Bills

Public Sector (Data Sharing) Bill

Committee Stage

In committee (resumed on motion).

Clause 1.

The CHAIR: Does any other member have anything to contribute to clause 1? If not, I put that clause 1 stand as printed.

Clause passed.

Clauses 2 to 5 passed.

Clause 6.

The Hon. A.L. McLACHLAN: I move:

Amendment No 1 [McLachlan–1]—

Page 5, line 33 [clause 6(4)]—Before 'approval' insert 'written'

It is part of the theme of these amendments to give physicality to some of the decisions being made and thereby assist when there is an annual review and an annual report.

The Hon. P. MALINAUSKAS: The government will be supporting this amendment. The amendment would require the minister to give written approval for the ODA to direct a public sector agency to provide data to the ODA for the purposes of it carrying out its functions. This amendment is not wholly necessary, as it would reflect what would occur in practice in any event, namely, the minister would give approval in writing rather than verbally. However, the government considers that this amendment is not unreasonable and would not prejudice the effectiveness of the legislation and so supports the amendment.

Amendment carried; clause as amended passed.

Clause 7.

The Hon. A.L. McLACHLAN: I move:

Amendment No 1 [McLachlan–2]—

Page 6 line 29 to page 7 line 3 [clause 7(4)]—Delete subclause (4) and substitute:

(4) Safe data

(a) If data to be shared and used contains personal information, the personal information must be de-identified unless—

(i) the person to whom the personal information relates has consented to the sharing and use; or

(ii) the sharing and use of the personal information is reasonably related to the original purpose for which it was collected and there is no reason to think that the person to whom the information relates would object to the sharing and use; or

(iii) the sharing and use of the personal information is in connection with a criminal investigation or criminal proceedings or proceedings for the imposition of a penalty; or

(iv) the sharing and use of the personal information is in connection with the wellbeing, welfare or protection of a child or children or other vulnerable person; or

(v) the sharing and use of the personal information is reasonably necessary to prevent or lessen a threat to the life, health or safety of a person; or

(vi) the purpose of the sharing and use of the personal information cannot be achieved through the use of de-identified data and it would be impracticable in the circumstances to seek the consent of the person to whom the information relates; or

(vii) the sharing and use of the personal information is for a prescribed purpose or occurs in prescribed circumstances;

(b) Data to be shared and used for a purpose must be assessed as appropriate for that purpose having regard to—

(i) whether the data is of the necessary quality for the proposed use (such as being accurate, relevant and timely); and

(ii) whether the data relates to people; and

(iii) if data containing personal information is to be de-identified, how that de-identification will be undertaken and whether the data may be re-identified, and if so, how it may be re-identified.

I understand the government will be supporting this amendment. The approach taken to this amendment by the Liberal opposition has been that we would seek to have the data depersonalised where possible, subject to certain exemptions. As indicated by the minister, the bill as drafted, enables the Office of Data Analytics, the ODA, to direct that a public sector agency provides public sector data to the ODA, but they must first obtain approval from the minister.

This amendment places a mandatory requirement, and I ask members to note that the inserted (4)(a) uses the word 'must', on the public sector agencies to identify personal information. The amendment incorporates elements from the commonwealth and New South Wales information privacy principles and provisions commonly contained in privacy legislation throughout Australia, although the amendments have been tailored to apply specifically to South Australia, as we have no privacy law that covers state government, local government or South Australian universities. The amendments have also been crafted to encapsulate the concepts contained in the existing South Australian government circulars, such as the Department of the Premier and Cabinet Circular PC012.

For the benefit of honourable members, the list of exemptions includes if the person has consented to the sharing of their personal data. This provision is obviously standard in information privacy principles. The second exemption is if the sharing and use of personal data is reasonably related to the original purpose for which it was collected, and there is no reason to think that the person would object.

Again, the form of drafting is from standard privacy principles, and there is jurisprudence being built in the courts around this. If the data relates to criminal investigation proceedings or the data relates to the welfare and protection of children—members will recall that the government placed great emphasis on this in introducing this bill, although its concept was well before the issues relating to child protection—it will be used to better share information in response to the recommendations of the Nyland royal commission.

Also, there is an exemption for the use of data which is reasonably necessary to prevent and lessen a threat to life or health or safety of a person and an all-encompassing provision that allows for regulations to provide for prescribed purpose. Of course, members will be able to seek to disallow any other initiative from the government relating to exemptions, if they were to appear in regulation. (4)(b) of the inserted clause reproduces the original conditions which existed in the government's bill. I recommend the amendments to the members.

Amendment carried; clause as amended passed.

Clause 8.

The Hon. P. MALINAUSKAS: I move:

Amendment No 1 [Police–1]—

Page 8, line 1 to line 3 [clause 8(2)]—Delete subclause (2) and substitute:

(2) Before public sector data is provided to a public sector agency under subsection (1)—

(a) the public sector agency must make a written record of the purpose or purposes for which the public sector data is proposed to be provided and used as agreed with the public sector agency that is to provide the data; and

(b) the public sector agency that is to provide the data must apply the trusted access principles and be satisfied that the provision and use of the data is appropriate in all the circumstances.

I thank the honourable member for his third amendment on [McLachlan–1] and appreciate the motivation behind that particular amendment. The government had concerns about the drafting of this amendment and, as a result, is moving its own amendment, which we believe addresses the honourable member's concerns about the need to make a written record on the purpose for which data is proposed to be provided and shared between public sector agencies. This, in turn, will enable both the annual report and the review of the act to be completed both effectively and efficiently.

The government's proposed new paragraph 8(2)(a), in effect, requires the public sector agency that is to receive data to agree with the data provider what the purpose is for the provision and use of the data and to make a written record of that purpose. The government's amendment aligns with the Hon. Mr McLachlan's fourth and fifth amendments, on [McLachlan–1], relating to annual reports and a review of the act, which the government is supporting. I urge support for the government amendment.

The Hon. A.L. McLACHLAN: The opposition will be supporting this amendment.

Amendment carried; clause as amended passed.

Clause 9.

The Hon. A.L. McLACHLAN: I move:

Amendment No 1 [McLachlan–3]—

Page 8, after line 27—Insert:

(6) The Minister must—

(a) as soon as practicable after making a direction under subsection (1), cause notice of the direction to be published in the Gazette; and

(b) within 6 sitting days of making a direction under subsection (1), cause notice of the direction to be laid before each House of Parliament.

(7) A notice under subsection (6) must specify the data provider, the data recipient and the general nature of the public sector data to which the direction relates.

The Hon. P. MALINAUSKAS: The government supports this amendment. The amendment operates when the minister makes a direction under clause 9 that a public sector agency provide data that it controls to another public sector agency. This direction may include data that is otherwise exempt from the voluntary data sharing provisions between agencies under clause 8.

Before making such a direction, the minister must have regard to the trusted access principles and be satisfied that the sharing and use of the data is appropriate in all circumstances. The amendment requires that the minister publish a notice of the direction in the Gazette and within six sitting days have the notice laid before each house. The government generally supports this amendment and commends it to the house.

Amendment carried; clause as amended passed.

Clauses 10 to 13 passed.

Clause 14.

The Hon. A.L. McLACHLAN: I move:

Amendment No 2 [McLachlan–3]—

Page 10, after line 24—Insert:

(2) The Minister must—

(a) as soon as practicable after giving an approval for the purposes of subsection (1)(a), cause notice of the approval to be published in the Gazette; and

(b) within 6 sitting days of giving an approval for the purposes of subsection (1)(a), cause notice of the approval to be laid before each House of Parliament.

This amendment is in line with the previous amendment to clause 9, and the opposition is seeking to ensure that the parliament and the community are aware of actions of the minister so that they can hold the minister to account for his judgements.

The Hon. P. MALINAUSKAS: The government supports the amendment.

Amendment carried.

The Hon. R.I. LUCAS: My question in relation to clause 14 follows the questions I was referring to earlier. Clause 14 has been amended, and we also amended earlier the safe data provisions under clause 7. As my colleague the Hon. Mr McLachlan indicated with safe data, with the new amendment, which the government supported:

…if the data that is to be shared and used contains personal information, the personal information must be de-identified unless—

and there is a whole series of possible exemptions. The broadest, potentially, in the context of my question is:

…the sharing and use of the personal information is reasonably related to the original purpose for which it was collected and there is no reason to think that the person to whom the information relates would object to the sharing and use.

Clearly, that is a judgement that the public servant or the minister would make. It is not challenged—ultimately, someone could take it to court, I guess, but, essentially, it is a judgement call that the minister or the public servant takes in relation to whether or not it is reasonably related to the original purpose for which it was collected. When I was referring earlier to the possibility of harvesting email addresses and names from various government departments and agencies into a central repository, such as DPC, I referred to clause 14, which provides:

A data recipient must not use or disclose public sector data received pursuant to an authorisation under section 8 or section 9 other than for a purpose for which it was provided unless—

(a) the Minister, after consultation with the data provider, approves the use or disclosure;

In response to earlier questions, the minister's advice was that it is the minister's decision, in the end, as to whether or not he or she is going to approve the use or disclosure for a purpose other than the purpose for which it was originally received.

My question is: when one looks at this act with the new amendment in clause 7(b)—which provides that 'you must, unless it is for a reasonable purpose', and, under clause 14, 'the minister can without any reason use it for a purpose other than the purpose for which it was originally collected'—what is the ultimate impact? Even with the new amendment in safe data provision that has been included, and we all support it, can the minister, if he deems fit, use clause 14 and approve the use or disclosure for a purpose for which it was not originally collected?

The Hon. P. MALINAUSKAS: Your question, as I understand it—and correct me if I am wrong—pertains to the question of whether or not a minister could later use their authority granted to them under this bill—

The Hon. R.I. Lucas: Under clause 14.

The Hon. P. MALINAUSKAS: —under clause 14, to be able to allow for information to be disseminated for a political purpose.

The Hon. R.I. LUCAS: No, you did not understand my question. We will come to the political purpose ultimately. What I am saying is: under clause 14, does the minister have the power? I am not a lawyer, and neither is the minister, but he has legal advice available to him. On my reading as a non-lawyer, now that we have the safe data provision with clause 14 still in there, a minister (Labor or Liberal) could direct that, under clause 14, data collected by a Transforming Health department, for example email addresses, be transferred to the DPC. Whether it is used for political purposes or not is a separate argument. I want to know whether under clause 14, on my reading, if the minister could still do that, and we could still have in DPC a central collection of all emails and contact points from various departments and agencies that have come into the various arms of government.

The Hon. P. MALINAUSKAS: My advice is that the answer to that question is yes, that could occur.

The Hon. R.I. LUCAS: I do not propose to delay the proceedings much longer than that. I support all the amendments that we have put in there with agreement between the government and the opposition in an endeavour to be transparent and accountable. In the end, the issue still remains that the minister will have that power. I have highlighted the concerns I have seen with the abuse of these particular provisions in the 2010 election and in a slightly different way in the 2014 election. We are leading into a 2018 election, and I have concerns.

If a premier, with a compliant CEO in the DPC, has access to massive databases of people who have expressed views on political issues, he does not have to give it to his Reggie Martin or his party equivalent. He has that capacity, through that database, to directly provide information to all of those people on a whole variety of issues centrally as the leader of the government and as the premier.

As I said, in 2010, it was as blatant as sending copies of the Labor Party policy on education to teachers and SSOs and other people within the education department. It was not even concealed along the lines of being a government announcement on this particular issue. It was actually the Labor Party policy document. Whoever the state secretary was at the time, it was authorised by the state secretary of the Labor Party. It was as brazen as that at the time. I accept the fact that the minister in charge of the bill here can say and do nothing more than that. Based on the advice he was given, he has answered the question.

I flag my ongoing concern in relation to this. The amendments that have been moved will at least potentially shine a light, although, as I highlighted earlier, the issue of six sitting days means that if there are no sitting days between November 2017 and March 2018, when there is an election, then these particular issues will not see the light of day until after the election. So, a premier, a government and a CEO who wanted to use these provisions for their own purposes would be able to, if they so chose.

Clearly, we would hope that is not going to be the case, that they are not used in that way but are actually used for the purposes for which the bill was originally conceived, and that was in the public interest to share data for the better delivery of services in South Australia. I hope that is what, in the end, we see coming out of the bill, not it being used as a vehicle for a premier and a government to be able to get its message, in a more targeted way, to a large number of public servants or people who have corresponded with the Public Service.

Clause as amended passed.

Clause 15.

The Hon. A.L. McLACHLAN: I move:

Amendment No 3 [McLachlan–3]—

Page 10, after line 37—Insert:

(3) The Minister must—

(a) as soon as practicable after delegating a function or power under subsection (1), cause notice of the delegation to be published in the Gazette; and

(b) within 1 sitting day of delegating a function or power under subsection (1), cause notice of the delegation to be laid before each House of Parliament.

(4) A notice under subsection (3) must specify—

(a) the delegate and the delegated functions or powers; and

(b) any conditions or limitations imposed on the delegation; and

(c) whether the instrument of delegation provides for further delegation by the delegate.

A further amendment to the inserted clause (3)(b) is to strike out the number '1' and insert '6', and strike out the word 'day' and insert the word 'days'. This amendment is consistent with the previous amendments to clause 14 and clause 9 in relation to requiring transparency of decision-making by the minister.

The Hon. P. MALINAUSKAS: The government supports the amendment.

Amendment as amended carried; clause as amended passed.

Clause 16 passed.

New clause 16A.

The Hon. A.L. McLACHLAN: I move:

Amendment No 4 [McLachlan–1]—

Page 11, after line 8—After line 8 insert:

16A—Annual report

(1) The Minister must, as soon as practicable after each 30 June, cause a report to be prepared about the operation of this Act during the year ended on that 30 June.

(2) Without limiting subsection (1), a report relating to a year must include the following matters:

(a) in relation to the provision of public sector data pursuant to a direction of ODA under section 6(4), a list of such directions including, in respect of each direction—

(i) the identity of the data provider and data recipient; and

(ii) the nature of the data; and

(iii) whether the public sector data contained personal information and whether the data was, at the time of the direction, exempt public sector data;

(b) a summary of the results of data analytics work undertaken by ODA and made available to public sector agencies, the private sector and the general public;

(c) in relation to the provision of public sector data containing personal information under section 8(1), a list of all instances of such provision including the identification of the data provider and data recipient, the general nature of the data and the purpose for which the data was shared;

(d) a list of all directions made by the Minister under section 9(1), including, in respect of each direction—

(i) the identification of the data provider and data recipient and the general nature of the public sector data; and

(ii) the purpose for which the public sector data was to be provided; and

(iii) whether the direction related to public sector data containing personal information and whether the data was, at the time of the direction, exempt public sector data;

(e) a list of all agreements entered into pursuant to section 13(1) including, in respect of each agreement—

(i) the identification of the parties to the agreement and the general nature of the data being shared; and

(ii) whether the agreement related to the sharing of public sector data containing personal information and whether the public sector data was, at the time of sharing, exempt public sector data.

(3) The Minister must, within 6 sitting days after receipt of a report under this section, cause copies of the report to be laid before each House of the Parliament.

The purpose of this new clause is to provide for an annual report in relation to the operation of the bill when enacted. Obviously, it is post action so it does not address, necessarily, some of the concerns raised by the Hon. Rob Lucas but it will allow the parliament to review the operation of the act and determine whether it is making a positive impact on policy development or is being used for suboptimal reasons or reasons outside the intention of the objects of the act.

The Hon. P. MALINAUSKAS: The government again considers that this amendment in respect of an annual report is not unreasonable and therefore supports the amendment.

New clause inserted.

Clause 17 passed.

New clause 17A.

The Hon. A.L. McLACHLAN: I move:

Amendment No 5 [McLachlan–1]—

Page 11, after line 31—After line 31 insert:

17A—Review of Act

(1) The Minister must, as soon as practicable after the third anniversary of the commencement of this Act, appoint a retired judicial officer to conduct a review of the operation of this Act.

(2) The Minister and any other person performing functions and powers under this Act must ensure that a person appointed to conduct a review is provided with such information as they may require for the purpose of conducting the review.

(3) A report on a review under this section must be presented to the Minister within 6 months of the appointment under subsection (1).

(4) The Minister must, within 6 sitting days after receipt of a report under this section, cause copies of the report to be laid before each House of Parliament.

(5) In this section—

judicial officer means a person appointed as a judge of the Supreme Court or the District Court or a person appointed as judge of another State or Territory or of the Commonwealth.

This amendment provides for a review of the act by a retired judicial officer. Again, it could be considered to arise out of an abundance of caution on how the act is used. The view of the opposition was that, given that we do not have a privacy act and we do not know when we will have one or if we will have one, it would be appropriate to see how these provisions work and whether there are any significant or concerning invasions of individuals' privacy in the transfer of data. I commend the amendment to members.

The Hon. P. MALINAUSKAS: Again, the government is happy to support this amendment. It sees it as appropriate and not unreasonable.

New clause inserted.

Title passed.

Bill reported with amendment.

Third Reading

The Hon. P. MALINAUSKAS (Minister for Police, Minister for Correctional Services, Minister for Emergency Services, Minister for Road Safety) (15:53): I move:

That this bill be now read a third time.

Bill read a third time and passed.