data-availability-and-transparency-act-2022.pdf, p.11
1 Short title
1 Section 1
Note on table limitations and amendments
1 April 2022
data-availability-and-transparency-act-2022.pdf, p.169
Consequential and Transitional Provisions
Statute Law Amendment (Prescribed Forms and Other Updates) Act 2023
1 July 2023 (s 2(1)
data-availability-and-transparency-act-2022.pdf, p.22
10 References to access to data
Amendment history for Data Availability and Transparency Act 2022
10 Dec
Reference to entity providing access to data includes reference to entity providing data to another entity or releasing data.
10(1) References to access to data
(1) For the purposes of this Act, a reference to an entity providing access to data includes a reference to the entity: (a) providing another entity with access to the data; and (b) providing open access to the data (releasing the data)
(a) providing another entity with access to the data; and (b) providing open access to the data (releasing the data)
(b) providing open access to the data (releasing the data)
(a) providing another entity with access to the data
includes a reference to the entity: (a) providing another entity with access to the data; and (b) providing open access to the data (releasing the data)
a reference to an entity providing access to data
Data custodians of public sector data must provide access to accredited entities.
10(2) References to access to data
Entity must retain a copy of data when providing access.
10(3) References to access to data
data-availability-and-transparency-act-2022.pdf, p.117
100 Notices of assessment
The Commissioner must give an entity written notice before starting and on completion of an assessment.
100(1) Notices of assessment
Notice must specify intended scope of assessment
100(2) Notices of assessment
Must provide notice with specified scope
The Commissioner must investigate conduct engaged in by an entity.
101 Investigations
Written determination with reasons and proposed action
data-availability-and-transparency-act-2022.pdf, p.119
Commissioner must make written determination on entity's breach of Act or data sharing agreement.
102 Determination on completion of investigation
Entity must comply with Commissioner's written determination
data-availability-and-transparency-act-2022.pdf, p.120
103 Notices relating to investigation
The Commissioner must give an entity written notice before starting an investigation.
103(1) Notices relating to investigation
The Commissioner must give an entity written notice.
103(2) Notices relating to investigation
Must provide determination and review rights notice to entity
103(3) Notices relating to investigation
Obligation to provide determination and review rights notice
data-availability-and-transparency-act-2022.pdf, p.121
Commissioner may give written recommendations about actions an entity should take.
103A Recommendations
data-availability-and-transparency-act-2022.pdf, p.122
104 Power to require information and documents
Commissioner may require person to provide information or document.
104(1) Power to require information and documents
Must comply with notice from investigation under section 101.
104(2) Power to require information and documents
Failure to comply with a notice results in imprisonment.
104(3) Power to require information and documents
...and (c) the person fails to comply with the notice.
Temporal interval between receiving a notice and failing to comply.
Prohibition on failing to comply with a notice.
Penalty for failing to comply with a notice.
Temporal relationship between receiving a notice and failing to comply.
Commissioner may take possession of document for investigation purposes.
104(4) Power to require information and documents
data-availability-and-transparency-act-2022.pdf, p.123
105 Legal professional privilege
Comply with notice under section 104 despite legal professional privilege
105(1) Legal professional privilege
Information and document production cannot be used as evidence in civil or criminal proceedings.
105(2) Legal professional privilege
Prohibits the use of information and document production as evidence.
Claim of legal professional privilege is unaffected by non-compliance with notice.
105(3) Legal professional privilege
Commissioner must withdraw notice unless satisfied it is reasonably necessary and proportionate to investigation.
105(4) Legal professional privilege
data-availability-and-transparency-act-2022.pdf, p.124
106 Limits on power to require information and documents
No notice can require information or documents from an excluded entity.
106(1) Limits on power to require information and documents
Prohibition of requiring information or documents from an excluded entity.
No requirement for information or documents beyond a certificate given to the Commissioner.
106(2) Limits on power to require information and documents
Prohibits requiring information or documents beyond a certificate.
Prohibition on disclosure of certain information
106(3) Limits on power to require information and documents
Giving information in relation to a specified matter, or giving a specified document, would be contrary to the public interest.
(3) The Attorney-General may give the Commissioner a certificate stating that, in the opinion of the Attorney-General...
Disclosing information would be contrary to the public interest.
(b) involve the disclosure of communications between a Minister of the Commonwealth and a Minister of a State or Territory,
(d) involve the disclosure of deliberations or advice of the Executive Council;
No effect on parliamentary privileges and immunities
106(4) Limits on power to require information and documents
Excludes effect on parliamentary privileges and immunities
data-availability-and-transparency-act-2022.pdf, p.125
Commissioner may transfer matter to another agency or body.
107 Transfer of matters to appropriate authority
data-availability-and-transparency-act-2022.pdf, p.126
108 Authorisation for Commissioner to disclose and receive
Commissioner may disclose information to an agency or body under certain conditions.
108(1) Authorisation for Commissioner to disclose and receive
List of agencies and bodies that can disclose and receive information
108(2) Authorisation for Commissioner to disclose and receive
(b) a State body, or a Territory body, whose functions include functions that correspond to those of the Information Commissioner;
Agency or body must include functions that correspond to those of the Information Commissioner
(d) a State body, or a Territory body, whose functions include functions that correspond to those of the Commonwealth Ombudsman;
Agency or body must include functions that correspond to those of the Commonwealth Ombudsman
(h) the Australian National Audit Office;
Agency or body must include functions that correspond to those of a person mentioned in paragraph (a), (c), (e) or (f)
(g) a regulatory authority of a foreign country whose functions include functions that correspond to those of a person mentioned in paragraph (a), (c), (e) or (f);
(ka) the Inspector of the National Anti-Corruption Commission;
(l) AUSTRAC (within the meaning of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006);
Authorization for Commissioner to receive information
108(3) Authorisation for Commissioner to disclose and receive
Commissioner has permission to receive information
data-availability-and-transparency-act-2022.pdf, p.127
Monitoring powers for certain provisions of this Act.
109 Monitoring powers
Identifies part of a larger framework for monitoring compliance.
Part 2 of the Regulatory Powers Act creates a framework for monitoring...
data-availability-and-transparency-act-2022.pdf, p.1
Compilation information and notes on amendments.
11 December 2024
11 Entity definitions
Defines data custodians and accredited entities as data scheme entities.
11(1) Entity definitions
Entities must be classified as data scheme entities.
Data custodians and accredited entities are defined.
Entity must be a data custodian if it controls public sector data or has become the data custodian of output.
11(2) Entity definitions
(2) An entity is a data custodian if the entity:...
Data custodian is also considered data custodian of ADSP-enhanced data.
11(2A) Entity definitions
11(3) Entity definitions
This compilation shows the text of the law as amended and in force on 11 December 2024.
Classifies the text as a compilation of the Data Availability and Transparency Act 2022.
The text is classified as a compilation.
data-availability-and-transparency-act-2022.pdf, p.129
110 Investigation powers
Subject to investigation under Part 3 of the Regulatory Powers Act
110(1) Investigation powers
Part of the Regulatory Powers Act framework
Commissioner is an authorised applicant and issuing officer.
110(2) Investigation powers
a court of a State or Territory that has jurisdiction in relation to matters arising under this Act
has jurisdiction in relation to matters arising under this Act
the Commissioner is the relevant chief executive
the Commissioner is an authorised applicant
data-availability-and-transparency-act-2022.pdf, p.130
112 Directions
The Commissioner may give a data scheme entity written directions requiring the entity to take or not take specified actions.
112(1) Directions
The direction must be given during an emergency or high risk situation.
(b) for a requirement to take specified actions—it is necessary, to address the situation or prevent it arising again, for the entity to take the actions immediately or as soon as practicable; and
The Commissioner requires the entity to take or not take specified actions.
(a) either of the following situations exists:
The Commissioner must give a data scheme entity written directions.
(1) The Commissioner may give a data scheme entity a written direction requiring the entity to take, or not to take, specified actions if...
The Commissioner can give a data scheme entity written directions.
The direction must be given until the situation is addressed.
(c) for a requirement not to take specified actions—the entity is taking the actions or may take them imminently and it is necessary, to address the situation or prevent it arising again, for the entity not to take the actions.
The Commissioner may give a data scheme entity a written direction requiring the entity to take or not to take specified actions.
112(2) Directions
The Commissioner must give a written direction.
Commissioner may give written direction to accredited entity regarding cancellation of accreditation.
112(3) Directions
Compliance with directions may include providing another entity with access to scheme data.
112(4) Directions
Must comply with a direction given to the entity.
112(5) Directions
Directions made under subsections are not legislative instruments.
112(6) Directions
Prohibits directions from being considered legislative instruments.
data-availability-and-transparency-act-2022.pdf, p.132
113 Civil penalty provisions
Enforce civil penalty provisions under Part 4 of the Regulatory Powers Act.
113(1) Civil penalty provisions
Prohibits enforcement of civil penalty provisions.
No application under section 82 for pecuniary penalty unless Commissioner's opinion of contravention.
113(2) Civil penalty provisions
Commissioner is an authorised applicant in relation to civil penalty provisions.
113(3) Civil penalty provisions
Commissioner is an authorised applicant.
114 Infringement notices
A civil penalty provision of this Act is subject to an infringement notice.
114(1) Infringement notices
Infringement officer cannot issue infringement notice without Commissioner's determination.
114(2) Infringement notices
Prohibition on issuing infringement notices.
Infringement officer must have Commissioner's opinion to issue notice.
Section 102 of the Regulatory Powers Act sets out Commissioner's opinion on contravention.
Infringement officer cannot give infringement notice without Commissioner's determination.
Section 103 of the Regulatory Powers Act applies only with Commissioner's determination.
Commissioner is infringement officer and relevant chief executive.
114(3) Infringement notices
Single infringement notice allowed for multiple alleged contraventions.
114(4) Infringement notices
Allows a single infringement notice for multiple alleged contraventions.
data-availability-and-transparency-act-2022.pdf, p.133
Enforceable provisions under Part 6 of the Regulatory Powers Act.
115 Enforceable undertakings
data-availability-and-transparency-act-2022.pdf, p.134
116 Injunctions
Enforceable provisions under Part 7 of the Regulatory Powers Act
116(1) Injunctions
Provisions are enforceable under Part 7 of the Regulatory Powers Act
No injunction under section 121 unless Commissioner's opinion determines contravention.
116(2) Injunctions
No injunction unless Commissioner's opinion determines contravention.
Commissioner is an authorised person and relevant courts are specified.
116(3) Injunctions
data-availability-and-transparency-act-2022.pdf, p.136
Administrative decisions are reviewable by the Administrative Review Tribunal.
117 Simplified outline of this Chapter
data-availability-and-transparency-act-2022.pdf, p.137
118 Reviewable decisions
Decisions made by the Commissioner are reviewable.
118(1) Reviewable decisions
Decisions made by Minister are reviewable decisions.
118(2) Reviewable decisions
(2) Each of the following decisions made by the Minister...
data-availability-and-transparency-act-2022.pdf, p.138
119 Applications for reconsideration of decisions made by delegates
Application for reconsideration of a reviewable decision made by a delegate.
119(1) Applications for reconsideration of decisions made by delegates
Application must set out reasons for reconsideration of decisions made by delegates.
119(2) Applications for reconsideration of decisions made by delegates
Application must be in an approved form.
Application fee must be paid for reconsideration to be valid.
119(3) Applications for reconsideration of decisions made by delegates
data-availability-and-transparency-act-2022.pdf, p.24
11A The data sharing project
A project involves sharing data between entities.
11A(1) The data sharing project
Data services or data creation by or on behalf of the sharer is involved in the project.
11A(2) The data sharing project
Sharer must share data with intermediary and user.
11A(3) The data sharing project
Must provide sharer's authorisation to share data with intermediary.
Must provide intermediary's authorisation to collect and use data.
Sharer must collect and use output or ADSP-enhanced data if provided access.
11A(4) The data sharing project
Treat multiple projects as a single project under certain conditions.
11A(5) The data sharing project
data-availability-and-transparency-act-2022.pdf, p.27
12 Simplified outline of this Chapter
12 Dec
Accredited users are authorised to collect and use the data.
Commonwealth bodies are authorised to share their public sector data with accredited users.
Commonwealth bodies must control the data.
Commonwealth bodies must be the data custodian of public sector data they share.
Sharing of data is prohibited in certain circumstances.
Some sharing of data is barred (e.g. if the sharing would contravene a prescribed law or an agreement).
Access to output is permitted under certain conditions.
Authorisation extension to other entities
An accredited user’s authorisation to use data may in some circumstances extend to providing access to output of the project to other entities.
120 Reconsideration by reviewer
Reviewer must reconsider decision and take one of three actions.
120(1) Reconsideration by reviewer
The reviewer's decision on reconsideration has effect as if it had been made under the original provision.
120(2) Reconsideration by reviewer
The reviewer's decision on reconsideration occurs during the reconsideration period.
(2) The reviewer’s decision on reconsideration of a decision has effect as if it had been made under the provision under which the original decision was made.
The reviewer's decision on reconsideration is cognitively processed during the reconsideration period.
(2) The reviewer's decision on reconsideration of a decision has effect as if it had been made under the provision under which the original decision was made.
The reviewer's decision on reconsideration is diffused during the reconsideration period.
Reviewer must give applicant a written notice stating decision on reconsideration.
120(3) Reconsideration by reviewer
The reviewer must give the applicant a written notice...
Reviewer must provide written statement of reasons within 28 days.
120(4) Reconsideration by reviewer
Delegate must not have been involved in making the reviewable decision and hold a position of at least the same level as the delegate who made the reviewable decision.
120(5) Reconsideration by reviewer
data-availability-and-transparency-act-2022.pdf, p.139
121 Deadline for reconsideration
Deadline for reconsideration of a decision
121(1) Deadline for reconsideration
Reviewer must inform applicant of decision within 90 days
121(2) Deadline for reconsideration
Applications may be made to review a reviewable decision under certain circumstances.
122 Review by the Administrative Review Tribunal
data-availability-and-transparency-act-2022.pdf, p.140
123 Designated individuals and designation
Specifies individuals who are designated individuals for entities.
123(1) Designated individuals and designation
The designation is effective until the individual ceases to hold office
Specifies temporal intervals for the designation
the individual’s capacity as a statutory officeholder
The designation applies to these individuals only
For the purposes of this Act, the following table specifies individuals who are designated individuals for entities.
The designation is a property of the individual
Defines the relationship between entities and designations
Designated individuals and designation Item
Individuals must have a designation if certain conditions apply.
123(2) Designated individuals and designation
Designation specified for each applicable item
Contract must be approved by data sharing agreement for accreditation.
123(3) Designated individuals and designation
Contract has approval from data sharing agreement.
data-availability-and-transparency-act-2022.pdf, p.141
124 Extension of authorisations to share, collect or use data
Authorises designated individual to engage in conduct within scope of designation.
124(1) Extension of authorisations to share, collect or use data
Exempts conduct of individuals from subsection (1) if certain conditions are met
124(2) Extension of authorisations to share, collect or use data
Authorises conduct within approved contract scope
124(3) Extension of authorisations to share, collect or use data
No effect on conduct of a body corporate if conditions of accreditation apply
124(4) Extension of authorisations to share, collect or use data
data-availability-and-transparency-act-2022.pdf, p.142
125 Other things an entity may or must do under the data sharing
Entity may delegate task to designated individual.
125(1) Other things an entity may or must do under the data sharing
125(2) Other things an entity may or must do under the data sharing
125A Contraventions by entities of civil penalty provisions and other
Entity must establish state of mind for conduct within scope of designation or approved contract.
125A(1) Contraventions by entities of civil penalty provisions and other
Establishing state of mind is sufficient to determine entity's breach of Act.
Government entity bears evidential burden to prove reasonable precautions were taken.
125A(2) Contraventions by entities of civil penalty provisions and other
Government entity has an obligation to prove reasonable precautions were taken.
Immunity from personal liability for contraventions of civil penalty provisions attributed to government entities.
125A(3) Contraventions by entities of civil penalty provisions and other
Government entity liable for contravention
125A(4) Contraventions by entities of civil penalty provisions and other
Section 97 of the Regulatory Powers Act does not apply to a Commonwealth body.
125A(5) Contraventions by entities of civil penalty provisions and other
Excludes application of Section 97 to a Commonwealth body.
No application of subsection (1) in relation to determining contravention by a non-Commonwealth body corporate.
125A(6) Contraventions by entities of civil penalty provisions and other
data-availability-and-transparency-act-2022.pdf, p.144
Establishing state of mind for entities committing offences
125B Offences by entities against this Act
data-availability-and-transparency-act-2022.pdf, p.145
126 Data codes
Commissioner may make codes of practice about data sharing scheme.
126(1) Data codes
Sets out how definitions are to be applied or complied with
126(2) Data codes
Commissioner must create data codes about specific privacy protections.
126(2A) Data codes
Must deal with consent by individuals to the sharing of their personal information.
126(2B) Data codes
Mandatory data code for purpose-specific privacy protections in section 16B
126(2C) Data codes
data-availability-and-transparency-act-2022.pdf, p.146
127 Guidelines
The Commissioner must make written guidelines.
127(1) Guidelines
Guidelines for data sharing scheme may include principles and processes relating to various aspects.
127(2) Guidelines
Guidelines inconsistent with regulations, rules or data codes have no effect to the extent of the inconsistency.
127(3) Guidelines
data-availability-and-transparency-act-2022.pdf, p.147
128 Register of ADSPs
128(1) Register of ADSPs
Commissioner must include certain details in the publicly accessible part of the register for each ADSP.
128(2) Register of ADSPs
Commissioner must include certain details
Rules may prescribe circumstances under which certain details must not be included in the publicly accessible part of the register.
128(3) Register of ADSPs
Commissioner must include details in non-public part of register.
128(4) Register of ADSPs
Contains details within a specific time frame
Artificial intelligence system processes details in the register
Details are disseminated to others through the register
Details are contained within the register at some point in time
The register may be maintained in any form the Commissioner considers appropriate.
128(5) Register of ADSPs
The register is not a legislative instrument.
128(6) Register of ADSPs
data-availability-and-transparency-act-2022.pdf, p.148
129 Register of accredited users
The Commissioner must maintain a register of accredited users.
129(1) Register of accredited users
The Commissioner must include certain details in the publicly accessible part of the register for each accredited user.
129(2) Register of accredited users
The Commissioner must include certain details.
Exemptions from public disclosure of register details
129(3) Register of accredited users
Commissioner must include details in non-publicly accessible register part.
129(4) Register of accredited users
(4) The Commissioner must include in the part of the register that is not publicly accessible any details:
Includes details implies non-publicly accessible register part
Requires inclusion of details in non-publicly accessible register part
Details spread to non-publicly accessible register part
The Commissioner may maintain the register in any form.
129(5) Register of accredited users
129(6) Register of accredited users
data-availability-and-transparency-act-2022.pdf, p.29
13 Authorisation for data custodian to share public sector data
Authorises data custodian to share public sector data with another entity under specified conditions.
13(1) Authorisation for data custodian to share public sector data
The sharer shares with an accredited user if the sharing is in accordance with the data sharing agreement.
Sharing occurs during the effect of a registered data sharing agreement.
(d) the sharing is in accordance with the data sharing agreement;
The sharer is authorised to share data with another entity.
(a) the constitutional requirements in subsection (4) are met;
The intermediary shares with the user on behalf of the sharer if it is an ADSP and accredited.
Authorisation to share ADSP-enhanced data.
(h) if the sharer shares through an intermediary—the intermediary is an ADSP and its accreditation is not suspended;
The sharer shares personal information with an accredited user if it meets the privacy coverage condition.
Authorisation to share personal information.
(g) if the data shared with the user includes personal information—the privacy coverage condition in section 16E is met in relation to the user;
The sharer shares with an accredited user if the project is covered by a registered data sharing agreement.
Defines a class of entities that can share public sector data.
(c) the project the sharing is part of is covered by a registered data sharing agreement that is in effect and that meets the requirements of this Act;
The intermediary shares with the user on behalf of the sharer if it meets the privacy coverage condition.
Defines a class of entities that can share ADSP-enhanced data.
(i) if the sharer shares through an intermediary—the privacy coverage condition in section 16E is met in relation to the intermediary.
Data custodian may share public sector data
13(2) Authorisation for data custodian to share public sector data
130 Register of data sharing agreements
Maintain a register of data sharing agreements.
130(1) Register of data sharing agreements
The Commissioner must include specific details in the register of data sharing agreements.
130(2) Register of data sharing agreements
The Commissioner must include specific details.
data-availability-and-transparency-act-2022.pdf, p.150
131 Recognition of external dispute resolution schemes
Commissioner must recognise external dispute resolution schemes.
131(1) Recognition of external dispute resolution schemes
(1) The Commissioner may, by written notice...
Classification of external dispute resolution schemes
(a) a data scheme entity or a class of data scheme entities;
Commissioner must consider certain aspects when recognizing external dispute resolution schemes.
131(2) Recognition of external dispute resolution schemes
The Commissioner may specify a period for recognition of an external dispute resolution scheme and make it subject to conditions.
131(3) Recognition of external dispute resolution schemes
A notice under subsection (1) is not a legislative instrument.
131(4) Recognition of external dispute resolution schemes
data-availability-and-transparency-act-2022.pdf, p.151
Commissioner may approve forms for data sharing scheme
132 Approved forms
133 Rules
The Minister may make rules by legislative instrument.
133(1) Rules
Rules cannot create an offence or civil penalty, provide powers of arrest or detention, impose a tax, or set an amount to be appropriated from the Consolidated Revenue Fund.
133(2) Rules
An offence or civil penalty cannot be created by the rules
Prohibition on creating an offence or civil penalty
Rules may not create an offence or civil penalty
Arrest or detention cannot be provided by the rules
Prohibition on providing powers of arrest or detention
Rules may not provide powers of arrest or detention
An amount to be appropriated from the Consolidated Revenue Fund cannot be set by the rules
Prohibition on setting an amount to be appropriated from the Consolidated Revenue Fund
Rules may not set an amount to be appropriated from the Consolidated Revenue Fund
data-availability-and-transparency-act-2022.pdf, p.152
Regulations may be prescribed by the Governor-General.
134 Regulations
data-availability-and-transparency-act-2022.pdf, p.153
Data scheme entities must not provide access to scheme data unless authorised.
135 Disclosure of scheme data in relation to information-gathering
Prohibition of providing access to scheme data.
Data custodian remains responsible for data until open access period starts.
135A Data held by National Archives of Australia
Data custodian remains responsible for data.
Data custodian transfers data to National Archives.
data-availability-and-transparency-act-2022.pdf, p.154
136 Geographical jurisdiction of civil penalty provisions and
A person does not contravene a civil penalty provision unless the conduct occurs wholly or partly in Australia, on board an Australian aircraft or ship, or outside Australia and is an Australian entity, citizen, or permanent resident.
136(1) Geographical jurisdiction of civil penalty provisions and
or (b) for conduct alleged to constitute an ancillary contravention—
Temporal relation between conduct and geographical location.
(a) the conduct, or a result of the conduct, occurs wholly or partly in Australia...
unless at least one of the following paragraphs applies in relation to the conduct constituting the alleged contravention or offence:
Obligation to comply with the Act's civil penalty provisions.
(1) A person does not contravene a civil penalty provision of this Act...
(d) the conduct occurs wholly outside Australia and the person engaging in the conduct is an Australian entity, an Australian citizen or a permanent resident of Australia.
Recurring trace between conduct and geographical location.
Exemption from civil penalty for conduct outside Australia
136(2) Geographical jurisdiction of civil penalty provisions and
...if the person is not an Australian entity, an Australian citizen or a permanent resident of Australia...
(b) the conduct constituting the alleged contravention or offence occurs wholly in a foreign country, but not on board an Australian aircraft or Australian ship...
...if the conduct constituting the alleged contravention or offence occurs wholly in a foreign country...
(2) Despite subsection (1), a person does not contravene a civil penalty provision of this Act...
(d) there is not in force, in the foreign country or the part of the foreign country where the conduct constituting the alleged contravention or offence occurred, a law creating a pecuniary or criminal penalty for conduct corresponding to the conduct constituting the alleged contravention or offence.
Exemption from civil penalty for conduct occurring in a foreign country
136(3) Geographical jurisdiction of civil penalty provisions and
(b) for conduct constituting an alleged contravention—the conduct constituting the primary contravention to which the alleged contravention relates, or a result of that conduct, occurs, or would have occurred, wholly in a foreign country,
(a) the alleged contravention or offence is an ancillary contravention or ancillary offence;
Exempts from civil penalty for conduct occurring in a foreign country
(3) Despite subsection (1), a person does not contravene a civil penalty provision of this Act...
data-availability-and-transparency-act-2022.pdf, p.157
Specifies individuals authorized to perform tasks on behalf of entities.
137 Authorised officers and individuals authorised to do particular
Individuals have authorisation to perform tasks.
data-availability-and-transparency-act-2022.pdf, p.160
137A Delegation by Minister
The Minister may delegate powers to the Commissioner.
137A(1) Delegation by Minister
Must comply with written directions of the Minister when exercising a delegated power.
137A(2) Delegation by Minister
138 Annual report
Annual report on activities during the financial year
The Commissioner must prepare and give a report to the Minister.
138(1) Annual report
138(2) Annual report
The Commissioner may include additional information in the annual report.
138(3) Annual report
Annual report must be given to Minister by a certain date.
138(4) Annual report
data-availability-and-transparency-act-2022.pdf, p.161
Fees may be prescribed by rules for services provided or on behalf of the Commissioner.
139 Charging of fees by Commissioner
data-availability-and-transparency-act-2022.pdf, p.31
Authorized entity can collect and use data under specified conditions.
13A Authorisation for accredited user to collect and use data
Project is consistent with data sharing principles
User can collect and use data during project period.
The collection or use is in accordance with the data sharing agreement;
User does not know and could not reasonably be expected to know that the sharing by the sharer is not authorised by section 13
User's accreditation suspension implies lack of permission.
The user is an accredited user and its accreditation is not suspended;
Data sharing agreement validates user's accreditation.
Entity has permission to collect and use data.
Registered data sharing agreement in effect
Privacy coverage condition met for personal information
Data shared with user is classified as personal information.
If data shared with user includes personal information—
Data sharing agreement propagates to user.
The project is covered by a registered data sharing agreement that is in effect and that meets the requirements of this Act;
data-availability-and-transparency-act-2022.pdf, p.32
Intermediary authorized to collect data shared with it by the sharer under certain conditions.
13B Authorisation for ADSP to act as intermediary
Intermediary has an obligation to collect data shared with it by the sharer under certain conditions.
Project is covered by a registered data sharing agreement that meets the requirements of this Act.
project is covered by a registered data sharing agreement
Collection or use is in accordance with the data sharing agreement.
Intermediary is satisfied that the project is consistent with the data sharing principles.
Intermediary is an ADSP and its accreditation is not suspended.
If the data shared with the intermediary includes personal information—the privacy coverage condition in section 16E is met in relation to the intermediary.
Sharer has permission to collect output or ADSP-enhanced data from user or intermediary under certain conditions.
13C Authorisation for data custodian to collect and use submitted
Sharer's permission to collect output or ADSP-enhanced data overlaps with project duration
Overlap between sharer's permission and project duration
Project is covered by a registered data sharing agreement that is in effect
CogAI recognises sharer's permission to collect output or ADSP-enhanced data from user or intermediary under certain conditions
CogAI recognises sharer's permission to collect output or ADSP-enhanced data
Sharer is authorised to collect output or ADSP-enhanced data of the project from the user or intermediary
Permission to collect output or ADSP-enhanced data
Sharer has shared data with user under section 13 as part of a project
Sharer's permission to collect output or ADSP-enhanced data diffuses through user or intermediary
Diffusion of sharer's permission through user or intermediary
Sharer's permission to collect output or ADSP-enhanced data ends when project is completed
Temporal relationship between sharer's permission and project completion
data-availability-and-transparency-act-2022.pdf, p.33
14 Penalties for unauthorised sharing
Unauthorized sharing of data is prohibited.
14(1) Penalties for unauthorised sharing
(1) An entity contravenes this subsection...
14(2) Penalties for unauthorised sharing
(2) An individual or a body corporate contravenes this subsection...
14(3) Penalties for unauthorised sharing
Implicates the provision's implications on entities.
(3) An entity commits an offence if: (a) the entity provides access to data; and (b) the provision of access is purportedly under section 13; and (c) the provision of access is not authorised by section 13 and the entity is reckless with respect to that circumstance.
Penalty: Imprisonment for 5 years or 300 penalty units, or both.
Imposes an obligation on entities to comply.
Spreads the provision's impact on entities.
Sharing data under section 13 without permission is prohibited.
14(4) Penalties for unauthorised sharing
Prohibits sharing data under section 13.
(4) An individual or a body corporate commits an offence if: (a) the individual or body corporate uses data; and (b) the use is a provision of access to the data by an entity under, or purportedly under, section 13;
data-availability-and-transparency-act-2022.pdf, p.162
140 Charging of fees by data scheme entities
Data custodian may charge fees to accredited entity for services performed.
140(1) Charging of fees by data scheme entities
Data custodian must charge fees in accordance with Australian Government policies.
140(2) Charging of fees by data scheme entities
Accredited entities can charge fees for services performed in relation to the data sharing scheme.
140(3) Charging of fees by data scheme entities
Allows accredited entities to charge fees
141 Commonwealth not liable to pay a fee
The Commonwealth is not liable to pay a fee, but it should be notionally liable.
141(1) Commonwealth not liable to pay a fee
The Finance Minister may give written directions for carrying out or giving effect to subsection (1)
141(2) Commonwealth not liable to pay a fee
Must comply with directions despite other laws.
141(3) Commonwealth not liable to pay a fee
Directions have effect despite other laws.
Commonwealth entity cannot be made liable to taxation by a Commonwealth law.
141(4) Commonwealth not liable to pay a fee
Cannot impose liability on Commonwealth entity
Commonwealth entity is included in the definition of Commonwealth
data-availability-and-transparency-act-2022.pdf, p.163
142 Periodic reviews of operation of Act
Minister must undertake periodic reviews of Act operation.
142(1) Periodic reviews of operation of Act
142(2) Periodic reviews of operation of Act
Combined reviews must be completed within a specified period.
142(3) Periodic reviews of operation of Act
Minister must prepare written report after review completion
142(4) Periodic reviews of operation of Act
data-availability-and-transparency-act-2022.pdf, p.164
143 Sunset of the data sharing scheme
Ceases effect at sunset day five years after commencement.
143(1) Sunset of the data sharing scheme
Regulations may be made under section 134 for the purposes of subsection (3) during a specific period.
143(2) Sunset of the data sharing scheme
Prescribes transitional provisions for scheme data ceasing to have effect
143(3) Sunset of the data sharing scheme
Continuation of certain provisions after sunset day
143(4) Sunset of the data sharing scheme
The Commissioner may give a written direction to entities regarding actions to take or not take.
143(5) Sunset of the data sharing scheme
Failure to comply with a direction may result in offences or civil penalties.
143(6) Sunset of the data sharing scheme
Offences or civil penalties may be imposed.
Penalties for offences against the regulations
143(7) Sunset of the data sharing scheme
...for offences against the regulations;
Penalties apply to a specific temporal interval
Regulations cannot allow data sharing after sunset day.
143(8) Sunset of the data sharing scheme
Prohibits regulations allowing data sharing
Repeals legislative instruments made under this Act on the first anniversary of the sunset day.
143(9) Sunset of the data sharing scheme
Prohibits legislative instruments from being in force after the sunset day.
States that all legislative instruments made under this Act are repealed on the first anniversary of the sunset day.
data-availability-and-transparency-act-2022.pdf, p.34
14A Penalties for unauthorised collection or use
Unauthorized collection or use of ADSP-enhanced data is prohibited.
14A(1) Penalties for unauthorised collection or use
The collection or use is not authorised by this Act if...
Temporal overlap between collection and use
The collection or use must occur within the same temporal interval.
Civil penalty: (a) 300 penalty units; or...
Implication of unauthorized collection or use on penalty units
If the entity collects or uses data without authorization, then a civil penalty applies.
The data is classified as ADSP-enhanced if it meets the specified criteria.
Recognition of ADSP-enhanced data by AI systems
AI systems must recognize and classify ADSP-enhanced data correctly.
The entity contravenes this subsection if...
Unauthorized collection or use of ADSP-enhanced data is not authorized.
Transmission of information about unauthorized collection or use
The entity must inform the relevant authorities about the unauthorized collection or use.
Penalties for serious contraventions of data sharing scheme responsibilities
14A(2) Penalties for unauthorised collection or use
Prohibits serious contraventions of data sharing scheme responsibilities
(2) This subsection applies if the entity concerned is or has been an accredited entity and the contravention is serious...
Using ADSP-enhanced data without authorization
14A(3) Penalties for unauthorised collection or use
(d) the individual or body corporate’s use of the data is not authorized by this Act.
14A(4) Penalties for unauthorised collection or use
and (b) the data is ADSP-enhanced data, or output, of a project...
Data collection or use overlaps with authorized sharing under section 13.
(c) the collection or use is not authorised by this Act and the entity is reckless with respect to that circumstance.
Data collection or use detects anomalies.
Prohibits unauthorized collection or use of ADSP-enhanced data.
Unauthorized collection or use spreads to other entities.
Data collection or use recurs with unauthorized sharing under section 13.
Unauthorised collection or use of ADSP-enhanced data is prohibited.
14A(5) Penalties for unauthorised collection or use
Temporal relation between use of data and section 13
(c) the individual has a designated relationship with the entity, or...
Imprisonment for 5 years or 300 penalty units, or both.
Implication of unauthorised use on penalty
(d) the individual or body corporate’s use of the data...
Classification of data as ADSP-enhanced by AI
(a) the individual or body corporate uses data;
(5) An individual or a body corporate commits an offence...
Spread of unauthorised collection or use
data-availability-and-transparency-act-2022.pdf, p.38
15 Data sharing purposes
Delivery of government services is a data sharing purpose.
15(1) Data sharing purposes
Delivery of government services includes providing information, services, determining eligibility, and paying payments.
15(1A) Data sharing purposes
Classifies delivery of government services
15(2) Data sharing purposes
(b) a purpose that relates to, or prejudices, national security within the meaning of the National Security Information (Criminal and Civil Proceedings) Act 2004;
(2) The following are precluded purposes:
(c) a purpose prescribed by the rules for the purposes of this paragraph.
Enforcement-related purposes include detecting, investigating, or addressing acts detrimental to public revenue.
15(3) Data sharing purposes
(3) An enforcement related purpose means any of the following purposes:
(b) detecting, investigating or addressing acts or practices detrimental to public revenue;
Purpose is not precluded if it relates to matters in a general way to another purpose.
15(4) Data sharing purposes
data-availability-and-transparency-act-2022.pdf, p.40
16 Data sharing principles
data-availability-and-transparency-act-2022.pdf, p.54
Sharing data is barred under certain conditions.
16 December 1966 ([1980] ATS 23)).
Prohibits sharing data under certain conditions.
The project principle is that the project is an appropriate project or program of work.
16(1) Data sharing principles
The project principle includes serving the public interest and observing ethics processes.
16(2) Data sharing principles
(b) the parties observe processes relating to ethics, as appropriate in the circumstances.
(a) the project can reasonably be expected to serve the public interest;
Data is made available only to appropriate persons.
16(3) Data sharing principles
Obligation to share data with appropriate persons.
(3) The people principle is that data is made available only to appropriate persons.
Access to data is only provided to individuals with appropriate attributes and qualifications.
16(4) Data sharing principles
The people principle includes the following elements: Authorisations Chapter 2 Data sharing purposes and principles Part 2.3
Data should be shared, collected and used in an appropriately controlled environment.
16(5) Data sharing principles
Defines the temporal scope of data sharing.
(5) The setting principle is that data is shared, collected and used in an appropriately controlled environment.
Identifies the AI system responsible for data sharing.
Describes the mechanism of data sharing.
Specifies the temporal relationship between data sharing.
Data sharing principles require appropriate means and security standards.
16(6) Data sharing principles
...appropriate means and security standards are applied.
Requires data sharing principles to be met.
Includes elements for the setting principle.
Appropriate protections must be applied to data.
16(7) Data sharing principles
Only share data necessary for applicable purpose
16(8) Data sharing principles
Output principle is that only Chapter 2 Authorisations are outputted.
16(9) Data sharing principles
data-availability-and-transparency-act-2022.pdf, p.43
16A General privacy protections
Sharing of biometric data requires individual consent.
16A(1) General privacy protections
Must not be shared unless individual consents.
Prohibits sharing of biometric data without consent.
Data is classified as requiring consent.
Classifies data as requiring consent for sharing.
Biometric data must be shared with consent
Prohibits accredited entities from storing or accessing ADSP-enhanced data outside Australia
16A(2) General privacy protections
...the output, of the project outside Australia.
Specifies a temporal interval during which prohibition applies
(2) If data that includes personal information is shared...
...accredited entity with or through which it is shared from storing or accessing, or providing access to, the ADSP-enhanced data, or the output, of the project outside Australia.
Describes a class of entities subject to prohibition using AI
...accredited entity with or through which it is shared from storing or accessing, or providing access to, the ADSP-enhanced data...
Describes a class of entities subject to prohibition
Ensures compliance with prohibition using SHACL
Prohibits action that may result in data ceasing to be de-identified when shared.
16A(3) General privacy protections
...the data sharing agreement must prohibit the accredited user from taking any action...
Defines a temporal interval for data sharing.
(3) If data that has been de-identified is shared...
Represents knowledge about data sharing.
Defines a temporal trace for data sharing.
Data sharing for delivery of government services requires consent or specific exceptions.
16B Purpose-specific privacy protections
Requires individual consent for data sharing.
Data sharing purpose is delivery of government services
data-availability-and-transparency-act-2022.pdf, p.46
16C Project involving use of de-identification or secure access data
Project involving use of de-identification or secure access data requires data sharing for informing government policy and programs or research and development.
16C(1) Project involving use of de-identification or secure access data
Requires data sharing for specified purposes.
Service must be performed by data custodian or ADSP with appropriate skills and experience
16C(2) Project involving use of de-identification or secure access data
(2) The data sharing agreement that covers the project...
Service must treat data with personal information to de-identify it using techniques that restrict its use.
16C(3) Project involving use of de-identification or secure access data
De-identification data service is a service to treat data that includes personal information so that the data is de-identified.
Definition of secure access data service
16C(4) Project involving use of de-identification or secure access data
data-availability-and-transparency-act-2022.pdf, p.47
16D Project involving complex data integration services
Project involving complex data integration services requires informing government policy and programs or research and development.
16D(1) Project involving complex data integration services
Service must be performed by data custodian or ADSP
16D(2) Project involving complex data integration services
Service to integrate data is a complex data integration service if specific conditions are met.
16D(3) Project involving complex data integration services
...any of the following subparagraphs applies to any of the data...
Temporal relationship between data integration and its control
(b) the data is at the unit or micro level;
Definition of a complex data integration service
(3) A service to integrate data is a complex data integration service if...
...the data is at the unit or micro level;
Class hierarchy for data integration services
(a) 2 or more entities control the data being integrated;
...any of the subparagraphs applies to any of the data...
Relationship between data integration and personal information
(i) the data includes personal information;
(c) any of the following subparagraphs applies to any of the data...
data-availability-and-transparency-act-2022.pdf, p.49
16E Privacy coverage condition
16E(1) Privacy coverage condition
An APP-equivalence term prohibits an entity from collecting or using personal information in a way that would breach an Australian Privacy Principle.
16E(2) Privacy coverage condition
The prohibition applies during the duration of the data sharing agreement
Prohibition applies during the duration of the data sharing agreement
(2) An APP-equivalence term is a term of a data sharing agreement
The entity must recognize and comply with the APP-equivalence term
Entity must recognize and comply with the APP-equivalence term
An entity must not collect or use personal information in this way
Prohibits entity from collecting or using personal information
The prohibition spreads through the entity's actions during the data sharing agreement
Prohibition spreads through the entity's actions during the data sharing agreement
The prohibition ends when the data sharing agreement ends
Prohibition ends when the data sharing agreement ends
data-availability-and-transparency-act-2022.pdf, p.50
16F Compliance with APP-equivalence term
An act or practice that contravenes the APP-equivalence term is taken to be an interference with privacy.
16F(1) Compliance with APP-equivalence term
Entity must comply with APP-equivalence term for Part V of the Privacy Act 1988 and other provisions.
16F(2) Compliance with APP-equivalence term
Entity's act or practice is subject to investigation by the Information Commissioner.
(b) the act or practice is the subject of a complaint to, or an investigation by, the Information Commissioner under Part V of the Privacy Act 1988.
Entity must comply with APP-equivalence term.
Entity may have contravened the APP-equivalence term in relation to an individual.
(a) an act or practice of the entity has contravened, or may have contravened, the APP-equivalence term in relation to an individual;
Reference to entities subject to APP-equivalence term is included in the Privacy Act 1988
16F(3) Compliance with APP-equivalence term
Inclusion of entities subject to APP-equivalence term is an obligation
APP-equivalence term is a subclass of the Privacy Act 1988
Entity must comply with Privacy Act 1988 as if it were an APP entity.
16F(4) Compliance with APP-equivalence term
Sections 80V and 80W of the Privacy Act 1988 apply in relation to an APP-equivalence term as if the term were a provision of that Act.
16F(5) Compliance with APP-equivalence term
The law applies to the APP-equivalence term.
data-availability-and-transparency-act-2022.pdf, p.52
17 When sharing is barred
Sharing data is barred by certain subsections.
17(1) When sharing is barred
17(2) When sharing is barred
Sharing data is barred if it infringes certain rights or privileges.
17(3) When sharing is barred
Sharing data is barred under certain circumstances.
17(4) When sharing is barred
Regulations for the purposes of this subparagraph
Sharing data is barred if it violates international law or Commonwealth law.
17(5) When sharing is barred
(5) Sharing data is barred if: (a) sharing the data is inconsistent with: (i) the obligations of Australia under international law, including obligations under any international agreement binding on Australia; or (ii) any law of the Commonwealth giving effect to such an agreement;
Traces sharing data prohibition through time
data-availability-and-transparency-act-2022.pdf, p.55
18 Data sharing agreement
18(1) Data sharing agreement
Must comply with data sharing agreement requirements
Data sharing agreement must be entered into by authorized officers or under subsection 137(4)
18(2) Data sharing agreement
...unless the individual is an authorized officer of the entity or authorized under subsection 137(4)
Temporal interval requirement for authorization
(2) A data sharing agreement must not be entered into...
Prohibition of unauthorized data sharing agreements
No variation of data sharing agreement can be entered into without proper authorization.
18(3) Data sharing agreement
Restricts temporal scope of authorized variations
(3) A variation of a data sharing agreement must not be entered into by an individual...
Prohibits unauthorized variation of data sharing agreement
Data sharing agreement requires registration before it has effect.
18(4) Data sharing agreement
data-availability-and-transparency-act-2022.pdf, p.56
19 Requirements to be met by all data sharing agreements
Parties must be identified in the agreement.
19(1) Requirements to be met by all data sharing agreements
All data sharing agreements must meet certain requirements.
19(1A) Requirements to be met by all data sharing agreements
Agreement must describe project and specify Act's applicability.
19(2) Requirements to be met by all data sharing agreements
Data sharing agreement must specify source data and final output.
19(3) Requirements to be met by all data sharing agreements
Agreement must specify data custodian and output for Commonwealth body appointment
19(4) Requirements to be met by all data sharing agreements
Sharing data without authorisation may contravene a law.
19(5) Requirements to be met by all data sharing agreements
Sharing data without authorisation contravenes a law.
Prohibits sharing data without authorisation.
Section 23 authorises sharing overrides other laws.
Prohibit accredited user from collecting and using output of the project for certain purposes.
19(6) Requirements to be met by all data sharing agreements
Prohibits accredited user from creating output other than final output and incidental output.
19(6A) Requirements to be met by all data sharing agreements
Defines temporal interval for incidental output
...output the creation of which is reasonably necessary or incidental to creation of the final output.
Implicates creation of incidental output on prohibition
Propagates prohibition through output types
(a) describing how the public interest is served by the project; (b) specifying the actions the party will take to give effect to the principles.
Agreement must specify how project will be consistent with data sharing principles.
19(7) Requirements to be met by all data sharing agreements
Actions must be taken during the project
Agreement must specify data services performed by ADSP
19(8) Requirements to be met by all data sharing agreements
2 Commencement
Conditional commencement of the Administrative Review Tribunal (Consequential and Transitional Provisions No. 1) Act, 2024.
20 Sept
data-availability-and-transparency-act-2022.pdf, p.60
20A Allowed access: providing data custodian of source data with
Allowing data custodian access to ADSP-enhanced data
20A(1) Allowed access: providing data custodian of source data with
Allowing data custodian access to output for ensuring accuracy.
20A(2) Allowed access: providing data custodian of source data with
(2) The data sharing agreement may allow the accredited user to provide access...
Submit data upon access to ADSP-enhanced data or output
20A(3) Allowed access: providing data custodian of source data with
Providing access to output or ADSP-enhanced data as allowed by this section is taken to be for the data sharing purpose, or data sharing purposes of the project.
20A(4) Allowed access: providing data custodian of source data with
20B Allowed access: providing access to output for validation or
Allowing access to output for validation or correction by accredited users and entities.
20B(1) Allowed access: providing access to output for validation or
Specifying temporal intervals for validation or correction.
(i) an entity that carries on a business, or is a not-for-profit entity, to which the output relates, for the purpose of validating or correcting the output;
Specifying requirements for authorized access.
(b) requires the data custodian of the source data to be satisfied, before access is provided, that the access will be an authorized use of the output under section 13A.
Granting authority for access to output.
Establishing conditions for access to be considered authorized.
Collecting a copy of data from an entity upon validation or correction
20B(2) Allowed access: providing access to output for validation or
Data collection occurs during the same time interval as data validation or correction
Collecting data from an entity upon validation or correction
Providing access for data sharing purpose
20B(3) Allowed access: providing access to output for validation or
data-availability-and-transparency-act-2022.pdf, p.61
Accredited user may provide access or release output in specified circumstances.
20C Allowed access: providing access to or releasing output in other
Permission to provide access or release output.
Classifies the provision as a permission.
data-availability-and-transparency-act-2022.pdf, p.62
Sharing of output under section 13 is allowed if certain conditions are met.
20D Allowed access: sharing under section 13
...sharing will be an authorised use of the output.
20E Exit of ADSP-enhanced data or output of project
Using output or ADSP-enhanced data in unauthorized ways is a defence to an offence under section 14A if the copy has exited the data sharing scheme.
20E(1) Exit of ADSP-enhanced data or output of project
Authorized use of output or ADSP-enhanced data before exit from the data sharing scheme.
Temporal relation between authorized and unauthorized use of output or ADSP-enhanced data.
The copy being used has exited the data sharing scheme under this section.
Authorized use of output or ADSP-enhanced data.
Knowledge representation of authorized and unauthorized use of output or ADSP-enhanced data.
This Act authorizes the use of output or ADSP-enhanced data in specific ways.
Defence to an offence under section 14A if the copy has exited the data sharing scheme.
Obligation to comply with authorized use of output or ADSP-enhanced data.
Using output or ADSP-enhanced data in unauthorized ways.
Authorized use of output or ADSP-enhanced data in subsequent instances.
Spread of authorized and unauthorized use of output or ADSP-enhanced data.
Authorized use of output or ADSP-enhanced data in previous instances.
Recurring trace of authorized and unauthorized use of output or ADSP-enhanced data.
The user or intermediary in a project uses output, or ADSP-enhanced data, of the project in ways other than those authorized by this Act.
Exit of ADSP-enhanced data or output of project upon authorized use
20E(2) Exit of ADSP-enhanced data or output of project
...the copy exits the data sharing scheme at the time it is collected by the person
Temporal interval for exit of ADSP-enhanced data or output of project
(2) If a person obtains a copy of output...
Cognitive logic for exit of ADSP-enhanced data or output of project
Obligation to exit data sharing scheme upon authorized use
Diffusion logic for exit of ADSP-enhanced data or output of project
Temporal logic for exit of ADSP-enhanced data or output of project
Exit of ADSP-enhanced data upon collection by person with access authorization.
20E(3) Exit of ADSP-enhanced data or output of project
Consent from individual before data sharing.
User must obtain consent before sharing personal information.
20E(4) Exit of ADSP-enhanced data or output of project
Specifies applicable time for exit of ADSP-enhanced data or output of project
20E(5) Exit of ADSP-enhanced data or output of project
User must collect data upon exit from the data sharing scheme.
20E(6) Exit of ADSP-enhanced data or output of project
User must hold a copy of output after exit from data sharing scheme
20E(7) Exit of ADSP-enhanced data or output of project
User has an obligation to hold a copy of output
data-availability-and-transparency-act-2022.pdf, p.64
20F Data custodian of output of project
Entity becomes data custodian of output at specified times.
20F(1) Data custodian of output of project
at the time of output creation/exits scheme/ access
Appointing data custodian for specified output of project
20F(2) Data custodian of output of project
The data custodian appointment is during the project duration
The user has an obligation to appoint a data custodian
Has obligation to appoint data custodian
The agreement allows the user to provide access to the data
20F(3) Data custodian of output of project
User must be appointed data custodian of output unless otherwise specified.
20F(4) Data custodian of output of project
User must be appointed data custodian of output.
Appoints data custodian for specified output of project under certain conditions.
20F(5) Data custodian of output of project
data-availability-and-transparency-act-2022.pdf, p.66
No limitation on data sharing by data custodians under other laws.
22 Other authorisations for data custodians not limited
23 Authorisations override other laws
23(1) Authorisations override other laws
Temporal relation between authorisations and other laws
(1) The authorisations in sections 13, 13A, 13B and 13C have effect despite anything in another law of the Commonwealth, or a law of a State or Territory.
23(2) Authorisations override other laws
data-availability-and-transparency-act-2022.pdf, p.67
Responsibilities of data scheme entities are mainly set out in this Chapter.
24 Simplified outline of this Chapter
Imposes obligations on data scheme entities.
data-availability-and-transparency-act-2022.pdf, p.68
25 No duty to share but reasons required for not sharing
25(1) No duty to share but reasons required for not sharing
Data custodian must consider sharing public sector data upon request.
25(2) No duty to share but reasons required for not sharing
Request is made by accredited user and in approved form or writing
Data custodian must provide written notice of reasons for refusing a request.
25(3) No duty to share but reasons required for not sharing
The data custodian must provide written notice.
26 Comply with rules and data codes
Must have regard to guidelines when engaging in conduct for the purposes of this Act.
27 Have regard to guidelines
Data scheme entities must engage in conduct for the purposes of this Act.
3 Objects
An accredited entity must comply with the conditions of accreditation.
30 Comply with conditions of accreditation
data-availability-and-transparency-act-2022.pdf, p.69
31 Report events and changes in circumstances affecting
31 Mar
Conditional commencement of Privacy and Other Legislation Amendment Act 2024
31 May
Temporal relationship between commencement and amendment act
An accredited entity must give notice to the Commissioner about certain events or changes.
31(1) Report events and changes in circumstances affecting
Exemption from subsection (1) under certain circumstances.
31(2) Report events and changes in circumstances affecting
32 Not provide false or misleading information
Do not provide false or misleading information
32(1) Not provide false or misleading information
Prohibition of false or misleading information
Cannot provide false or misleading information
32(2) Not provide false or misleading information
Prohibition of providing false or misleading information
data-availability-and-transparency-act-2022.pdf, p.70
33 Registration of data sharing agreements
Entity must provide data sharing agreement to Commissioner within 30 days.
33(1) Registration of data sharing agreements
Entity must provide data sharing agreement.
Entity must provide additional information to Commissioner upon request.
33(2) Registration of data sharing agreements
Entity must provide additional information.
34 Assist Commissioner in relation to annual report
Notify Commissioner of data sharing activities and complaints.
34(1) Assist Commissioner in relation to annual report
Must provide information and assistance to the Commissioner.
34(2) Assist Commissioner in relation to annual report
Obligation to provide information and assistance.
34(3) Assist Commissioner in relation to annual report
Must provide information and assistance.
Notify Commissioner within a specified period.
34(4) Assist Commissioner in relation to annual report
data-availability-and-transparency-act-2022.pdf, p.72
35 Definition of data breach
Event prescribed by a data code occurs during the data breach
event prescribed by a data code occurs in relation to the data
entity has obligation to hold scheme data
unauthorised access to or disclosure of the data occurs
Data loss is likely to occur before or at the same time as the event
data is lost in circumstances where there is likely to be unauthorised access to or disclosure of the data
36 Take steps to mitigate data breach
Entity must take steps to mitigate data breach within a specified period.
36(1) Take steps to mitigate data breach
Take reasonable steps to prevent or reduce harm from data breach within a specified period.
36(2) Take steps to mitigate data breach
The data custodian must take reasonable steps to prevent or reduce harm within the specified period.
A temporal interval is required for taking action to prevent harm from data breach.
The data custodian's action to prevent or reduce harm within the specified period is related to the application of artificial intelligence in preventing data breach.
Artificial intelligence application in preventing data breach
Artificial intelligence can be applied to prevent or reduce harm from data breach.
Take reasonable steps to prevent or reduce harm from data breach within the specified period.
Data custodian has a responsibility to prevent harm from data breach.
The data custodian's action to prevent or reduce harm within the specified period is related to the prevention of harm from data breach and the spread of information about the breach.
Information about data breach must be spread to entities, groups of entities and things affected by the breach.
The data custodian's action to prevent or reduce harm within the specified period is related to the prevention of harm from data breach.
Temporal relationship between actions and consequences
There is a temporal relationship between taking action and preventing harm from data breach.
Steps must be taken after a data breach occurs.
36(3) Take steps to mitigate data breach
data-availability-and-transparency-act-2022.pdf, p.73
37 Interaction with Part IIIC of the Privacy Act 1988 (notification of
Deemed holding of personal information by data custodian
37(1) Interaction with Part IIIC of the Privacy Act 1988 (notification of
Data custodian has shared the personal information with or through an accredited entity under section 13
The accredited entity holds the personal information
Data custodian has responsibilities under Part IIIC of the Privacy Act 1988 (notification of eligible data breaches) in relation to personal information.
37(2) Interaction with Part IIIC of the Privacy Act 1988 (notification of
Obligation to notify eligible data breaches
Obligation to comply with Australian Privacy Principle 11.1
Data custodian is required not to do an act that breaches Australian Privacy Principle 11.1
Obligation to notify eligible data breaches in relation to personal information
Section 15 of the Privacy Act 1988 and Part IIIC of the Privacy Act 1988
Obligation to comply with Australian Privacy Principle 11.1 and responsibilities under Part IIIC of the Privacy Act 1988
Data custodian has responsibilities under Part IIIC of the Privacy Act 1988 and is required not to do an act that breaches Australian Privacy Principle 11.1
Accredited entity must notify data breach if suspected or aware
37(3) Interaction with Part IIIC of the Privacy Act 1988 (notification of
data-availability-and-transparency-act-2022.pdf, p.75
38 Notify Commissioner of non-personal data breach
notification in an approved form within a specified period
Notify Commissioner of non-personal data breach
38(1) Notify Commissioner of non-personal data breach
Notify Commissioner of non-personal data breach within a specified period.
38(1A) Notify Commissioner of non-personal data breach
Notification period starts at the end of the financial year
(b) if there is no period applicable under a data code—as soon as practicable after the end of the financial year in which the breach occurs.
(a) the period applicable under a data code; or (b) if there is no period applicable under a data code—as soon as practicable after the end of the financial year in which the breach occurs.
Notification must occur within the defined period
Notification period ends at the start of the next financial year
Notify Commissioner of non-personal data breach within a certain period
38(2) Notify Commissioner of non-personal data breach
Notify Commissioner of non-personal data breach upon determining likelihood of serious harm.
38(3) Notify Commissioner of non-personal data breach
data-availability-and-transparency-act-2022.pdf, p.77
The Commissioner has obligations to regulate and enforce the data sharing scheme.
39 Simplified outline of this Chapter
The Commissioner is assisted in the performance of these functions by APS employees during their working hours.
The Commissioner is assisted in the performance of these functions by APS employees in the Department who are made available by the Secretary.
The Commissioner has obligations to regulate and enforce the scheme.
The Commissioner is the regulator for the data sharing scheme.
The Commissioner has the power to engage contractors and consultants.
The Commissioner may engage contractors and consultants.
The Commissioner may also engage contractors and consultants.
The Commissioner has access to the advice of the National Data Advisory Council.
The Commissioner is assisted by the advice of the National Data Advisory Council.
The Commissioner is also assisted by the advice of the National Data Advisory Council.
The Commissioner's role is constitutionally mandated.
The constitutional basis for the roles of the Commissioner and Council is set out in subsections 42(2) and 61(2).
The Commissioner's functions include regulating and enforcing the scheme.
The Commissioner also has the function of regulating and enforcing the scheme, which includes dealing with complaints...
data-availability-and-transparency-act-2022.pdf, p.12
Data sharing scheme requires project and data sharing principles
4 Simplified outline of this Act
40 Commissioner to have regard to objects of Act
There is an interval during which the Commissioner performs functions.
Temporal interval during function performance
There is an obligation on the Commissioner to consider the objects of the Act.
The Commissioner must have regard to the objects of this Act.
data-availability-and-transparency-act-2022.pdf, p.78
Establishment of National Data Commissioner
41 National Data Commissioner
42 Functions
42(1) Functions
Commissioner's functions are limited to specific areas.
42(2) Functions
The Commissioner must provide advice on matters related to the operation of the Act.
43 Advice related functions
data-availability-and-transparency-act-2022.pdf, p.79
Commissioner's guidance related functions
44 Guidance related functions
45 Regulatory functions
Commissioner's regulatory functions regarding data sharing scheme.
45(1) Regulatory functions
Person assisting Commissioner must have necessary skills, qualifications or experience.
45(2) Regulatory functions
data-availability-and-transparency-act-2022.pdf, p.80
Commissioner's education and support related functions
45A Education and support related functions
The Commissioner is an official of the Department for finance law purposes.
46 Application of finance law
The Commissioner is an official of the Department.
47 Staff
The Secretary must make available APS employees to assist the Commissioner.
47(1) Staff
APS employee must follow directions of Commissioner and Secretary
47(2) Staff
data-availability-and-transparency-act-2022.pdf, p.81
Commissioner may engage persons under written agreement.
48 Contractors
The Commissioner may engage consultants.
49 Consultants
data-availability-and-transparency-act-2022.pdf, p.13
5 Act binds the Crown
The Act binds the Crown in all its capacities.
5(1) Act binds the Crown
The Crown is not liable for prosecution.
5(2) Act binds the Crown
This Act does not make the Crown liable to be prosecuted for an offence.
The Crown is liable to pay a pecuniary penalty under a civil penalty order.
5(3) Act binds the Crown
The Crown has an obligation to pay a pecuniary penalty.
50 Delegation by Commissioner
The Commissioner may delegate functions or powers to a staff member.
50(1) Delegation by Commissioner
Delegation of certain functions and powers is prohibited.
50(2) Delegation by Commissioner
data-availability-and-transparency-act-2022.pdf, p.82
Commissioner's discretion in performance/exercise of functions/powers
51 Independence of Commissioner
Commissioner and employees are not liable for actions taken in good faith.
52 Commissioner not to be sued
Commissioner's liability is implied by the absence of a duty to act with care.
Employees' liability is implied by their employment relationship.
Employment relationship implies a duty to act with care.
data-availability-and-transparency-act-2022.pdf, p.83
53 Appointment
The Commissioner must be appointed by the Governor-General.
53(1) Appointment
Must provide information about Commissioner appointment
Qualifications required for appointment to Commissioner position
53(2) Appointment
54 General terms and conditions of appointment
The Commissioner must hold office for a period not exceeding 5 years.
54(1) General terms and conditions of appointment
The Commissioner must hold office on a full-time basis.
54(2) General terms and conditions of appointment
(2) The Commissioner holds office on a full-time basis.
Terms and conditions of appointment determined by Governor-General
54(3) General terms and conditions of appointment
Commissioner cannot engage in paid work outside office duties without Minister's approval.
55 Other paid work
Prohibition on Commissioner engaging in paid work outside office duties.
Commissioner must be paid remuneration determined by Remuneration Tribunal or prescribed by rules.
56 Remuneration
data-availability-and-transparency-act-2022.pdf, p.84
57 Leave of absence
Commissioner has recreation leave entitlements determined by the Remuneration Tribunal.
57(1) Leave of absence
Commissioner has a duty to provide recreation leave entitlements.
Grant leave of absence on terms and conditions determined by the Minister.
57(2) Leave of absence
58 Resignation
The Commissioner must provide a written resignation to the Governor-General.
58(1) Resignation
The Commissioner must provide a written resignation.
Resignation takes effect on specified day
58(2) Resignation
58A Disclosure of interests to Minister
Termination of appointment under specified conditions
59 Termination of appointment
Prohibition of Commissioner's appointment termination
This Act extends to every external Territory.
6 Extension to external Territories
data-availability-and-transparency-act-2022.pdf, p.85
The Minister may appoint a person to act as Commissioner under certain circumstances.
60 Acting appointments
data-availability-and-transparency-act-2022.pdf, p.87
61 Establishment and function of Council
Establishes National Data Advisory Council with advisory function.
61(1) Establishment and function of Council
Council may perform certain functions with respect to data sharing and matters incidental to legislative powers.
61(2) Establishment and function of Council
62 Membership of Council
There is a member appointed by the Commissioner.
data-availability-and-transparency-act-2022.pdf, p.88
63 Appointment of members
The Commissioner must appoint members by written instrument.
63(1) Appointment of members
Commissioner must ensure appointed members have qualifications, skills or experience.
63(2) Appointment of members
Obligation to ensure appointed members have qualifications, skills or experience.
Term of appointment must not exceed 3 years.
64 Term of appointment
65 Remuneration and allowances
Member must be paid remuneration determined by Remuneration Tribunal or prescribed by rules.
65(1) Remuneration and allowances
Member must be paid allowances as prescribed by the rules.
65(2) Remuneration and allowances
65(3) Remuneration and allowances
data-availability-and-transparency-act-2022.pdf, p.89
Grant leave of absence on terms and conditions determined by the Commissioner.
66 Leave of absence
Granting leave of absence is an obligation.
67 Disclosure of interests to Minister or Commissioner
Commissioner must disclose interests to Minister
67(1) Disclosure of interests to Minister or Commissioner
Member must disclose interests to Commissioner.
67(2) Disclosure of interests to Minister or Commissioner
Member has a duty to disclose interests.
68 Disclosure of interests to Council
Member of Council must disclose interest to meeting.
68(1) Disclosure of interests to Council
Member must disclose interests to Council as soon as possible after knowledge of relevant facts.
68(2) Disclosure of interests to Council
Disclosure must occur at a specific point in time.
Disclosure of interests must be recorded in meeting minutes.
68(3) Disclosure of interests to Council
Member must provide written resignation to Commissioner.
69 Resignation of members
Member must provide written resignation.
Legislative power extends outside Australia.
7 Extraterritorial operation
data-availability-and-transparency-act-2022.pdf, p.90
Termination of appointment of members due to various reasons.
70 Termination of appointment of members
Prohibits termination of appointment for certain reasons.
Member terms and conditions determined by the Commissioner
71 Other terms and conditions of members
Member holds office on specified terms and conditions
data-availability-and-transparency-act-2022.pdf, p.91
72 Procedures
Council must meet at least twice a year.
72(1) Procedures
Council may convene meetings by Commissioner or Chair.
72(2) Procedures
Council must determine its own procedures.
72(3) Procedures
data-availability-and-transparency-act-2022.pdf, p.92
The Commissioner has power to require persons to give information, and has monitoring and investigation powers in relation to certain provisions of this Act.
73 Simplified outline of this Chapter
The Commissioner may investigate a data scheme entity regardless of whether a complaint has been made within a specified temporal interval.
The Commissioner has power to require persons to give information.
The Commissioner has monitoring and investigation powers in relation to certain provisions of this Act.
The Commissioner can transfer matters to a more appropriate agency.
The Commissioner can require persons to give information.
data-availability-and-transparency-act-2022.pdf, p.94
74 Accreditation
Granting accreditation to an entity that meets criteria.
74(1) Accreditation
(c) the authority considers it appropriate, in all the circumstances, to grant the accreditation.
Authority's justification for granting accreditation.
the authority may grant the accreditation applied for.
(a) the entity is an Australian entity and not an excluded entity;
the accreditation applies to the entity.
Accreditation propagation through entities.
Authority may accredit entity with or without conditions.
74(2) Accreditation
Authority has the power to accredit entity.
Entity must comply with accreditation conditions.
74(3) Accreditation
Entity participation in data sharing scheme poses security concerns.
74(4) Accreditation
Prohibits entity participation in data sharing scheme.
data-availability-and-transparency-act-2022.pdf, p.95
75 Notice of accreditation decision
Entity must receive written notice of accreditation decision.
75(1) Notice of accreditation decision
Entity must provide notice of accreditation decision
75(2) Notice of accreditation decision
The notice must set out certain information if accreditation is refused.
75(3) Notice of accreditation decision
data-availability-and-transparency-act-2022.pdf, p.96
76 Application for accreditation
76(1) Application for accreditation
Application requirements for accreditation
76(2) Application for accreditation
77 Criteria for accreditation
Entity must have data management and governance policies and practices.
77(1) Criteria for accreditation
The entity exists during its data management and governance.
Entity must have data management and governance during its existence.
(a) the entity has appropriate data management and governance policies and practices
The entity must have data management and governance to ensure privacy and protection.
Entity must have data management and governance to ensure privacy and protection.
(b) the entity is able to minimise the risk of unauthorised access, sharing or loss of data
The entity must have AI capabilities for data management and governance.
Entity must have AI capabilities for data management and governance.
(d) any additional criteria prescribed under subsection (2)
The entity must have data management and governance policies.
Entity has obligation to have data management and governance policies.
The entity must be able to manage risks in relation to data.
Entity must be able to manage risks in relation to data.
(c) the entity has the necessary skills and capability to ensure the privacy, protection and appropriate use of data
Entity must have necessary policies, practices, skills and capability to perform data services.
77(1A) Criteria for accreditation
Entity must have necessary policies, practices, skills and capability.
Minister may consider additional criteria for accreditation
77(2) Criteria for accreditation
data-availability-and-transparency-act-2022.pdf, p.97
77A General provisions relating to accreditation
Entity remains accredited as ADSP until accreditation is cancelled.
77A(1) General provisions relating to accreditation
Accreditation cancellation marks end of accreditation period
(1) An entity accredited as an ADSP until the accreditation is cancelled.
Entity remains accredited until accreditation is cancelled.
77A(2) General provisions relating to accreditation
The accreditation overlaps with the cancellation until the cancellation occurs.
Temporal relationship between accreditation and cancellation
(2) An entity accredited as an accredited user...
If the accreditation is suspended, the entity remains accredited until cancellation.
The system can infer that the entity remains accredited until cancellation.
The entity remains accredited until the accreditation is cancelled.
The accreditation status spreads to all related entities until cancellation.
77A(3) General provisions relating to accreditation
Accreditation is granted on the basis that: ...
(a) under Part 5.2, the entity may be accredited with conditions of accreditation and conditions of accreditation may be imposed, varied or removed while the entity is accredited;
(3) Accreditation is granted on the basis that: (a) ...
(3) Accreditation is granted on the basis that: (b) ...
Accreditation suspension and cancellation
(b) the accreditation may be suspended or cancelled under section 81;
(3) Accreditation is granted on the basis that: (c) ...
(c) the accreditation may be cancelled, revoked, terminated or varied, and conditions of accreditation may be imposed, varied or removed, by or under later legislation;
(3) Accreditation is granted on the basis that: (d) ...
(d) no compensation is payable in any of those events.
data-availability-and-transparency-act-2022.pdf, p.98
77B Conditions of accreditation
Entities must comply with accreditation conditions.
77B(1) Conditions of accreditation
May require or permit an entity to do something, or prevent it from doing something.
77B(2) Conditions of accreditation
Examples of conditions that may be prescribed or imposed
77B(3) Conditions of accreditation
78 Imposition, variation or removal of conditions of accreditation by
Accreditation authority may impose conditions of accreditation on an entity.
78(1) Imposition, variation or removal of conditions of accreditation by
Authority has the power to impose conditions.
Consider whether to cancel or suspend accreditation, or impose conditions on an entity.
78(2) Imposition, variation or removal of conditions of accreditation by
Entity must comply with subsection (2) in both capacities.
78(3) Imposition, variation or removal of conditions of accreditation by
Authority may vary or remove accreditation conditions.
78(4) Imposition, variation or removal of conditions of accreditation by
Authority has permission to modify accreditation conditions.
Minister must notify Commissioner of decision to impose, vary or remove condition of accreditation.
78(5) Imposition, variation or removal of conditions of accreditation by
Minister has a duty to notify Commissioner.
data-availability-and-transparency-act-2022.pdf, p.99
Accreditation authority must not make certain decisions without notice.
79 Notice before decision relating to conditions of accreditation
data-availability-and-transparency-act-2022.pdf, p.100
80 Notice of conditions
Accredited entity must receive written notice of decision.
80(1) Notice of conditions
Entity must provide notice of conditions, including review rights.
80(2) Notice of conditions
data-availability-and-transparency-act-2022.pdf, p.102
81 Suspension or cancellation of accreditation
Suspension or cancellation of accreditation for certain circumstances.
81(1) Suspension or cancellation of accreditation
Suspension or cancellation of accreditation is prohibited
Prohibition of accreditation suspension or cancellation
Reasonable satisfaction that entity does not meet criteria
Suspension of accreditation if reasonable suspicion of breach.
81(2) Suspension or cancellation of accreditation
Prohibits suspension without reasonable suspicion.
Cancellation of accreditation if breach determined
81(3) Suspension or cancellation of accreditation
Accreditation authority may cancel accreditation within specified time frame
Defines temporal interval for breach determination
Commissioner determines under subsection 102(1)
Accreditation authority uses AI to evaluate breach determination and cancel accreditation if necessary
Applies AI reasoning to accreditation cancellation decisions
Entity has breached this Act or a data sharing agreement
Accreditation authority may not cancel accreditation
Prohibits cancellation without breach determination
Commissioner determines breach under subsection 102(1)
Accreditation authority notifies relevant parties of cancellation decision
Diffuses information about accreditation cancellation to relevant parties
Accreditation authority may cancel accreditation after specified time frame
Defines temporal interval for cancellation of accreditation
Minister may cancel accreditation if entity breaches Act or data sharing agreement.
81(4) Suspension or cancellation of accreditation
...if the Minister reasonably believes that the entity has breached this Act or a data sharing agreement.
(4) The Minister may cancel the accreditation...
Involves reasoning about cancellation of accreditation based on breach.
Prohibits cancellation of accreditation without reasonable belief of breach.
Diffuses responsibility for cancellation of accreditation to Minister.
Validates cancellation of accreditation against data sharing agreements.
Consider entity's conduct in multiple capacities when evaluating accreditation.
81(5) Suspension or cancellation of accreditation
Consider whether to suspend or cancel accreditation on a ground
81(6) Suspension or cancellation of accreditation
Grounds for suspending or cancelling accreditation must be considered.
81(7) Suspension or cancellation of accreditation
Prohibition of suspension or cancellation
Suspension of accreditation if renewal is not applied for within 5 years.
81(8) Suspension or cancellation of accreditation
Prohibits suspension of accreditation if renewal is not applied for within 5 years.
data-availability-and-transparency-act-2022.pdf, p.104
82 Notice before decision about suspension or cancellation
Authority must give written notice before suspending or cancelling accreditation.
82(1) Notice before decision about suspension or cancellation
Accredited entity must provide written statement showing cause why accreditation should not be suspended or cancelled.
82(2) Notice before decision about suspension or cancellation
Accredited entity must provide written statement.
The accreditation authority must consider a written statement before making a decision.
82(3) Notice before decision about suspension or cancellation
The statement falls within the accreditation authority's consideration period.
The statement is considered within a specific time frame.
The accreditation authority considers written statements within a specified period.
The accreditation authority MUST consider the statement.
The accreditation authority has a duty to consider written statements.
The accreditation authority MUST consider the statement before making a decision.
The accreditation authority must make a decision based on consideration of the statement.
The accreditation authority has a duty to make decisions based on written statements.
The accreditation authority has a duty to consider the statement.
The accreditation authority is required to make decisions based on written statements.
Accreditation authority may decide not to give entity a notice under subsection (2) of this section.
82(4) Notice before decision about suspension or cancellation
data-availability-and-transparency-act-2022.pdf, p.105
83 Notice of suspension or cancellation
Entity must receive written notice of accreditation suspension or cancellation.
83(1) Notice of suspension or cancellation
The accreditation authority must give notice as soon as practicable after making a decision.
83(2) Notice of suspension or cancellation
The accreditation authority must give notice.
Circumstance, period of suspension (if applicable)
Notice of suspension or cancellation requirements
83(3) Notice of suspension or cancellation
data-availability-and-transparency-act-2022.pdf, p.106
Entity must lift suspension upon request from accreditation authority if grounds no longer exist.
83A Lifting of suspension
Entity must lift suspension upon request from accreditation authority.
data-availability-and-transparency-act-2022.pdf, p.107
84 Renewal
The Commissioner must grant renewal if certain conditions are met.
84(1) Renewal
The renewal is granted if the Commissioner considers it appropriate.
(c) the Commissioner considers it appropriate, in all the circumstances, to grant the renewal.
The entity meets the criteria for accreditation under section 77.
The entity is classified as an Australian entity.
(1) If an entity applies for the renewal of the entity’s accreditation...
(a) the entity is an Australian entity and not an excluded entity; (b) the Commissioner is satisfied that the entity meets the criteria for accreditation under section 77;
Commissioner may renew accreditation with or without conditions.
84(2) Renewal
Commissioner has the power to renew accreditation.
data-availability-and-transparency-act-2022.pdf, p.108
85 Notice of renewal decision
The Commissioner must give written notice of the decision.
85(1) Notice of renewal decision
(a) the 5-year period for which the renewed accreditation is in effect; (b) if the Commissioner decides to grant the renewal with conditions of accreditation imposed by the Commissioner...
Notice of renewal decision must provide specific information.
85(2) Notice of renewal decision
Notice of renewal decision contains temporal information.
(2) If the Commissioner grants the entity the renewal...
Entity must provide notice of renewal decision.
(a) the reason for the refusal; (b) that the entity’s accreditation will be suspended or cancelled under section 81; (c) the entity’s review rights under Part 6.2.
Entity's accreditation will be suspended or cancelled under section 81.
85(3) Notice of renewal decision
Defines a temporal interval for notice of refusal.
(3) If the Commissioner refuses to renew the entity’s accreditation, the notice must set out...
Implies that the notice must provide certain information.
Recognizes the need for notice of refusal.
Prohibits the Commissioner from renewing accreditation without notice.
Diffuses the requirement for notice of refusal.
data-availability-and-transparency-act-2022.pdf, p.109
85A Application for renewal
Entity must apply for renewal of accreditation.
85A(1) Application for renewal
85A(2) Application for renewal
data-availability-and-transparency-act-2022.pdf, p.110
Rules for accreditation framework procedures and requirements
86 Rules relating to the accreditation framework
Obligation to provide rules for accreditation framework
87 Further information or evidence
Request for further information or evidence from an entity.
87(1) Further information or evidence
Entity must provide information or evidence upon request.
87(2) Further information or evidence
data-availability-and-transparency-act-2022.pdf, p.111
88 Making scheme complaints
Complainant may complain to Commissioner about breach of Act or data sharing agreement
88(1) Making scheme complaints
Entity can complain to Commissioner if reasonable suspicion exists
88(2) Making scheme complaints
(a) specify the respondent; (b) be made in an approved form; (c) meet any requirements prescribed by a data code
88(3) Making scheme complaints
(c) meet any requirements prescribed by a data code
89 Respondents
Identify respondent for Commonwealth body complaints
89(1) Respondents
(a) if the Commonwealth body is a body corporate or an individual—the Commonwealth body;
The respondent is the entity about which the complaint is made.
89(2) Respondents
The respondent is the entity if it is not a Commonwealth body.
If the complaint is about an entity that is not a Commonwealth body, the respondent is the entity.
data-availability-and-transparency-act-2022.pdf, p.15
9 Definitions
Commonwealth body, State body, Territory body
data-availability-and-transparency-act-2022.pdf, p.112
90 Communicating with complainant
Commissioner must provide written notice to complainant within 30 days.
90(1) Communicating with complainant
Request for further information from complainant
90(2) Communicating with complainant
Complainant must comply with Commissioner's request within 30 days.
90(3) Communicating with complainant
Complainant has an obligation to comply with the Commissioner's request.
Commissioner does not need to comply with subsection (1) if notice is given before last day.
90(4) Communicating with complainant
Notice given before last day overlaps with subsection (1)
Last day for complying with subsection (1)
Commissioner exempted from complying with subsection (1)
91 Dealing with complaints
Commissioner must make preliminary inquiries and consider conciliation or external dispute resolution.
91(1) Dealing with complaints
Exemption from dealing with complaints under certain conditions.
91(2) Dealing with complaints
data-availability-and-transparency-act-2022.pdf, p.113
92 Grounds for not dealing with complaints
The Commissioner may not deal with the complaint if...
data-availability-and-transparency-act-2022.pdf, p.114
Evidence of things said or done in conciliation is not admissible unless agreed upon by parties or related to an offence.
93 Admissibility of things said or done in conciliation
Prohibits admissibility of conciliation evidence unless agreed upon by parties.
data-availability-and-transparency-act-2022.pdf, p.115
A person may complain about any matter relating to the administration or operation of the data sharing scheme.
94 Making general complaints
The Commissioner may deal with a complaint by doing certain actions.
95 Dealing with complaints
The Commissioner must deal with the complaint.
data-availability-and-transparency-act-2022.pdf, p.116
Evidence of things said or done in conciliation is not admissible unless agreed upon by parties or related to committing an offence.
96 Admissibility of things said or done in conciliation
Prohibits admissibility of conciliation evidence unless agreed upon.
99 Assessments
The Commissioner may assess whether conduct is consistent with the requirements of this Act.
99(1) Assessments
The Commissioner may conduct an assessment in any manner the Commissioner considers appropriate.
99(2) Assessments
The Commissioner has a duty to conduct an assessment.
Commissioner may obtain information from any person and make inquiries.
99(3) Assessments
Commissioner has the power to obtain information.
Person must provide information if requested.
Inquiries are possible but not guaranteed.
Commissioner must consider submissions made in response to invitation.
99(4) Assessments
Data Availability and Transparency Act 2022