NSW government told to polish data sharing laws

The NSW government must strengthen data sharing laws to make them easier for agencies to navigate, enabling the creation of “high value” datasets, a review has found.

The review of the Data Sharing (Government Sector) Act 2015, tabled in state parliament last week, found that amendments were needed to maximise use of the legislation as a tool for data sharing.

It makes 14 recommendations to update the legislation introduced to reform cross-agency data sharing at a time when data was largely siloed and give the Data Analytics Centre “legislative teeth”.

The review – which took into account five written submissions – found the Act’s policy objectives remain valid, with data sharing and analytics now considered “more important than ever”.

“Linked datasets and data insights derived from them are increasingly viewed as critical government assets and digital infrastructure,” the report from the Department of Customer Service [pdf] said.

But during the review, the government heard greater clarity and an update to how the Act operates was needed to “fully deliver on [its] underlying policy objectives… and enhance data sharing”.

“Several stakeholders highlighted operational challenges which they felt have been barriers to the timely and effective sharing of data under the Act,” the report said.

“This has at time frustrated objective 3 (C) of the Act – to facilitate the expeditious sharing of government sector data with the DAC or between other government sector agencies.”

This was particularly true of instances “where data analytics and insights have required individual determinations under NSW privacy legislation” due to “complex interdependencies”, it said.

Agencies that responded to the review also said there was a lack of awareness of the Act and that when sharing did occur, alternative mechanisms were used because of a lack of clarity.

“Significant operational and culture barriers” to data sharing were similarly cited, made worse by the limited guidance on ways to address them.

The review found there were opportunities to “streamline how the Act intersects with [other] privacy legislation”, as well as update and strengthen policy guidelines and data safeguards.

But it said any changes to the Act or other privacy legislation would require “considerable” work to be undertaken in consultation with the Privacy Commissioner.

Specific recommendations include amending the Act to “enable de-identified data insights to be on-shared by the agency that performs the analytics function” if the owner of the data agrees.

The agency must also have had the opportunity to verify the accuracy of the data, preferably in partnership with the DAC, know where the data will be used and have access to any insights.

The report also recommended that a “standardised framework… to guide the creation of de-identified linked datasets” in a similar way to the Victorian government’s data sharing framework be developed.

It said the framework should help create a “high trust environment for record linkage and data sharing” by referencing the technical tools and capabilities available to manage information security and privacy.

The review has similarly called for additional “centralised linked datasets” like the human services dataset and other “high value datasets” to improve visibility of existing data and reduce duplication.

“Linked datasets and the data insights derived from them are increasingly viewed as critical government assets and digital infrastructure,” the report said.

“Like all government infrastructure, these assets will require careful management and maintenance over time.”

The review recommended amending the Act to “specifically recognise data sharing with the Commonwealth government and other state and territory governments is lawful and possible”.

It follows agreement by federal, state and territory leaders at national cabinet earlier this year to “share data across jurisdictions as a default position”, granted privacy standards are met.

The federal government has also developed its own legislation in the form of the Data Availability and Transparency Bill, though this remains before parliament, awaiting recommended changes.

Other recommendations include:

• Standard data sharing agreements between agencies to improve the efficiency of data sharing and reduce duplication of effort, costs and delays in drafting ad-hoc agreements
• Clarifying data sharing functions across government to overcome a perception that the Act only applied to the DAC and ensure it is used to its full potential and by agencies
• “Explicitly enabling” agencies to share of personal information during emergencies like natural disasters
• Clarifying that private sector data provided to agencies can be shared across the government as long as contract and commercial-in-confidence considerations are taken into account