Data Availability and Transparency Act 2022
11 December 2024
Compilation information and notes on amendments.
data-availability-and-transparency-act-2022.pdf, p.1
Classifies the text as a compilation of the Data Availability and Transparency Act 2022.
The text is classified as a compilation.
This compilation shows the text of the law as amended and in force on 11 December 2024.
1 Short title
data-availability-and-transparency-act-2022.pdf, p.11
2 Commencement
1 Section 1
1 April 2022
Note on table limitations and amendments
3 Objects
4 Simplified outline of this Act
Data sharing scheme requires project and data sharing principles
data-availability-and-transparency-act-2022.pdf, p.12
5 Act binds the Crown
data-availability-and-transparency-act-2022.pdf, p.13
5(1) Act binds the Crown
The Act binds the Crown in all its capacities.
5(2) Act binds the Crown
The Crown is not liable for prosecution.
This Act does not make the Crown liable to be prosecuted for an offence.
5(3) Act binds the Crown
The Crown is liable to pay a pecuniary penalty under a civil penalty order.
The Crown has an obligation to pay a pecuniary penalty.
6 Extension to external Territories
This Act extends to every external Territory.
7 Extraterritorial operation
Legislative power extends outside Australia.
9 Definitions
data-availability-and-transparency-act-2022.pdf, p.15
Commonwealth body, State body, Territory body
10 References to access to data
data-availability-and-transparency-act-2022.pdf, p.22
10(1) References to access to data
Reference to entity providing access to data includes reference to entity providing data to another entity or releasing data.
(a) providing another entity with access to the data
(b) providing open access to the data (releasing the data)
a reference to an entity providing access to data
includes a reference to the entity: (a) providing another entity with access to the data; and (b) providing open access to the data (releasing the data)
(1) For the purposes of this Act, a reference to an entity providing access to data includes a reference to the entity: (a) providing another entity with access to the data; and (b) providing open access to the data (releasing the data)
(a) providing another entity with access to the data; and (b) providing open access to the data (releasing the data)
10(2) References to access to data
Data custodians of public sector data must provide access to accredited entities.
10(3) References to access to data
Entity must retain a copy of data when providing access.
11 Entity definitions
11(1) Entity definitions
Defines data custodians and accredited entities as data scheme entities.
Data custodians and accredited entities are defined.
Entities must be classified as data scheme entities.
11(2) Entity definitions
Entity must be a data custodian if it controls public sector data or has become the data custodian of output.
(2) An entity is a data custodian if the entity:...
11(2A) Entity definitions
Data custodian is also considered data custodian of ADSP-enhanced data.
11(3) Entity definitions
11A The data sharing project
data-availability-and-transparency-act-2022.pdf, p.24
11A(1) The data sharing project
A project involves sharing data between entities.
11A(2) The data sharing project
Data services or data creation by or on behalf of the sharer is involved in the project.
11A(3) The data sharing project
Sharer must share data with intermediary and user.
Must provide sharer's authorisation to share data with intermediary.
Must provide intermediary's authorisation to collect and use data.
11A(4) The data sharing project
Sharer must collect and use output or ADSP-enhanced data if provided access.
11A(5) The data sharing project
Treat multiple projects as a single project under certain conditions.
12 Simplified outline of this Chapter
data-availability-and-transparency-act-2022.pdf, p.27
Commonwealth bodies are authorised to share their public sector data with accredited users.
Accredited users are authorised to collect and use the data.
Commonwealth bodies must be the data custodian of public sector data they share.
Commonwealth bodies must control the data.
Some sharing of data is barred (e.g. if the sharing would contravene a prescribed law or an agreement).
Sharing of data is prohibited in certain circumstances.
Authorisation extension to other entities
An accredited user’s authorisation to use data may in some circumstances extend to providing access to output of the project to other entities.
Access to output is permitted under certain conditions.
13 Authorisation for data custodian to share public sector data
data-availability-and-transparency-act-2022.pdf, p.29
13(1) Authorisation for data custodian to share public sector data
Authorises data custodian to share public sector data with another entity under specified conditions.
(a) the constitutional requirements in subsection (4) are met;
The sharer is authorised to share data with another entity.
Defines a class of entities that can share public sector data.
(c) the project the sharing is part of is covered by a registered data sharing agreement that is in effect and that meets the requirements of this Act;
The sharer shares with an accredited user if the project is covered by a registered data sharing agreement.
Sharing occurs during the effect of a registered data sharing agreement.
(d) the sharing is in accordance with the data sharing agreement;
The sharer shares with an accredited user if the sharing is in accordance with the data sharing agreement.
Authorisation to share ADSP-enhanced data.
(h) if the sharer shares through an intermediary—the intermediary is an ADSP and its accreditation is not suspended;
The intermediary shares with the user on behalf of the sharer if it is an ADSP and accredited.
Defines a class of entities that can share ADSP-enhanced data.
(i) if the sharer shares through an intermediary—the privacy coverage condition in section 16E is met in relation to the intermediary.
The intermediary shares with the user on behalf of the sharer if it meets the privacy coverage condition.
Authorisation to share personal information.
(g) if the data shared with the user includes personal information—the privacy coverage condition in section 16E is met in relation to the user;
The sharer shares personal information with an accredited user if it meets the privacy coverage condition.
13(2) Authorisation for data custodian to share public sector data
Data custodian may share public sector data
13A Authorisation for accredited user to collect and use data
Authorized entity can collect and use data under specified conditions.
data-availability-and-transparency-act-2022.pdf, p.31
Entity has permission to collect and use data.
Registered data sharing agreement in effect
Data shared with user is classified as personal information.
If data shared with user includes personal information—
Privacy coverage condition met for personal information
User can collect and use data during project period.
The collection or use is in accordance with the data sharing agreement;
Project is consistent with data sharing principles
User's accreditation suspension implies lack of permission.
The user is an accredited user and its accreditation is not suspended;
User does not know and could not reasonably be expected to know that the sharing by the sharer is not authorised by section 13
Data sharing agreement propagates to user.
The project is covered by a registered data sharing agreement that is in effect and that meets the requirements of this Act;
Data sharing agreement validates user's accreditation.
13B Authorisation for ADSP to act as intermediary
Intermediary authorized to collect data shared with it by the sharer under certain conditions.
data-availability-and-transparency-act-2022.pdf, p.32
Intermediary has an obligation to collect data shared with it by the sharer under certain conditions.
Project is covered by a registered data sharing agreement that meets the requirements of this Act.
project is covered by a registered data sharing agreement
Collection or use is in accordance with the data sharing agreement.
collection or use is in accordance with the data sharing agreement
Intermediary is satisfied that the project is consistent with the data sharing principles.
intermediary is satisfied that the project is consistent with the data sharing principles
Intermediary is an ADSP and its accreditation is not suspended.
intermediary is an ADSP and its accreditation is not suspended
If the data shared with the intermediary includes personal information—the privacy coverage condition in section 16E is met in relation to the intermediary.
if the data shared with the intermediary includes personal information—the privacy coverage condition in section 16E is met in relation to the intermediary
13C Authorisation for data custodian to collect and use submitted
Sharer has permission to collect output or ADSP-enhanced data from user or intermediary under certain conditions.
Permission to collect output or ADSP-enhanced data
Sharer has shared data with user under section 13 as part of a project
Sharer is authorised to collect output or ADSP-enhanced data of the project from the user or intermediary
Overlap between sharer's permission and project duration
Project is covered by a registered data sharing agreement that is in effect
Sharer's permission to collect output or ADSP-enhanced data overlaps with project duration
Temporal relationship between sharer's permission and project completion
Project is covered by a registered data sharing agreement that meets the requirements of this Act
Sharer's permission to collect output or ADSP-enhanced data ends when project is completed
Diffusion of sharer's permission through user or intermediary
Sharer's permission to collect output or ADSP-enhanced data diffuses through user or intermediary
CogAI recognises sharer's permission to collect output or ADSP-enhanced data
CogAI recognises sharer's permission to collect output or ADSP-enhanced data from user or intermediary under certain conditions
14 Penalties for unauthorised sharing
data-availability-and-transparency-act-2022.pdf, p.33
14(1) Penalties for unauthorised sharing
Unauthorized sharing of data is prohibited.
(1) An entity contravenes this subsection...
14(2) Penalties for unauthorised sharing
(2) An individual or a body corporate contravenes this subsection...
14(3) Penalties for unauthorised sharing
(3) An entity commits an offence if: (a) the entity provides access to data; and (b) the provision of access is purportedly under section 13; and (c) the provision of access is not authorised by section 13 and the entity is reckless with respect to that circumstance.
Penalty: Imprisonment for 5 years or 300 penalty units, or both.
Imposes an obligation on entities to comply.
Implicates the provision's implications on entities.
Spreads the provision's impact on entities.
14(4) Penalties for unauthorised sharing
Sharing data under section 13 without permission is prohibited.
Prohibits sharing data under section 13.
(4) An individual or a body corporate commits an offence if: (a) the individual or body corporate uses data; and (b) the use is a provision of access to the data by an entity under, or purportedly under, section 13;
14A Penalties for unauthorised collection or use
data-availability-and-transparency-act-2022.pdf, p.34
14A(1) Penalties for unauthorised collection or use
Unauthorized collection or use of ADSP-enhanced data is prohibited.
Unauthorized collection or use of ADSP-enhanced data is not authorized.
The entity contravenes this subsection if...
Temporal overlap between collection and use
The collection or use must occur within the same temporal interval.
The collection or use is not authorised by this Act if...
Implication of unauthorized collection or use on penalty units
If the entity collects or uses data without authorization, then a civil penalty applies.
Civil penalty: (a) 300 penalty units; or...
Transmission of information about unauthorized collection or use
The entity must inform the relevant authorities about the unauthorized collection or use.
Recognition of ADSP-enhanced data by AI systems
AI systems must recognize and classify ADSP-enhanced data correctly.
The data is classified as ADSP-enhanced if it meets the specified criteria.
14A(2) Penalties for unauthorised collection or use
Penalties for serious contraventions of data sharing scheme responsibilities
Prohibits serious contraventions of data sharing scheme responsibilities
(2) This subsection applies if the entity concerned is or has been an accredited entity and the contravention is serious...
14A(3) Penalties for unauthorised collection or use
Using ADSP-enhanced data without authorization
(d) the individual or body corporate’s use of the data is not authorized by this Act.
14A(4) Penalties for unauthorised collection or use
Prohibits unauthorized collection or use of ADSP-enhanced data.
Data collection or use overlaps with authorized sharing under section 13.
(c) the collection or use is not authorised by this Act and the entity is reckless with respect to that circumstance.
and (b) the data is ADSP-enhanced data, or output, of a project...
Data collection or use recurs with unauthorized sharing under section 13.
Unauthorized collection or use spreads to other entities.
Data collection or use detects anomalies.
14A(5) Penalties for unauthorised collection or use
Unauthorised collection or use of ADSP-enhanced data is prohibited.
(5) An individual or a body corporate commits an offence...
Imprisonment for 5 years or 300 penalty units, or both.
Temporal relation between use of data and section 13
(c) the individual has a designated relationship with the entity, or...
Implication of unauthorised use on penalty
(d) the individual or body corporate’s use of the data...
Spread of unauthorised collection or use
Classification of data as ADSP-enhanced by AI
(a) the individual or body corporate uses data;
15 Data sharing purposes
data-availability-and-transparency-act-2022.pdf, p.38
15(1) Data sharing purposes
Delivery of government services is a data sharing purpose.
15(1A) Data sharing purposes
Delivery of government services includes providing information, services, determining eligibility, and paying payments.
Classifies delivery of government services
15(2) Data sharing purposes
(2) The following are precluded purposes:
(b) a purpose that relates to, or prejudices, national security within the meaning of the National Security Information (Criminal and Civil Proceedings) Act 2004;
(c) a purpose prescribed by the rules for the purposes of this paragraph.
15(3) Data sharing purposes
Enforcement-related purposes include detecting, investigating, or addressing acts detrimental to public revenue.
(3) An enforcement related purpose means any of the following purposes:
(b) detecting, investigating or addressing acts or practices detrimental to public revenue;
15(4) Data sharing purposes
Purpose is not precluded if it relates to matters in a general way to another purpose.
16 Data sharing principles
data-availability-and-transparency-act-2022.pdf, p.40
16(1) Data sharing principles
The project principle is that the project is an appropriate project or program of work.
16(2) Data sharing principles
The project principle includes serving the public interest and observing ethics processes.
(a) the project can reasonably be expected to serve the public interest;
(b) the parties observe processes relating to ethics, as appropriate in the circumstances.
16(3) Data sharing principles
Data is made available only to appropriate persons.
Obligation to share data with appropriate persons.
(3) The people principle is that data is made available only to appropriate persons.
16(4) Data sharing principles
Access to data is only provided to individuals with appropriate attributes and qualifications.
The people principle includes the following elements: Authorisations Chapter 2 Data sharing purposes and principles Part 2.3
16(5) Data sharing principles
Data should be shared, collected and used in an appropriately controlled environment.
(5) The setting principle is that data is shared, collected and used in an appropriately controlled environment.
Defines the temporal scope of data sharing.
Specifies the temporal relationship between data sharing.
Describes the mechanism of data sharing.
Identifies the AI system responsible for data sharing.
16(6) Data sharing principles
Data sharing principles require appropriate means and security standards.
Requires data sharing principles to be met.
...appropriate means and security standards are applied.
Includes elements for the setting principle.
16(7) Data sharing principles
Appropriate protections must be applied to data.
16(8) Data sharing principles
Only share data necessary for applicable purpose
16(9) Data sharing principles
Output principle is that only Chapter 2 Authorisations are outputted.
16A General privacy protections
data-availability-and-transparency-act-2022.pdf, p.43
16A(1) General privacy protections
Sharing of biometric data requires individual consent.
Prohibits sharing of biometric data without consent.
Must not be shared unless individual consents.
Classifies data as requiring consent for sharing.
Biometric data must be shared with consent
Data is classified as requiring consent.
16A(2) General privacy protections
Prohibits accredited entities from storing or accessing ADSP-enhanced data outside Australia
(2) If data that includes personal information is shared...
...the output, of the project outside Australia.
Describes a class of entities subject to prohibition
...accredited entity with or through which it is shared from storing or accessing, or providing access to, the ADSP-enhanced data...
Specifies a temporal interval during which prohibition applies
Describes a class of entities subject to prohibition using AI
...accredited entity with or through which it is shared from storing or accessing, or providing access to, the ADSP-enhanced data, or the output, of the project outside Australia.
Ensures compliance with prohibition using SHACL
16A(3) General privacy protections
Prohibits action that may result in data ceasing to be de-identified when shared.
(3) If data that has been de-identified is shared...
...the data sharing agreement must prohibit the accredited user from taking any action...
Defines a temporal interval for data sharing.
Defines a temporal trace for data sharing.
Represents knowledge about data sharing.
16B Purpose-specific privacy protections
Data sharing for delivery of government services requires consent or specific exceptions.
Requires individual consent for data sharing.
Data sharing purpose is delivery of government services
16C Project involving use of de-identification or secure access data
data-availability-and-transparency-act-2022.pdf, p.46
16C(1) Project involving use of de-identification or secure access data
Project involving use of de-identification or secure access data requires data sharing for informing government policy and programs or research and development.
Requires data sharing for specified purposes.
16C(2) Project involving use of de-identification or secure access data
Service must be performed by data custodian or ADSP with appropriate skills and experience
(2) The data sharing agreement that covers the project...
16C(3) Project involving use of de-identification or secure access data
Service must treat data with personal information to de-identify it using techniques that restrict its use.
De-identification data service is a service to treat data that includes personal information so that the data is de-identified.
16C(4) Project involving use of de-identification or secure access data
Definition of secure access data service
16D Project involving complex data integration services
data-availability-and-transparency-act-2022.pdf, p.47
16D(1) Project involving complex data integration services
Project involving complex data integration services requires informing government policy and programs or research and development.
16D(2) Project involving complex data integration services
Service must be performed by data custodian or ADSP
16D(3) Project involving complex data integration services
Service to integrate data is a complex data integration service if specific conditions are met.
Definition of a complex data integration service
(3) A service to integrate data is a complex data integration service if...
Class hierarchy for data integration services
(a) 2 or more entities control the data being integrated;
...the data is at the unit or micro level;
Temporal relationship between data integration and its control
(b) the data is at the unit or micro level;
...any of the following subparagraphs applies to any of the data...
(c) any of the following subparagraphs applies to any of the data...
Relationship between data integration and personal information
(i) the data includes personal information;
...any of the subparagraphs applies to any of the data...
16E Privacy coverage condition
data-availability-and-transparency-act-2022.pdf, p.49
16E(1) Privacy coverage condition
16E(2) Privacy coverage condition
An APP-equivalence term prohibits an entity from collecting or using personal information in a way that would breach an Australian Privacy Principle.
Prohibits entity from collecting or using personal information
(2) An APP-equivalence term is a term of a data sharing agreement
An entity must not collect or use personal information in this way
Prohibition applies during the duration of the data sharing agreement
The prohibition applies during the duration of the data sharing agreement
Prohibition ends when the data sharing agreement ends
The prohibition ends when the data sharing agreement ends
Prohibition spreads through the entity's actions during the data sharing agreement
The prohibition spreads through the entity's actions during the data sharing agreement
Entity must recognize and comply with the APP-equivalence term
The entity must recognize and comply with the APP-equivalence term
16F Compliance with APP-equivalence term
data-availability-and-transparency-act-2022.pdf, p.50
16F(1) Compliance with APP-equivalence term
An act or practice that contravenes the APP-equivalence term is taken to be an interference with privacy.
16F(2) Compliance with APP-equivalence term
Entity must comply with APP-equivalence term for Part V of the Privacy Act 1988 and other provisions.
Entity must comply with APP-equivalence term.
Entity's act or practice is subject to investigation by the Information Commissioner.
(b) the act or practice is the subject of a complaint to, or an investigation by, the Information Commissioner under Part V of the Privacy Act 1988.
Entity may have contravened the APP-equivalence term in relation to an individual.
(a) an act or practice of the entity has contravened, or may have contravened, the APP-equivalence term in relation to an individual;
16F(3) Compliance with APP-equivalence term
Reference to entities subject to APP-equivalence term is included in the Privacy Act 1988
Inclusion of entities subject to APP-equivalence term is an obligation
APP-equivalence term is a subclass of the Privacy Act 1988
16F(4) Compliance with APP-equivalence term
Entity must comply with Privacy Act 1988 as if it were an APP entity.
16F(5) Compliance with APP-equivalence term
Sections 80V and 80W of the Privacy Act 1988 apply in relation to an APP-equivalence term as if the term were a provision of that Act.
The law applies to the APP-equivalence term.
17 When sharing is barred
data-availability-and-transparency-act-2022.pdf, p.52
17(1) When sharing is barred
Sharing data is barred by certain subsections.
17(2) When sharing is barred
Sharing data is barred under certain conditions.
17(3) When sharing is barred
Sharing data is barred if it infringes certain rights or privileges.
17(4) When sharing is barred
Sharing data is barred under certain circumstances.
Regulations for the purposes of this subparagraph
17(5) When sharing is barred
Sharing data is barred if it violates international law or Commonwealth law.
(5) Sharing data is barred if: (a) sharing the data is inconsistent with: (i) the obligations of Australia under international law, including obligations under any international agreement binding on Australia; or (ii) any law of the Commonwealth giving effect to such an agreement;
Traces sharing data prohibition through time
16 December 1966 ([1980] ATS 23)).
data-availability-and-transparency-act-2022.pdf, p.54
Prohibits sharing data under certain conditions.
18 Data sharing agreement
data-availability-and-transparency-act-2022.pdf, p.55
18(1) Data sharing agreement
Must comply with data sharing agreement requirements
18(2) Data sharing agreement
Data sharing agreement must be entered into by authorized officers or under subsection 137(4)
Prohibition of unauthorized data sharing agreements
(2) A data sharing agreement must not be entered into...
...unless the individual is an authorized officer of the entity or authorized under subsection 137(4)
Temporal interval requirement for authorization
18(3) Data sharing agreement
No variation of data sharing agreement can be entered into without proper authorization.
Prohibits unauthorized variation of data sharing agreement
(3) A variation of a data sharing agreement must not be entered into by an individual...
Restricts temporal scope of authorized variations
18(4) Data sharing agreement
Data sharing agreement requires registration before it has effect.
19 Requirements to be met by all data sharing agreements
data-availability-and-transparency-act-2022.pdf, p.56
19(1A) Requirements to be met by all data sharing agreements
All data sharing agreements must meet certain requirements.
19(1) Requirements to be met by all data sharing agreements
Parties must be identified in the agreement.
19(2) Requirements to be met by all data sharing agreements
Agreement must describe project and specify Act's applicability.
19(3) Requirements to be met by all data sharing agreements
Data sharing agreement must specify source data and final output.
19(4) Requirements to be met by all data sharing agreements
Agreement must specify data custodian and output for Commonwealth body appointment
19(5) Requirements to be met by all data sharing agreements
Sharing data without authorisation may contravene a law.
Prohibits sharing data without authorisation.
Section 23 authorises sharing overrides other laws.
Sharing data without authorisation contravenes a law.
19(6) Requirements to be met by all data sharing agreements
Prohibit accredited user from collecting and using output of the project for certain purposes.
19(6A) Requirements to be met by all data sharing agreements
Prohibits accredited user from creating output other than final output and incidental output.
Defines temporal interval for incidental output
...output the creation of which is reasonably necessary or incidental to creation of the final output.
Implicates creation of incidental output on prohibition
Propagates prohibition through output types
19(7) Requirements to be met by all data sharing agreements
Agreement must specify how project will be consistent with data sharing principles.
(a) describing how the public interest is served by the project; (b) specifying the actions the party will take to give effect to the principles.
Actions must be taken during the project
19(8) Requirements to be met by all data sharing agreements
Agreement must specify data services performed by ADSP
20A Allowed access: providing data custodian of source data with
data-availability-and-transparency-act-2022.pdf, p.60
20A(1) Allowed access: providing data custodian of source data with
Allowing data custodian access to ADSP-enhanced data
20A(2) Allowed access: providing data custodian of source data with
Allowing data custodian access to output for ensuring accuracy.
(2) The data sharing agreement may allow the accredited user to provide access...
20A(3) Allowed access: providing data custodian of source data with
Submit data upon access to ADSP-enhanced data or output
20A(4) Allowed access: providing data custodian of source data with
Providing access to output or ADSP-enhanced data as allowed by this section is taken to be for the data sharing purpose, or data sharing purposes of the project.
20B Allowed access: providing access to output for validation or
20B(1) Allowed access: providing access to output for validation or
Allowing access to output for validation or correction by accredited users and entities.
Specifying temporal intervals for validation or correction.
(i) an entity that carries on a business, or is a not-for-profit entity, to which the output relates, for the purpose of validating or correcting the output;
Establishing conditions for access to be considered authorized.
(b) requires the data custodian of the source data to be satisfied, before access is provided, that the access will be an authorized use of the output under section 13A.
Specifying requirements for authorized access.
Granting authority for access to output.
20B(2) Allowed access: providing access to output for validation or
Collecting a copy of data from an entity upon validation or correction
Collecting data from an entity upon validation or correction
Data collection occurs during the same time interval as data validation or correction
20B(3) Allowed access: providing access to output for validation or
Providing access for data sharing purpose
20C Allowed access: providing access to or releasing output in other
Accredited user may provide access or release output in specified circumstances.
data-availability-and-transparency-act-2022.pdf, p.61
Permission to provide access or release output.
Classifies the provision as a permission.
20D Allowed access: sharing under section 13
Sharing of output under section 13 is allowed if certain conditions are met.
data-availability-and-transparency-act-2022.pdf, p.62
...sharing will be an authorised use of the output.
20E Exit of ADSP-enhanced data or output of project
20E(1) Exit of ADSP-enhanced data or output of project
Using output or ADSP-enhanced data in unauthorized ways is a defence to an offence under section 14A if the copy has exited the data sharing scheme.
Obligation to comply with authorized use of output or ADSP-enhanced data.
Using output or ADSP-enhanced data in unauthorized ways.
Defence to an offence under section 14A if the copy has exited the data sharing scheme.
Temporal relation between authorized and unauthorized use of output or ADSP-enhanced data.
The copy being used has exited the data sharing scheme under this section.
Authorized use of output or ADSP-enhanced data before exit from the data sharing scheme.
Recurring trace of authorized and unauthorized use of output or ADSP-enhanced data.
The user or intermediary in a project uses output, or ADSP-enhanced data, of the project in ways other than those authorized by this Act.
Authorized use of output or ADSP-enhanced data in previous instances.
Spread of authorized and unauthorized use of output or ADSP-enhanced data.
Authorized use of output or ADSP-enhanced data in subsequent instances.
Knowledge representation of authorized and unauthorized use of output or ADSP-enhanced data.
This Act authorizes the use of output or ADSP-enhanced data in specific ways.
Authorized use of output or ADSP-enhanced data.
20E(2) Exit of ADSP-enhanced data or output of project
Exit of ADSP-enhanced data or output of project upon authorized use
Obligation to exit data sharing scheme upon authorized use
(2) If a person obtains a copy of output...
...the copy exits the data sharing scheme at the time it is collected by the person
Temporal interval for exit of ADSP-enhanced data or output of project
Temporal logic for exit of ADSP-enhanced data or output of project
Diffusion logic for exit of ADSP-enhanced data or output of project
Cognitive logic for exit of ADSP-enhanced data or output of project
20E(3) Exit of ADSP-enhanced data or output of project
Exit of ADSP-enhanced data upon collection by person with access authorization.
20E(4) Exit of ADSP-enhanced data or output of project
User must obtain consent before sharing personal information.
Consent from individual before data sharing.
20E(5) Exit of ADSP-enhanced data or output of project
Specifies applicable time for exit of ADSP-enhanced data or output of project
20E(6) Exit of ADSP-enhanced data or output of project
User must collect data upon exit from the data sharing scheme.
20E(7) Exit of ADSP-enhanced data or output of project
User must hold a copy of output after exit from data sharing scheme
User has an obligation to hold a copy of output
20F Data custodian of output of project
data-availability-and-transparency-act-2022.pdf, p.64
20F(1) Data custodian of output of project
Entity becomes data custodian of output at specified times.
at the time of output creation/exits scheme/ access
20F(2) Data custodian of output of project
Appointing data custodian for specified output of project
Has obligation to appoint data custodian
The agreement allows the user to provide access to the data
The user has an obligation to appoint a data custodian
The data custodian appointment is during the project duration
20F(3) Data custodian of output of project
20F(4) Data custodian of output of project
User must be appointed data custodian of output unless otherwise specified.
User must be appointed data custodian of output.
20F(5) Data custodian of output of project
Appoints data custodian for specified output of project under certain conditions.
22 Other authorisations for data custodians not limited
No limitation on data sharing by data custodians under other laws.
data-availability-and-transparency-act-2022.pdf, p.66
23 Authorisations override other laws
23(1) Authorisations override other laws
(1) The authorisations in sections 13, 13A, 13B and 13C have effect despite anything in another law of the Commonwealth, or a law of a State or Territory.
Temporal relation between authorisations and other laws
23(2) Authorisations override other laws
24 Simplified outline of this Chapter
Responsibilities of data scheme entities are mainly set out in this Chapter.
data-availability-and-transparency-act-2022.pdf, p.67
Imposes obligations on data scheme entities.
25 No duty to share but reasons required for not sharing
data-availability-and-transparency-act-2022.pdf, p.68
25(1) No duty to share but reasons required for not sharing
25(2) No duty to share but reasons required for not sharing
Data custodian must consider sharing public sector data upon request.
Request is made by accredited user and in approved form or writing
25(3) No duty to share but reasons required for not sharing
Data custodian must provide written notice of reasons for refusing a request.
The data custodian must provide written notice.
26 Comply with rules and data codes
27 Have regard to guidelines
Must have regard to guidelines when engaging in conduct for the purposes of this Act.
Data scheme entities must engage in conduct for the purposes of this Act.
30 Comply with conditions of accreditation
An accredited entity must comply with the conditions of accreditation.
31 Report events and changes in circumstances affecting
data-availability-and-transparency-act-2022.pdf, p.69
31(1) Report events and changes in circumstances affecting
An accredited entity must give notice to the Commissioner about certain events or changes.
31(2) Report events and changes in circumstances affecting
Exemption from subsection (1) under certain circumstances.
32 Not provide false or misleading information
32(1) Not provide false or misleading information
Do not provide false or misleading information
Prohibition of false or misleading information
32(2) Not provide false or misleading information
Cannot provide false or misleading information
Prohibition of providing false or misleading information
33 Registration of data sharing agreements
data-availability-and-transparency-act-2022.pdf, p.70
33(1) Registration of data sharing agreements
Entity must provide data sharing agreement to Commissioner within 30 days.
Entity must provide data sharing agreement.
33(2) Registration of data sharing agreements
Entity must provide additional information to Commissioner upon request.
Entity must provide additional information.
34 Assist Commissioner in relation to annual report
34(1) Assist Commissioner in relation to annual report
Notify Commissioner of data sharing activities and complaints.
34(2) Assist Commissioner in relation to annual report
Must provide information and assistance to the Commissioner.
Obligation to provide information and assistance.
34(3) Assist Commissioner in relation to annual report
Must provide information and assistance.
34(4) Assist Commissioner in relation to annual report
Notify Commissioner within a specified period.
35 Definition of data breach
data-availability-and-transparency-act-2022.pdf, p.72
entity has obligation to hold scheme data
Event prescribed by a data code occurs during the data breach
event prescribed by a data code occurs in relation to the data
Data loss is likely to occur before or at the same time as the event
data is lost in circumstances where there is likely to be unauthorised access to or disclosure of the data
unauthorised access to or disclosure of the data occurs
36 Take steps to mitigate data breach
36(1) Take steps to mitigate data breach
Entity must take steps to mitigate data breach within a specified period.
36(2) Take steps to mitigate data breach
Take reasonable steps to prevent or reduce harm from data breach within a specified period.
Data custodian has a responsibility to prevent harm from data breach.
Take reasonable steps to prevent or reduce harm from data breach within the specified period.
A temporal interval is required for taking action to prevent harm from data breach.
The data custodian must take reasonable steps to prevent or reduce harm within the specified period.
Temporal relationship between actions and consequences
There is a temporal relationship between taking action and preventing harm from data breach.
The data custodian's action to prevent or reduce harm within the specified period is related to the prevention of harm from data breach.
Information about data breach must be spread to entities, groups of entities and things affected by the breach.
The data custodian's action to prevent or reduce harm within the specified period is related to the prevention of harm from data breach and the spread of information about the breach.
Artificial intelligence application in preventing data breach
Artificial intelligence can be applied to prevent or reduce harm from data breach.
The data custodian's action to prevent or reduce harm within the specified period is related to the application of artificial intelligence in preventing data breach.
36(3) Take steps to mitigate data breach
Steps must be taken after a data breach occurs.
37 Interaction with Part IIIC of the Privacy Act 1988 (notification of
data-availability-and-transparency-act-2022.pdf, p.73
37(1) Interaction with Part IIIC of the Privacy Act 1988 (notification of
Deemed holding of personal information by data custodian
Data custodian has shared the personal information with or through an accredited entity under section 13
The accredited entity holds the personal information
37(2) Interaction with Part IIIC of the Privacy Act 1988 (notification of
Data custodian has responsibilities under Part IIIC of the Privacy Act 1988 (notification of eligible data breaches) in relation to personal information.
Obligation to notify eligible data breaches
Data custodian is required not to do an act that breaches Australian Privacy Principle 11.1
Obligation to comply with Australian Privacy Principle 11.1
Data custodian has responsibilities under Part IIIC of the Privacy Act 1988 and is required not to do an act that breaches Australian Privacy Principle 11.1
Section 15 of the Privacy Act 1988 and Part IIIC of the Privacy Act 1988
Obligation to comply with Australian Privacy Principle 11.1 and responsibilities under Part IIIC of the Privacy Act 1988
Data custodian has responsibilities under Part IIIC of the Privacy Act 1988 (notification of eligible data breaches) in relation to personal information
Obligation to notify eligible data breaches in relation to personal information
37(3) Interaction with Part IIIC of the Privacy Act 1988 (notification of
Accredited entity must notify data breach if suspected or aware
38 Notify Commissioner of non-personal data breach
data-availability-and-transparency-act-2022.pdf, p.75
38(1) Notify Commissioner of non-personal data breach
Notify Commissioner of non-personal data breach
notification in an approved form within a specified period
38(1A) Notify Commissioner of non-personal data breach
Notify Commissioner of non-personal data breach within a specified period.
Notification period starts at the end of the financial year
(b) if there is no period applicable under a data code—as soon as practicable after the end of the financial year in which the breach occurs.
Notification period ends at the start of the next financial year
(a) the period applicable under a data code; or (b) if there is no period applicable under a data code—as soon as practicable after the end of the financial year in which the breach occurs.
Notification must occur within the defined period
38(2) Notify Commissioner of non-personal data breach
Notify Commissioner of non-personal data breach within a certain period
38(3) Notify Commissioner of non-personal data breach
Notify Commissioner of non-personal data breach upon determining likelihood of serious harm.
39 Simplified outline of this Chapter
The Commissioner has obligations to regulate and enforce the data sharing scheme.
data-availability-and-transparency-act-2022.pdf, p.77
The Commissioner is the regulator for the data sharing scheme.
The Commissioner has obligations to regulate and enforce the scheme.
The Commissioner's functions include regulating and enforcing the scheme.
The Commissioner also has the function of regulating and enforcing the scheme, which includes dealing with complaints...
The Commissioner is assisted in the performance of these functions by APS employees during their working hours.
The Commissioner is assisted in the performance of these functions by APS employees in the Department who are made available by the Secretary.
The Commissioner may engage contractors and consultants.
The Commissioner may also engage contractors and consultants.
The Commissioner has the power to engage contractors and consultants.
The Commissioner is assisted by the advice of the National Data Advisory Council.
The Commissioner is also assisted by the advice of the National Data Advisory Council.
The Commissioner has access to the advice of the National Data Advisory Council.
The constitutional basis for the roles of the Commissioner and Council is set out in subsections 42(2) and 61(2).
The Commissioner's role is constitutionally mandated.
40 Commissioner to have regard to objects of Act
The Commissioner must have regard to the objects of this Act.
There is an obligation on the Commissioner to consider the objects of the Act.
Temporal interval during function performance
There is an interval during which the Commissioner performs functions.
41 National Data Commissioner
Establishment of National Data Commissioner
data-availability-and-transparency-act-2022.pdf, p.78
42 Functions
42(1) Functions
42(2) Functions
Commissioner's functions are limited to specific areas.
43 Advice related functions
The Commissioner must provide advice on matters related to the operation of the Act.
44 Guidance related functions
Commissioner's guidance related functions
data-availability-and-transparency-act-2022.pdf, p.79
45 Regulatory functions
45(1) Regulatory functions
Commissioner's regulatory functions regarding data sharing scheme.
45(2) Regulatory functions
Person assisting Commissioner must have necessary skills, qualifications or experience.
45A Education and support related functions
Commissioner's education and support related functions
data-availability-and-transparency-act-2022.pdf, p.80
46 Application of finance law
The Commissioner is an official of the Department for finance law purposes.
The Commissioner is an official of the Department.
47 Staff
47(1) Staff
The Secretary must make available APS employees to assist the Commissioner.
47(2) Staff
APS employee must follow directions of Commissioner and Secretary
48 Contractors
Commissioner may engage persons under written agreement.
data-availability-and-transparency-act-2022.pdf, p.81
49 Consultants
The Commissioner may engage consultants.
50 Delegation by Commissioner
50(1) Delegation by Commissioner
The Commissioner may delegate functions or powers to a staff member.
50(2) Delegation by Commissioner
Delegation of certain functions and powers is prohibited.
51 Independence of Commissioner
Commissioner's discretion in performance/exercise of functions/powers
data-availability-and-transparency-act-2022.pdf, p.82
52 Commissioner not to be sued
Commissioner and employees are not liable for actions taken in good faith.
Commissioner's liability is implied by the absence of a duty to act with care.
Employees' liability is implied by their employment relationship.
Employment relationship implies a duty to act with care.
53 Appointment
data-availability-and-transparency-act-2022.pdf, p.83
53(1) Appointment
The Commissioner must be appointed by the Governor-General.
Must provide information about Commissioner appointment
53(2) Appointment
Qualifications required for appointment to Commissioner position
54 General terms and conditions of appointment
54(1) General terms and conditions of appointment
The Commissioner must hold office for a period not exceeding 5 years.
54(2) General terms and conditions of appointment
The Commissioner must hold office on a full-time basis.
(2) The Commissioner holds office on a full-time basis.
54(3) General terms and conditions of appointment
Terms and conditions of appointment determined by Governor-General
55 Other paid work
Commissioner cannot engage in paid work outside office duties without Minister's approval.
Prohibition on Commissioner engaging in paid work outside office duties.
56 Remuneration
Commissioner must be paid remuneration determined by Remuneration Tribunal or prescribed by rules.
57 Leave of absence
data-availability-and-transparency-act-2022.pdf, p.84
57(1) Leave of absence
Commissioner has recreation leave entitlements determined by the Remuneration Tribunal.
Commissioner has a duty to provide recreation leave entitlements.
57(2) Leave of absence
Grant leave of absence on terms and conditions determined by the Minister.
58 Resignation
58(1) Resignation
The Commissioner must provide a written resignation to the Governor-General.
The Commissioner must provide a written resignation.
58(2) Resignation
Resignation takes effect on specified day
58A Disclosure of interests to Minister
59 Termination of appointment
Termination of appointment under specified conditions
Prohibition of Commissioner's appointment termination
60 Acting appointments
The Minister may appoint a person to act as Commissioner under certain circumstances.
data-availability-and-transparency-act-2022.pdf, p.85
61 Establishment and function of Council
data-availability-and-transparency-act-2022.pdf, p.87
61(1) Establishment and function of Council
Establishes National Data Advisory Council with advisory function.
61(2) Establishment and function of Council
Council may perform certain functions with respect to data sharing and matters incidental to legislative powers.
62 Membership of Council
There is a member appointed by the Commissioner.
63 Appointment of members
data-availability-and-transparency-act-2022.pdf, p.88
63(1) Appointment of members
The Commissioner must appoint members by written instrument.
63(2) Appointment of members
Commissioner must ensure appointed members have qualifications, skills or experience.
Obligation to ensure appointed members have qualifications, skills or experience.
64 Term of appointment
Term of appointment must not exceed 3 years.
65 Remuneration and allowances
65(1) Remuneration and allowances
Member must be paid remuneration determined by Remuneration Tribunal or prescribed by rules.
65(2) Remuneration and allowances
Member must be paid allowances as prescribed by the rules.
65(3) Remuneration and allowances
66 Leave of absence
Grant leave of absence on terms and conditions determined by the Commissioner.
data-availability-and-transparency-act-2022.pdf, p.89
Granting leave of absence is an obligation.
67 Disclosure of interests to Minister or Commissioner
67(1) Disclosure of interests to Minister or Commissioner
Commissioner must disclose interests to Minister
67(2) Disclosure of interests to Minister or Commissioner
Member must disclose interests to Commissioner.
Member has a duty to disclose interests.
68 Disclosure of interests to Council
68(1) Disclosure of interests to Council
Member of Council must disclose interest to meeting.
68(2) Disclosure of interests to Council
Member must disclose interests to Council as soon as possible after knowledge of relevant facts.
Disclosure must occur at a specific point in time.
68(3) Disclosure of interests to Council
Disclosure of interests must be recorded in meeting minutes.
69 Resignation of members
Member must provide written resignation to Commissioner.
Member must provide written resignation.
70 Termination of appointment of members
Termination of appointment of members due to various reasons.
data-availability-and-transparency-act-2022.pdf, p.90
Prohibits termination of appointment for certain reasons.
71 Other terms and conditions of members
Member terms and conditions determined by the Commissioner
Member holds office on specified terms and conditions
72 Procedures
data-availability-and-transparency-act-2022.pdf, p.91
72(1) Procedures
Council must meet at least twice a year.
72(2) Procedures
Council may convene meetings by Commissioner or Chair.
72(3) Procedures
Council must determine its own procedures.
73 Simplified outline of this Chapter
The Commissioner has power to require persons to give information, and has monitoring and investigation powers in relation to certain provisions of this Act.
data-availability-and-transparency-act-2022.pdf, p.92
The Commissioner has power to require persons to give information.
The Commissioner can require persons to give information.
The Commissioner has monitoring and investigation powers in relation to certain provisions of this Act.
The Commissioner may investigate a data scheme entity regardless of whether a complaint has been made within a specified temporal interval.
The Commissioner can transfer matters to a more appropriate agency.
74 Accreditation
data-availability-and-transparency-act-2022.pdf, p.94
74(1) Accreditation
Granting accreditation to an entity that meets criteria.
(a) the entity is an Australian entity and not an excluded entity;
the authority may grant the accreditation applied for.
(c) the authority considers it appropriate, in all the circumstances, to grant the accreditation.
Authority's justification for granting accreditation.
Accreditation propagation through entities.
the accreditation applies to the entity.
74(2) Accreditation
Authority may accredit entity with or without conditions.
Authority has the power to accredit entity.
74(3) Accreditation
Entity must comply with accreditation conditions.
74(4) Accreditation
Entity participation in data sharing scheme poses security concerns.
Prohibits entity participation in data sharing scheme.
75 Notice of accreditation decision
data-availability-and-transparency-act-2022.pdf, p.95
75(1) Notice of accreditation decision
Entity must receive written notice of accreditation decision.
75(2) Notice of accreditation decision
Entity must provide notice of accreditation decision
75(3) Notice of accreditation decision
The notice must set out certain information if accreditation is refused.
76 Application for accreditation
data-availability-and-transparency-act-2022.pdf, p.96
76(1) Application for accreditation
76(2) Application for accreditation
Application requirements for accreditation
77 Criteria for accreditation
77(1) Criteria for accreditation
Entity must have data management and governance policies and practices.
Entity has obligation to have data management and governance policies.
(a) the entity has appropriate data management and governance policies and practices
The entity must have data management and governance policies.
Entity must have data management and governance during its existence.
The entity exists during its data management and governance.
Entity must have data management and governance to ensure privacy and protection.
(b) the entity is able to minimise the risk of unauthorised access, sharing or loss of data
The entity must have data management and governance to ensure privacy and protection.
Entity must be able to manage risks in relation to data.
(c) the entity has the necessary skills and capability to ensure the privacy, protection and appropriate use of data
The entity must be able to manage risks in relation to data.
Entity must have AI capabilities for data management and governance.
(d) any additional criteria prescribed under subsection (2)
The entity must have AI capabilities for data management and governance.
77(1A) Criteria for accreditation
Entity must have necessary policies, practices, skills and capability to perform data services.
Entity must have necessary policies, practices, skills and capability.
77(2) Criteria for accreditation
Minister may consider additional criteria for accreditation
77A General provisions relating to accreditation
data-availability-and-transparency-act-2022.pdf, p.97
77A(1) General provisions relating to accreditation
Entity remains accredited as ADSP until accreditation is cancelled.
Accreditation cancellation marks end of accreditation period
(1) An entity accredited as an ADSP until the accreditation is cancelled.
77A(2) General provisions relating to accreditation
Entity remains accredited until accreditation is cancelled.
(2) An entity accredited as an accredited user...
The entity remains accredited until the accreditation is cancelled.
Temporal relationship between accreditation and cancellation
The accreditation overlaps with the cancellation until the cancellation occurs.
If the accreditation is suspended, the entity remains accredited until cancellation.
The accreditation status spreads to all related entities until cancellation.
The system can infer that the entity remains accredited until cancellation.
77A(3) General provisions relating to accreditation
(a) under Part 5.2, the entity may be accredited with conditions of accreditation and conditions of accreditation may be imposed, varied or removed while the entity is accredited;
(3) Accreditation is granted on the basis that: (a) ...
Accreditation suspension and cancellation
(b) the accreditation may be suspended or cancelled under section 81;
(3) Accreditation is granted on the basis that: (b) ...
(c) the accreditation may be cancelled, revoked, terminated or varied, and conditions of accreditation may be imposed, varied or removed, by or under later legislation;
(3) Accreditation is granted on the basis that: (c) ...
(d) no compensation is payable in any of those events.
(3) Accreditation is granted on the basis that: (d) ...
Accreditation is granted on the basis that: ...
77B Conditions of accreditation
data-availability-and-transparency-act-2022.pdf, p.98
77B(1) Conditions of accreditation
Entities must comply with accreditation conditions.
77B(2) Conditions of accreditation
May require or permit an entity to do something, or prevent it from doing something.
77B(3) Conditions of accreditation
Examples of conditions that may be prescribed or imposed
78 Imposition, variation or removal of conditions of accreditation by
78(1) Imposition, variation or removal of conditions of accreditation by
Accreditation authority may impose conditions of accreditation on an entity.
Authority has the power to impose conditions.
78(2) Imposition, variation or removal of conditions of accreditation by
Consider whether to cancel or suspend accreditation, or impose conditions on an entity.
78(3) Imposition, variation or removal of conditions of accreditation by
Entity must comply with subsection (2) in both capacities.
78(4) Imposition, variation or removal of conditions of accreditation by
Authority may vary or remove accreditation conditions.
Authority has permission to modify accreditation conditions.
78(5) Imposition, variation or removal of conditions of accreditation by
Minister must notify Commissioner of decision to impose, vary or remove condition of accreditation.
Minister has a duty to notify Commissioner.
79 Notice before decision relating to conditions of accreditation
Accreditation authority must not make certain decisions without notice.
data-availability-and-transparency-act-2022.pdf, p.99
80 Notice of conditions
data-availability-and-transparency-act-2022.pdf, p.100
80(1) Notice of conditions
Accredited entity must receive written notice of decision.
80(2) Notice of conditions
Entity must provide notice of conditions, including review rights.
81 Suspension or cancellation of accreditation
data-availability-and-transparency-act-2022.pdf, p.102
81(1) Suspension or cancellation of accreditation
Suspension or cancellation of accreditation for certain circumstances.
Prohibition of accreditation suspension or cancellation
Reasonable satisfaction that entity does not meet criteria
Suspension or cancellation of accreditation is prohibited
81(2) Suspension or cancellation of accreditation
Suspension of accreditation if reasonable suspicion of breach.
Prohibits suspension without reasonable suspicion.
81(3) Suspension or cancellation of accreditation
Cancellation of accreditation if breach determined
Prohibits cancellation without breach determination
Commissioner determines breach under subsection 102(1)
Accreditation authority may not cancel accreditation
Defines temporal interval for breach determination
Commissioner determines under subsection 102(1)
Accreditation authority may cancel accreditation within specified time frame
Defines temporal interval for cancellation of accreditation
Entity has breached this Act or a data sharing agreement
Accreditation authority may cancel accreditation after specified time frame
Diffuses information about accreditation cancellation to relevant parties
Accreditation authority notifies relevant parties of cancellation decision
Applies AI reasoning to accreditation cancellation decisions
Accreditation authority uses AI to evaluate breach determination and cancel accreditation if necessary
81(4) Suspension or cancellation of accreditation
Minister may cancel accreditation if entity breaches Act or data sharing agreement.
Prohibits cancellation of accreditation without reasonable belief of breach.
(4) The Minister may cancel the accreditation...
...if the Minister reasonably believes that the entity has breached this Act or a data sharing agreement.
Defines temporal interval for cancellation of accreditation.
Diffuses responsibility for cancellation of accreditation to Minister.
Involves reasoning about cancellation of accreditation based on breach.
Validates cancellation of accreditation against data sharing agreements.
81(5) Suspension or cancellation of accreditation
Consider entity's conduct in multiple capacities when evaluating accreditation.
81(6) Suspension or cancellation of accreditation
Consider whether to suspend or cancel accreditation on a ground
81(7) Suspension or cancellation of accreditation
Grounds for suspending or cancelling accreditation must be considered.
Prohibition of suspension or cancellation
81(8) Suspension or cancellation of accreditation
Suspension of accreditation if renewal is not applied for within 5 years.
Prohibits suspension of accreditation if renewal is not applied for within 5 years.
82 Notice before decision about suspension or cancellation
data-availability-and-transparency-act-2022.pdf, p.104
82(1) Notice before decision about suspension or cancellation
Authority must give written notice before suspending or cancelling accreditation.
82(2) Notice before decision about suspension or cancellation
Accredited entity must provide written statement showing cause why accreditation should not be suspended or cancelled.
Accredited entity must provide written statement.
82(3) Notice before decision about suspension or cancellation
The accreditation authority must consider a written statement before making a decision.
The accreditation authority must consider the statement.
The accreditation authority has a duty to consider written statements.
The accreditation authority MUST consider the statement.
The accreditation authority must make a decision based on consideration of the statement.
The accreditation authority has a duty to make decisions based on written statements.
The accreditation authority MUST consider the statement before making a decision.
The statement is considered within a specific time frame.
The accreditation authority considers written statements within a specified period.
The statement falls within the accreditation authority's consideration period.
The accreditation authority has a duty to consider the statement.
The accreditation authority is required to make decisions based on written statements.
82(4) Notice before decision about suspension or cancellation
Accreditation authority may decide not to give entity a notice under subsection (2) of this section.
83 Notice of suspension or cancellation
data-availability-and-transparency-act-2022.pdf, p.105
83(1) Notice of suspension or cancellation
Entity must receive written notice of accreditation suspension or cancellation.
83(2) Notice of suspension or cancellation
The accreditation authority must give notice as soon as practicable after making a decision.
The accreditation authority must give notice.
83(3) Notice of suspension or cancellation
Notice of suspension or cancellation requirements
Circumstance, period of suspension (if applicable)
83A Lifting of suspension
Entity must lift suspension upon request from accreditation authority if grounds no longer exist.
data-availability-and-transparency-act-2022.pdf, p.106
Entity must lift suspension upon request from accreditation authority.
84 Renewal
data-availability-and-transparency-act-2022.pdf, p.107
84(1) Renewal
The Commissioner must grant renewal if certain conditions are met.
(1) If an entity applies for the renewal of the entity’s accreditation...
(c) the Commissioner considers it appropriate, in all the circumstances, to grant the renewal.
The renewal is granted if the Commissioner considers it appropriate.
The entity meets the criteria for accreditation under section 77.
(a) the entity is an Australian entity and not an excluded entity; (b) the Commissioner is satisfied that the entity meets the criteria for accreditation under section 77;
The entity is classified as an Australian entity.
84(2) Renewal
Commissioner may renew accreditation with or without conditions.
Commissioner has the power to renew accreditation.
85 Notice of renewal decision
data-availability-and-transparency-act-2022.pdf, p.108
85(1) Notice of renewal decision
The Commissioner must give written notice of the decision.
85(2) Notice of renewal decision
Notice of renewal decision must provide specific information.
(a) the 5-year period for which the renewed accreditation is in effect; (b) if the Commissioner decides to grant the renewal with conditions of accreditation imposed by the Commissioner...
Entity must provide notice of renewal decision.
(2) If the Commissioner grants the entity the renewal...
Notice of renewal decision contains temporal information.
85(3) Notice of renewal decision
Entity's accreditation will be suspended or cancelled under section 81.
(a) the reason for the refusal; (b) that the entity’s accreditation will be suspended or cancelled under section 81; (c) the entity’s review rights under Part 6.2.
Prohibits the Commissioner from renewing accreditation without notice.
(3) If the Commissioner refuses to renew the entity’s accreditation, the notice must set out...
Defines a temporal interval for notice of refusal.
Implies that the notice must provide certain information.
Diffuses the requirement for notice of refusal.
Recognizes the need for notice of refusal.
85A Application for renewal
data-availability-and-transparency-act-2022.pdf, p.109
85A(1) Application for renewal
Entity must apply for renewal of accreditation.
85A(2) Application for renewal
86 Rules relating to the accreditation framework
Rules for accreditation framework procedures and requirements
data-availability-and-transparency-act-2022.pdf, p.110
Obligation to provide rules for accreditation framework
87 Further information or evidence
87(1) Further information or evidence
Request for further information or evidence from an entity.
87(2) Further information or evidence
Entity must provide information or evidence upon request.
88 Making scheme complaints
data-availability-and-transparency-act-2022.pdf, p.111
88(1) Making scheme complaints
Complainant may complain to Commissioner about breach of Act or data sharing agreement
88(2) Making scheme complaints
Entity can complain to Commissioner if reasonable suspicion exists
88(3) Making scheme complaints
(a) specify the respondent; (b) be made in an approved form; (c) meet any requirements prescribed by a data code
(c) meet any requirements prescribed by a data code
89 Respondents
89(1) Respondents
Identify respondent for Commonwealth body complaints
(a) if the Commonwealth body is a body corporate or an individual—the Commonwealth body;
89(2) Respondents
The respondent is the entity about which the complaint is made.
If the complaint is about an entity that is not a Commonwealth body, the respondent is the entity.
The respondent is the entity if it is not a Commonwealth body.
90 Communicating with complainant
data-availability-and-transparency-act-2022.pdf, p.112
90(1) Communicating with complainant
Commissioner must provide written notice to complainant within 30 days.
90(2) Communicating with complainant
Request for further information from complainant
90(3) Communicating with complainant
Complainant must comply with Commissioner's request within 30 days.
Complainant has an obligation to comply with the Commissioner's request.
90(4) Communicating with complainant
Commissioner does not need to comply with subsection (1) if notice is given before last day.
Commissioner exempted from complying with subsection (1)
Notice given before last day overlaps with subsection (1)
Last day for complying with subsection (1)
91 Dealing with complaints
91(1) Dealing with complaints
Commissioner must make preliminary inquiries and consider conciliation or external dispute resolution.
91(2) Dealing with complaints
Exemption from dealing with complaints under certain conditions.
92 Grounds for not dealing with complaints
data-availability-and-transparency-act-2022.pdf, p.113
The Commissioner may not deal with the complaint if...
93 Admissibility of things said or done in conciliation
Evidence of things said or done in conciliation is not admissible unless agreed upon by parties or related to an offence.
data-availability-and-transparency-act-2022.pdf, p.114
Prohibits admissibility of conciliation evidence unless agreed upon by parties.
94 Making general complaints
A person may complain about any matter relating to the administration or operation of the data sharing scheme.
data-availability-and-transparency-act-2022.pdf, p.115
95 Dealing with complaints
The Commissioner may deal with a complaint by doing certain actions.
The Commissioner must deal with the complaint.
96 Admissibility of things said or done in conciliation
Evidence of things said or done in conciliation is not admissible unless agreed upon by parties or related to committing an offence.
data-availability-and-transparency-act-2022.pdf, p.116
Prohibits admissibility of conciliation evidence unless agreed upon.
99 Assessments
data-availability-and-transparency-act-2022.pdf, p.117
99(1) Assessments
The Commissioner may assess whether conduct is consistent with the requirements of this Act.
99(2) Assessments
The Commissioner may conduct an assessment in any manner the Commissioner considers appropriate.
The Commissioner has a duty to conduct an assessment.
99(3) Assessments
Commissioner may obtain information from any person and make inquiries.
Commissioner has the power to obtain information.
Person must provide information if requested.
Inquiries are possible but not guaranteed.
99(4) Assessments
Commissioner must consider submissions made in response to invitation.
100 Notices of assessment
100(1) Notices of assessment
The Commissioner must give an entity written notice before starting and on completion of an assessment.
100(2) Notices of assessment
Notice must specify intended scope of assessment
Must provide notice with specified scope
101 Investigations
The Commissioner must investigate conduct engaged in by an entity.
102 Determination on completion of investigation
Commissioner must make written determination on entity's breach of Act or data sharing agreement.
Written determination with reasons and proposed action
data-availability-and-transparency-act-2022.pdf, p.119
Entity must comply with Commissioner's written determination
103 Notices relating to investigation
data-availability-and-transparency-act-2022.pdf, p.120
103(1) Notices relating to investigation
The Commissioner must give an entity written notice before starting an investigation.
The Commissioner must give an entity written notice.
103(2) Notices relating to investigation
103(3) Notices relating to investigation
Must provide determination and review rights notice to entity
Obligation to provide determination and review rights notice
103A Recommendations
Commissioner may give written recommendations about actions an entity should take.
data-availability-and-transparency-act-2022.pdf, p.121
104 Power to require information and documents
data-availability-and-transparency-act-2022.pdf, p.122
104(1) Power to require information and documents
Commissioner may require person to provide information or document.
104(2) Power to require information and documents
Must comply with notice from investigation under section 101.
104(3) Power to require information and documents
Failure to comply with a notice results in imprisonment.
...and (c) the person fails to comply with the notice.
Prohibition on failing to comply with a notice.
Penalty for failing to comply with a notice.
Temporal interval between receiving a notice and failing to comply.
Temporal relationship between receiving a notice and failing to comply.
104(4) Power to require information and documents
Commissioner may take possession of document for investigation purposes.
105 Legal professional privilege
data-availability-and-transparency-act-2022.pdf, p.123
105(1) Legal professional privilege
Comply with notice under section 104 despite legal professional privilege
105(2) Legal professional privilege
Information and document production cannot be used as evidence in civil or criminal proceedings.
Prohibits the use of information and document production as evidence.
105(3) Legal professional privilege
Claim of legal professional privilege is unaffected by non-compliance with notice.
105(4) Legal professional privilege
Commissioner must withdraw notice unless satisfied it is reasonably necessary and proportionate to investigation.
106 Limits on power to require information and documents
data-availability-and-transparency-act-2022.pdf, p.124
106(1) Limits on power to require information and documents
No notice can require information or documents from an excluded entity.
Prohibition of requiring information or documents from an excluded entity.
106(2) Limits on power to require information and documents
No requirement for information or documents beyond a certificate given to the Commissioner.
Prohibits requiring information or documents beyond a certificate.
106(3) Limits on power to require information and documents
Prohibition on disclosure of certain information
(3) The Attorney-General may give the Commissioner a certificate stating that, in the opinion of the Attorney-General...
Giving information in relation to a specified matter, or giving a specified document, would be contrary to the public interest.
(b) involve the disclosure of communications between a Minister of the Commonwealth and a Minister of a State or Territory,
Disclosing information would be contrary to the public interest.
(d) involve the disclosure of deliberations or advice of the Executive Council;
106(4) Limits on power to require information and documents
No effect on parliamentary privileges and immunities
Excludes effect on parliamentary privileges and immunities
107 Transfer of matters to appropriate authority
Commissioner may transfer matter to another agency or body.
data-availability-and-transparency-act-2022.pdf, p.125
108 Authorisation for Commissioner to disclose and receive
data-availability-and-transparency-act-2022.pdf, p.126
108(1) Authorisation for Commissioner to disclose and receive
Commissioner may disclose information to an agency or body under certain conditions.
108(2) Authorisation for Commissioner to disclose and receive
List of agencies and bodies that can disclose and receive information
Agency or body must include functions that correspond to those of the Information Commissioner
(b) a State body, or a Territory body, whose functions include functions that correspond to those of the Information Commissioner;
Agency or body must include functions that correspond to those of the Commonwealth Ombudsman
(d) a State body, or a Territory body, whose functions include functions that correspond to those of the Commonwealth Ombudsman;
Agency or body must include functions that correspond to those of a person mentioned in paragraph (a), (c), (e) or (f)
(g) a regulatory authority of a foreign country whose functions include functions that correspond to those of a person mentioned in paragraph (a), (c), (e) or (f);
(h) the Australian National Audit Office;
(ka) the Inspector of the National Anti-Corruption Commission;
(l) AUSTRAC (within the meaning of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006);
108(3) Authorisation for Commissioner to disclose and receive
Authorization for Commissioner to receive information
Commissioner has permission to receive information
109 Monitoring powers
Monitoring powers for certain provisions of this Act.
data-availability-and-transparency-act-2022.pdf, p.127
Identifies part of a larger framework for monitoring compliance.
Part 2 of the Regulatory Powers Act creates a framework for monitoring...
110 Investigation powers
data-availability-and-transparency-act-2022.pdf, p.129
110(1) Investigation powers
Subject to investigation under Part 3 of the Regulatory Powers Act
Part of the Regulatory Powers Act framework
110(2) Investigation powers
Commissioner is an authorised applicant and issuing officer.
has jurisdiction in relation to matters arising under this Act
the Commissioner is the relevant chief executive
a court of a State or Territory that has jurisdiction in relation to matters arising under this Act
the Commissioner is an authorised applicant
112 Directions
data-availability-and-transparency-act-2022.pdf, p.130
112(1) Directions
The Commissioner may give a data scheme entity written directions requiring the entity to take or not take specified actions.
The Commissioner requires the entity to take or not take specified actions.
(a) either of the following situations exists:
The direction must be given during an emergency or high risk situation.
(b) for a requirement to take specified actions—it is necessary, to address the situation or prevent it arising again, for the entity to take the actions immediately or as soon as practicable; and
The direction must be given until the situation is addressed.
(c) for a requirement not to take specified actions—the entity is taking the actions or may take them imminently and it is necessary, to address the situation or prevent it arising again, for the entity not to take the actions.
The Commissioner must give a data scheme entity written directions.
(1) The Commissioner may give a data scheme entity a written direction requiring the entity to take, or not to take, specified actions if...
The Commissioner can give a data scheme entity written directions.
112(2) Directions
The Commissioner may give a data scheme entity a written direction requiring the entity to take or not to take specified actions.
The Commissioner must give a written direction.
112(3) Directions
Commissioner may give written direction to accredited entity regarding cancellation of accreditation.
112(4) Directions
Compliance with directions may include providing another entity with access to scheme data.
112(5) Directions
Must comply with a direction given to the entity.
112(6) Directions
Directions made under subsections are not legislative instruments.
Prohibits directions from being considered legislative instruments.
113 Civil penalty provisions
data-availability-and-transparency-act-2022.pdf, p.132
113(1) Civil penalty provisions
Enforce civil penalty provisions under Part 4 of the Regulatory Powers Act.
Prohibits enforcement of civil penalty provisions.
113(2) Civil penalty provisions
No application under section 82 for pecuniary penalty unless Commissioner's opinion of contravention.
113(3) Civil penalty provisions
Commissioner is an authorised applicant in relation to civil penalty provisions.
Commissioner is an authorised applicant.
114 Infringement notices
114(1) Infringement notices
A civil penalty provision of this Act is subject to an infringement notice.
114(2) Infringement notices
Infringement officer cannot issue infringement notice without Commissioner's determination.
Prohibition on issuing infringement notices.
Infringement officer must have Commissioner's opinion to issue notice.
Section 102 of the Regulatory Powers Act sets out Commissioner's opinion on contravention.
Infringement officer cannot give infringement notice without Commissioner's determination.
Section 103 of the Regulatory Powers Act applies only with Commissioner's determination.
114(3) Infringement notices
Commissioner is infringement officer and relevant chief executive.
114(4) Infringement notices
Single infringement notice allowed for multiple alleged contraventions.
Allows a single infringement notice for multiple alleged contraventions.
115 Enforceable undertakings
Enforceable provisions under Part 6 of the Regulatory Powers Act.
data-availability-and-transparency-act-2022.pdf, p.133
116 Injunctions
data-availability-and-transparency-act-2022.pdf, p.134
116(1) Injunctions
Enforceable provisions under Part 7 of the Regulatory Powers Act
Provisions are enforceable under Part 7 of the Regulatory Powers Act
116(2) Injunctions
No injunction under section 121 unless Commissioner's opinion determines contravention.
No injunction unless Commissioner's opinion determines contravention.
116(3) Injunctions
Commissioner is an authorised person and relevant courts are specified.
117 Simplified outline of this Chapter
Administrative decisions are reviewable by the Administrative Review Tribunal.
data-availability-and-transparency-act-2022.pdf, p.136
118 Reviewable decisions
data-availability-and-transparency-act-2022.pdf, p.137
118(1) Reviewable decisions
Decisions made by the Commissioner are reviewable.
118(2) Reviewable decisions
Decisions made by Minister are reviewable decisions.
(2) Each of the following decisions made by the Minister...
119 Applications for reconsideration of decisions made by delegates
data-availability-and-transparency-act-2022.pdf, p.138
119(1) Applications for reconsideration of decisions made by delegates
Application for reconsideration of a reviewable decision made by a delegate.
119(2) Applications for reconsideration of decisions made by delegates
Application must set out reasons for reconsideration of decisions made by delegates.
Application must be in an approved form.
119(3) Applications for reconsideration of decisions made by delegates
Application fee must be paid for reconsideration to be valid.
120 Reconsideration by reviewer
120(1) Reconsideration by reviewer
Reviewer must reconsider decision and take one of three actions.
120(2) Reconsideration by reviewer
The reviewer's decision on reconsideration has effect as if it had been made under the original provision.
(2) The reviewer's decision on reconsideration of a decision has effect as if it had been made under the provision under which the original decision was made.
(2) The reviewer’s decision on reconsideration of a decision has effect as if it had been made under the provision under which the original decision was made.
The reviewer's decision on reconsideration occurs during the reconsideration period.
The reviewer's decision on reconsideration is diffused during the reconsideration period.
The reviewer's decision on reconsideration is cognitively processed during the reconsideration period.
120(3) Reconsideration by reviewer
Reviewer must give applicant a written notice stating decision on reconsideration.
The reviewer must give the applicant a written notice...
120(4) Reconsideration by reviewer
Reviewer must provide written statement of reasons within 28 days.
120(5) Reconsideration by reviewer
Delegate must not have been involved in making the reviewable decision and hold a position of at least the same level as the delegate who made the reviewable decision.
121 Deadline for reconsideration
data-availability-and-transparency-act-2022.pdf, p.139
121(1) Deadline for reconsideration
Deadline for reconsideration of a decision
121(2) Deadline for reconsideration
Reviewer must inform applicant of decision within 90 days
122 Review by the Administrative Review Tribunal
Applications may be made to review a reviewable decision under certain circumstances.
123 Designated individuals and designation
data-availability-and-transparency-act-2022.pdf, p.140
123(1) Designated individuals and designation
Specifies individuals who are designated individuals for entities.
For the purposes of this Act, the following table specifies individuals who are designated individuals for entities.
The designation applies to these individuals only
Specifies temporal intervals for the designation
the individual’s capacity as a statutory officeholder
The designation is effective until the individual ceases to hold office
Defines the relationship between entities and designations
Designated individuals and designation Item
The designation is a property of the individual
123(2) Designated individuals and designation
Individuals must have a designation if certain conditions apply.
Designation specified for each applicable item
123(3) Designated individuals and designation
Contract must be approved by data sharing agreement for accreditation.
Contract has approval from data sharing agreement.
124 Extension of authorisations to share, collect or use data
data-availability-and-transparency-act-2022.pdf, p.141
124(1) Extension of authorisations to share, collect or use data
Authorises designated individual to engage in conduct within scope of designation.
124(2) Extension of authorisations to share, collect or use data
Exempts conduct of individuals from subsection (1) if certain conditions are met
124(3) Extension of authorisations to share, collect or use data
Authorises conduct within approved contract scope
124(4) Extension of authorisations to share, collect or use data
No effect on conduct of a body corporate if conditions of accreditation apply
125 Other things an entity may or must do under the data sharing
data-availability-and-transparency-act-2022.pdf, p.142
125(1) Other things an entity may or must do under the data sharing
Entity may delegate task to designated individual.
125(2) Other things an entity may or must do under the data sharing
125A Contraventions by entities of civil penalty provisions and other
125A(1) Contraventions by entities of civil penalty provisions and other
Entity must establish state of mind for conduct within scope of designation or approved contract.
Establishing state of mind is sufficient to determine entity's breach of Act.
125A(2) Contraventions by entities of civil penalty provisions and other
Government entity bears evidential burden to prove reasonable precautions were taken.
Government entity has an obligation to prove reasonable precautions were taken.
125A(3) Contraventions by entities of civil penalty provisions and other
Immunity from personal liability for contraventions of civil penalty provisions attributed to government entities.
Government entity liable for contravention
125A(4) Contraventions by entities of civil penalty provisions and other
125A(5) Contraventions by entities of civil penalty provisions and other
Section 97 of the Regulatory Powers Act does not apply to a Commonwealth body.
Excludes application of Section 97 to a Commonwealth body.
125A(6) Contraventions by entities of civil penalty provisions and other
No application of subsection (1) in relation to determining contravention by a non-Commonwealth body corporate.
125B Offences by entities against this Act
Establishing state of mind for entities committing offences
data-availability-and-transparency-act-2022.pdf, p.144
126 Data codes
data-availability-and-transparency-act-2022.pdf, p.145
126(1) Data codes
Commissioner may make codes of practice about data sharing scheme.
126(2) Data codes
Sets out how definitions are to be applied or complied with
126(2A) Data codes
Commissioner must create data codes about specific privacy protections.
126(2B) Data codes
Must deal with consent by individuals to the sharing of their personal information.
126(2C) Data codes
Mandatory data code for purpose-specific privacy protections in section 16B
127 Guidelines
data-availability-and-transparency-act-2022.pdf, p.146
127(1) Guidelines
The Commissioner must make written guidelines.
127(2) Guidelines
Guidelines for data sharing scheme may include principles and processes relating to various aspects.
127(3) Guidelines
Guidelines inconsistent with regulations, rules or data codes have no effect to the extent of the inconsistency.
128 Register of ADSPs
data-availability-and-transparency-act-2022.pdf, p.147
128(1) Register of ADSPs
128(2) Register of ADSPs
Commissioner must include certain details in the publicly accessible part of the register for each ADSP.
Commissioner must include certain details
128(3) Register of ADSPs
Rules may prescribe circumstances under which certain details must not be included in the publicly accessible part of the register.
128(4) Register of ADSPs
Commissioner must include details in non-public part of register.
Contains details within a specific time frame
Details are contained within the register at some point in time
Details are disseminated to others through the register
Artificial intelligence system processes details in the register
128(5) Register of ADSPs
The register may be maintained in any form the Commissioner considers appropriate.
128(6) Register of ADSPs
The register is not a legislative instrument.
129 Register of accredited users
data-availability-and-transparency-act-2022.pdf, p.148
129(1) Register of accredited users
The Commissioner must maintain a register of accredited users.
129(2) Register of accredited users
The Commissioner must include certain details in the publicly accessible part of the register for each accredited user.
The Commissioner must include certain details.
129(3) Register of accredited users
Exemptions from public disclosure of register details
129(4) Register of accredited users
Commissioner must include details in non-publicly accessible register part.
(4) The Commissioner must include in the part of the register that is not publicly accessible any details:
Includes details implies non-publicly accessible register part
Details spread to non-publicly accessible register part
Requires inclusion of details in non-publicly accessible register part
129(5) Register of accredited users
The Commissioner may maintain the register in any form.
129(6) Register of accredited users
130 Register of data sharing agreements
130(1) Register of data sharing agreements
Maintain a register of data sharing agreements.
130(2) Register of data sharing agreements
The Commissioner must include specific details in the register of data sharing agreements.
The Commissioner must include specific details.
131 Recognition of external dispute resolution schemes
data-availability-and-transparency-act-2022.pdf, p.150
131(1) Recognition of external dispute resolution schemes
Commissioner must recognise external dispute resolution schemes.
(1) The Commissioner may, by written notice...
Classification of external dispute resolution schemes
(a) a data scheme entity or a class of data scheme entities;
131(2) Recognition of external dispute resolution schemes
Commissioner must consider certain aspects when recognizing external dispute resolution schemes.
131(3) Recognition of external dispute resolution schemes
The Commissioner may specify a period for recognition of an external dispute resolution scheme and make it subject to conditions.
131(4) Recognition of external dispute resolution schemes
A notice under subsection (1) is not a legislative instrument.
132 Approved forms
Commissioner may approve forms for data sharing scheme
data-availability-and-transparency-act-2022.pdf, p.151
133 Rules
133(1) Rules
The Minister may make rules by legislative instrument.
133(2) Rules
Rules cannot create an offence or civil penalty, provide powers of arrest or detention, impose a tax, or set an amount to be appropriated from the Consolidated Revenue Fund.
Prohibition on creating an offence or civil penalty
Rules may not create an offence or civil penalty
An offence or civil penalty cannot be created by the rules
Prohibition on providing powers of arrest or detention
Rules may not provide powers of arrest or detention
Arrest or detention cannot be provided by the rules
Prohibition on setting an amount to be appropriated from the Consolidated Revenue Fund
Rules may not set an amount to be appropriated from the Consolidated Revenue Fund
An amount to be appropriated from the Consolidated Revenue Fund cannot be set by the rules
134 Regulations
Regulations may be prescribed by the Governor-General.
data-availability-and-transparency-act-2022.pdf, p.152
135 Disclosure of scheme data in relation to information-gathering
Data scheme entities must not provide access to scheme data unless authorised.
data-availability-and-transparency-act-2022.pdf, p.153
Prohibition of providing access to scheme data.
135A Data held by National Archives of Australia
Data custodian remains responsible for data until open access period starts.
Data custodian transfers data to National Archives.
Data custodian remains responsible for data.
136 Geographical jurisdiction of civil penalty provisions and
data-availability-and-transparency-act-2022.pdf, p.154
136(1) Geographical jurisdiction of civil penalty provisions and
A person does not contravene a civil penalty provision unless the conduct occurs wholly or partly in Australia, on board an Australian aircraft or ship, or outside Australia and is an Australian entity, citizen, or permanent resident.
Obligation to comply with the Act's civil penalty provisions.
(1) A person does not contravene a civil penalty provision of this Act...
unless at least one of the following paragraphs applies in relation to the conduct constituting the alleged contravention or offence:
Temporal relation between conduct and geographical location.
(a) the conduct, or a result of the conduct, occurs wholly or partly in Australia...
or (b) for conduct alleged to constitute an ancillary contravention—
Recurring trace between conduct and geographical location.
(d) the conduct occurs wholly outside Australia and the person engaging in the conduct is an Australian entity, an Australian citizen or a permanent resident of Australia.
136(2) Geographical jurisdiction of civil penalty provisions and
Exemption from civil penalty for conduct outside Australia
(2) Despite subsection (1), a person does not contravene a civil penalty provision of this Act...
...if the conduct constituting the alleged contravention or offence occurs wholly in a foreign country...
(b) the conduct constituting the alleged contravention or offence occurs wholly in a foreign country, but not on board an Australian aircraft or Australian ship...
...if the person is not an Australian entity, an Australian citizen or a permanent resident of Australia...
(d) there is not in force, in the foreign country or the part of the foreign country where the conduct constituting the alleged contravention or offence occurred, a law creating a pecuniary or criminal penalty for conduct corresponding to the conduct constituting the alleged contravention or offence.
136(3) Geographical jurisdiction of civil penalty provisions and
Exemption from civil penalty for conduct occurring in a foreign country
Exempts from civil penalty for conduct occurring in a foreign country
(3) Despite subsection (1), a person does not contravene a civil penalty provision of this Act...
(b) for conduct constituting an alleged contravention—the conduct constituting the primary contravention to which the alleged contravention relates, or a result of that conduct, occurs, or would have occurred, wholly in a foreign country,
(a) the alleged contravention or offence is an ancillary contravention or ancillary offence;
137 Authorised officers and individuals authorised to do particular
Specifies individuals authorized to perform tasks on behalf of entities.
data-availability-and-transparency-act-2022.pdf, p.157
Individuals have authorisation to perform tasks.
137A Delegation by Minister
data-availability-and-transparency-act-2022.pdf, p.160
137A(1) Delegation by Minister
The Minister may delegate powers to the Commissioner.
137A(2) Delegation by Minister
Must comply with written directions of the Minister when exercising a delegated power.
138 Annual report
138(1) Annual report
The Commissioner must prepare and give a report to the Minister.
Annual report on activities during the financial year
138(2) Annual report
138(3) Annual report
The Commissioner may include additional information in the annual report.
138(4) Annual report
Annual report must be given to Minister by a certain date.
139 Charging of fees by Commissioner
Fees may be prescribed by rules for services provided or on behalf of the Commissioner.
data-availability-and-transparency-act-2022.pdf, p.161
140 Charging of fees by data scheme entities
data-availability-and-transparency-act-2022.pdf, p.162
140(1) Charging of fees by data scheme entities
Data custodian may charge fees to accredited entity for services performed.
140(2) Charging of fees by data scheme entities
Data custodian must charge fees in accordance with Australian Government policies.
140(3) Charging of fees by data scheme entities
Accredited entities can charge fees for services performed in relation to the data sharing scheme.
Allows accredited entities to charge fees
141 Commonwealth not liable to pay a fee
141(1) Commonwealth not liable to pay a fee
The Commonwealth is not liable to pay a fee, but it should be notionally liable.
141(2) Commonwealth not liable to pay a fee
The Finance Minister may give written directions for carrying out or giving effect to subsection (1)
141(3) Commonwealth not liable to pay a fee
Must comply with directions despite other laws.
Directions have effect despite other laws.
141(4) Commonwealth not liable to pay a fee
Commonwealth entity cannot be made liable to taxation by a Commonwealth law.
Cannot impose liability on Commonwealth entity
Commonwealth entity is included in the definition of Commonwealth
142 Periodic reviews of operation of Act
data-availability-and-transparency-act-2022.pdf, p.163
142(1) Periodic reviews of operation of Act
Minister must undertake periodic reviews of Act operation.
142(2) Periodic reviews of operation of Act
142(3) Periodic reviews of operation of Act
Combined reviews must be completed within a specified period.
142(4) Periodic reviews of operation of Act
Minister must prepare written report after review completion
143 Sunset of the data sharing scheme
data-availability-and-transparency-act-2022.pdf, p.164
143(1) Sunset of the data sharing scheme
Ceases effect at sunset day five years after commencement.
143(2) Sunset of the data sharing scheme
Regulations may be made under section 134 for the purposes of subsection (3) during a specific period.
143(3) Sunset of the data sharing scheme
Prescribes transitional provisions for scheme data ceasing to have effect
143(4) Sunset of the data sharing scheme
Continuation of certain provisions after sunset day
143(5) Sunset of the data sharing scheme
The Commissioner may give a written direction to entities regarding actions to take or not take.
143(6) Sunset of the data sharing scheme
Failure to comply with a direction may result in offences or civil penalties.
Offences or civil penalties may be imposed.
143(7) Sunset of the data sharing scheme
Penalties for offences against the regulations
...for offences against the regulations;
Penalties apply to a specific temporal interval
143(8) Sunset of the data sharing scheme
Regulations cannot allow data sharing after sunset day.
Prohibits regulations allowing data sharing
143(9) Sunset of the data sharing scheme
Repeals legislative instruments made under this Act on the first anniversary of the sunset day.
Prohibits legislative instruments from being in force after the sunset day.
States that all legislative instruments made under this Act are repealed on the first anniversary of the sunset day.
31 Mar
data-availability-and-transparency-act-2022.pdf, p.169
Consequential and Transitional Provisions
12 Dec
1 July 2023 (s 2(1)
Statute Law Amendment (Prescribed Forms and Other Updates) Act 2023
20 Sept
Conditional commencement of the Administrative Review Tribunal (Consequential and Transitional Provisions No. 1) Act, 2024.
31 May
Conditional commencement of Privacy and Other Legislation Amendment Act 2024
Temporal relationship between commencement and amendment act
10 Dec
Amendment history for Data Availability and Transparency Act 2022