal data. The IPC recommends that agencies seek expert advice in relation to complex de-identification matters.

More information on de-identification can be found on the IPC’s website.

4. After you share

4.1       Oversight and auditing mechanisms

Is the data being used only for the purpose for which it was shared?

The auditing mechanisms established by the data sharing agreement should require the recipient to undertake regular audits of its use of the data to ensure that it is only used for the specific purposes outlined in the agreement.

Are the access and storage arrangements secure?

The information should continue to be stored and accessed according to the standards agreed to at the time of sharing. Any changes to this should be communicated to and agreed to by the sharing agency. The specific retention and security obligations for personal information are set out in section 12 of the PPIP Act and HPP 5 of the HRIP Act.

Can individuals access their information?  

If personal or health information is involved, there must be processes in place to explain to an individual what personal or health information about them is being stored, why it is being used, any rights they have to access it and processes in place which allow people to access their personal or health information without excessive delay or expense. This includes information about data that has been shared and what it is being used for by the recipient. These form part of the obligations under the PPIP (sections 12, 13 and 14) and HRIP (Division 3) Acts.

Are there processes in place for the information to be corrected?

There must be processes in place which allow people to update, correct or amend their personal information where necessary. The data sharing agreement should include a process by which the sharing agency will communicate any amendments or alterations to the data to the recipient.  There are obligations in relation to amending personal information in section 15 of the PPIP Act and HPP 8.

Are there processes in place for the deletion or return of data?

The data sharing agreement should detail the requirements for deletion or return of data once the purpose for which it was shared is completed. Obligations in relation to retention and destruction of personal or health information are set out in section 12 of the PPIP Act and HPP 5.

5. Appendix A – Data sharing flowchart

[See document]

 

[1] See section 5(1) of the Data Sharing Act