Document ID: chunk:federal_register_of_legislation:C2024C00820:section:13:p1
Version: federal_register_of_legislation:C2024C00820
Segment Type: section
Provision Reference: s 13 (pt 1/2)
Character Range: 32160–34897

13  Authorisation for data custodian to share public sector data
 (1) An entity (the sharer) is authorised to share data with another entity (the user), either directly or through another entity (the intermediary), if all of the following apply:
 (a) the constitutional requirements in subsection (4) are met;
 (b) the data custodian requirements in subsection (2) are met;
 (c) the project the sharing is part of is covered by a registered data sharing agreement that is in effect and that meets the requirements of this Act;
 (d) the sharing is in accordance with the data sharing agreement;
 (e) the sharer is satisfied that the project is consistent with the data sharing principles;
 (f) the user is an accredited user and its accreditation is not suspended;
 (g) if the data shared with the user includes personal information—the privacy coverage condition in section 16E is met in relation to the user;
 (h) if the sharer shares through an intermediary—the intermediary is an ADSP and its accreditation is not suspended;
 (i) if the data shared with the intermediary includes personal information—the privacy coverage condition in section 16E is met in relation to the intermediary.
Note: This section authorises the sharer to share its public sector data with the user and with the intermediary (if any). It also authorises the intermediary (if any) to share with the user, on behalf of the sharer, ADSP‑enhanced data of which the sharer is the data custodian.
 (2) The data custodian requirements are the following:
 (a) the data is public sector data and the sharer is the data custodian of the data;
 (b) if the sharer is not the only data custodian of the data—authority to share the data has been given by each other data custodian;
 (c) the sharing is not barred by section 17;
 (d) the sharing is consistent with the general privacy protections in section 16A and the purpose‑specific privacy protections in section 16B;
 (e) if the data shared does not include personal information—only the minimum amount of data necessary for the project to proceed is shared;
 (f) if the requirement in subsection 16C(2) or 16D(2) applies—the requirement is met.
Note: If sharing is done through an intermediary, it is possible that authority to share as mentioned in paragraph (2)(b) will be needed from additional data custodians of ADSP‑enhanced data of the project, before the ADSP‑enhanced data can be shared with the user.
 (3) Authority given by a data custodian for the purposes of paragraph (2)(b) must be given by one of the following:
 (a) an authorised officer of that data custodian;
 (b) if another data custodian is authorised to act as the agent of that data custodian—an authorised officer of the agent data custodian.