On 1 May 2018, the Australian Government released its much-anticipated response to the Productivity Commission’s 2017 Data Availability and Use inquiry (see summary here). In its response, the Government has outlined that it will introduce legislative and governance measures to improve Australia’s ability to drive social and economic benefits from data while balancing the protection of individuals’ privacy. The new measures seek to both address consumer data usage, and facilitate the release and sharing of government data.
The Government has accepted many of the Productivity Commission’s recommendations, including:
- a Consumer Data Right as a competition and consumer measure allowing consumers to access data collected about themselves and to control how this data is used, or transferred to third parties
- a legislative and governance framework to enable data availability and use which includes:
- the establishment of the Office of the National Data Commissioner to oversee and monitor the integrity of Australia’s data system; and
- the new Data Sharing and Release Act (DSR Act) which will establish Accredited Data Authorities (ADAs) and define high-value designated datasets for public sharing.
The Government will not adopt the Productivity Commission’s recommendation that the new laws amend secrecy provisions governing particularly sensitive data relating to national security and law enforcement.
As confirmed in the Federal Budget 2018-19, the Government has committed $65 million over the next four years to the introduction of these measures.
Overview of the Productivity Commission inquiry
In 2016, the Productivity Commission launched an inquiry into the risks, benefits and costs of options for improving the availability and use of data in Australia. In its final report released on 8 May 2017, the Productivity Commission highlighted a number of key recommendations, namely:
- a new comprehensive right for consumers and small/medium businesses
- a new Data Sharing and Release Act
- a new National Data Custodian
- the designation of National Interest Datasets
- the designation of sectoral Accredited Release Authorities, and
- streamlining of ethics committee approval processes.
For a detailed look at the Productivity Commission’s refer to our previous LegalTalk Alert. The Australian Government has largely accepted these recommendations, with some modifications (as discussed below), and has allocated $65 million over the next four years to implement the reforms.
Consumer Data Right
The Government’s proposed Consumer Data Right (CDR) envisages that consumers be entitled to allow
their data to be shared with third parties so as to:
- increase consumers’ ability to negotiate better deals with current providers or switch to other providers with better deals; and
- increase competition, innovation, and drive greater value for consumers.
The CDR will be introduced through amendments to the Competition and Consumer Act 2010 (Cth). Its implementation will be led by the Treasurer and monitored by a dual-regulator model – the Australian Competition and Consumer Commission (ACCC) as the main regulator in charge of operations, and the Office of the Australian Information Commissioner providing support and resolving consumer complaints. A new Data Standards Body will be created to engage with industry sectors, the tech community, consumer groups and privacy advocates.
The Government has allocated $44.6 million over the next four years to establish the CDR. Of that, the ACCC has been assigned $20.2 million over the next four years to establish a dedicated Access to Data Unit. This Unit will develop rules and an accreditation scheme to implement the consumer data right, approve technical standards, and enforce compliance by participants.
The CDR is intended to be an economy-wide right, but will be firstly applied in the banking sector as a right known as ‘Open Banking’. The energy and telecommunications sectors are then expected to follow as sectors that are subject to the CDR. Preliminary estimates based on the Federal Government’s Open Banking Review anticipate the introduction of Open Banking in mid-2019.
In addition, the Treasury and the Department of Energy and Environment have already commenced modelling the application of the CDR to the energy sector to potentially revamp an existing energy sector data right that has been criticised for inadequacies around data provision, transfer and customer consent. The Government expects to examine the applicability of the CDR to telecommunications in late 2018.
The Government’s proposed right is notably more limited than the one recommended by the Productivity Commission, which allowed consumers the right to be informed of an entity’s intention to disclose, sell or exchange consumer data. The Government is yet to clarify the scope of application of the CDR and which entities will be subject to the CDR. The Open Banking review recommended all consumers, including individuals, small/medium and large businesses be entitled to exercise the right.
New data release and sharing regulatory framework
In line with the Productivity Commission report, the Government proposes to introduce a new Data Sharing and Release (DSA) Act to deal with the use of government-collected data, and will establish the Office of the National Data Commissioner, designate Accredited Data Authorities (ADAs), and identify high-value designated datasets. The provisions of the proposed DSR Act will be guided by the Open Government National Action Plan 2016-2018 and the Data Integration Partnership for Australia.
Key components of the proposed DSR Act will include risk management practices, safeguards for sensitive data, registers of publically-available datasets, the monitoring of Australia’s data system, and rules on data sharing and release. The Government will provide $20.5 million over the next four years for the implementation of the new regulatory framework.
However, contrary to the Productivity Commission’s recommendations, the Government has decided that the framework will not affect existing secrecy provisions governing particularly sensitive data relating to national security and law enforcement. The Government considers safeguarding these particular classes of sensitive information a key priority.
National Data Commissioner
If implemented as currently envisaged, the National Data Commissioner will be tasked with overseeing and monitoring Australia’s data system, with broad policy aims to drive ethical and best practice use and re-use of data. The Commissioner will be supported by a new National Data Advisory Council, which will advise on ethical and technical best practice use of data and industry and international developments, and also by the Australian Bureau of Statistics, which will provide technical support and guidance.
Accredited Data Authorities (ADAs)
The DSR Act will create a network of ADAs which, together with data custodians, will implement a user network largely based on the United Kingdom’s ‘Five Safes Model’, which has been accepted as international best practice. ADAs will be vested with the authority to decide whether government collected datasets should be made available for public release or be limited to sharing with trusted users.
The ADAs’ designation is expected to be similar to the process by which the National Statistical Service accredits certain agencies as ‘Integrating Authorities’ to bring data together to create statistical and research datasets.
High-value designated datasets
Following a legislative consultation process, the DSR Act will detail a framework to identify datasets of which availability and use generates significant community-wide benefits. High-value designated datasets (‘National Interest Datasets’ in the language of the Productivity Commission report), containing nonsensitive data will be available for public release, and those National Interest Datasets with sensitive data will be available to trusted users, determined by ADAs, with appropriate risk management mechanisms as determined by the DSR Act.
The Productivity Commission indicated that high-value designated datasets could include private sector information in situations where it is in the national interest to do so (e.g. where data is held in relation to services delivered by both public and private sectors or services that are publicly funded). At this stage, it remains unclear whether the Government will require private sector data to be included in high-value designated data sets.
The creation of a Consumer Data Right, Data Commissioner and data use and sharing framework is a major step forward by the Government to boost data availability and use in a regulated, protected environment. However, some questions remain unanswered – particularly, how the new laws will interact with the Government’s 2016 Guidelines on the release of unit level data as open data. There is also a significant amount of highly sensitive data relating to security and law enforcement that will remain regulated by discrete secrecy laws.
It is likely that reform will continue following the imminent introduction of the EU General Data Protection Regulation, with calls in the Senate to undertake a comprehensive review of privacy legislation to ensure alignment with emerging international standards.