Victorian Data Sharing Act 2017

Authorised by the Chief Parliamentary Counsel Authorised Version i Victorian Data Sharing Act 2017 No. 60 of 2017 TABLE OF PROVISIONS Section Page Part 1—Preliminary 1 1 Purposes 1 2 Commencement 2 3 Definitions 2 4 Act binds the Crown 9 5 Purpose of data sharing 9 Part 2—Chief Data Officer 10 6 Chief Data Officer 10 7 Functions and powers of Chief Data Officer 10 Part 3—Data requests 11 8 Chief Data Officer may request data 11 9 Data sharing body must respond to data request 11 10 Designated body may respond to data request 12 11 Chief Data Officer may request information about data holdings 12 12 Data sharing body must respond to data holding request 13 13 Designated body may respond to data holding request 14 14 Reasons for refusing to provide specified data or information 14 Part 4—Use and disclosure of data 16 Division 1—Authorised use and disclosure of identifiable data 16 15 Data sharing body or designated body may disclose identifiable data 16 16 Chief Data Officer may disclose identifiable data for the purpose of data integration 16 17 Chief Data Officer or data analytics body may use identifiable data for the purpose of data integration 16 18 Restrictions on the use of identifiable data for the purpose of data analytics work 16 19 Restriction on the disclosure of results of data analytics work 17 Division 2—Authorised use and disclosure of data to which a secrecy provision applies 17 20 Data sharing body or designated body may disclose data to which a secrecy provision applies 17 -- 1 of 33 -- Section Page ii Authorised by the Chief Parliamentary Counsel 21 Data sharing body or designated body must inform Chief Data Officer of secrecy provision 18 22 Chief Data Officer may use data to which a secrecy provision applies 18 23 Chief Data Officer may disclose data to which a secrecy provision applies 18 Division 3—Relationship with other Acts 19 24 Handling of data under other Acts 19 25 Exemption from Freedom of Information Act 1982 20 Part 5—Offences 21 26 Unauthorised access to, use of or disclosure of data or information—summary offence 21 27 Unauthorised access to, use of or disclosure of data or information—indictable offence 21 Part 6—Reporting and review 23 28 Report to the Health Complaints Commissioner 23 29 Report to the Information Commissioner 24 30 Review of Act after 5 years 25 Part 7—Other matters 26 31 Delegation 26 32 Regulations 26 33 Chief Data Officer may issue policies and guidelines 27 Part 8—Amendment of other Acts and repeal of amending Part 29 34 Amendment of Privacy and Data Protection Act 2014 29 35 Amendment of Family Violence Protection Amendment (Information Sharing) Act 2017 29 36 Repeal of amending Part 30 ═════════════ Endnotes 31 1 General information 31 -- 2 of 33 -- Authorised by the Chief Parliamentary Counsel Authorised Version 1 Victorian Data Sharing Act 2017 † No. 60 of 2017 [Assented to 5 December 2017] The Parliament of Victoria enacts: Part 1—Preliminary 1 Purposes The purposes of this Act are— (a) to establish the office of Chief Data Officer; and (b) to promote the sharing and use of public sector data as a public resource that supports government policy making, service planning and design; and Victoria -- 3 of 33 -- Part 1—Preliminary Victorian Data Sharing Act 2017 No. 60 of 2017 2 Authorised by the Chief Parliamentary Counsel (c) to remove barriers that impede the sharing of identifiable data with the Chief Data Officer or with data analytics bodies, and to facilitate the sharing of data across the public sector; and (d) to provide protections in connection with data sharing under this Act, by— (i) specifying the purposes of data sharing, and the circumstances in which sharing of identifiable data is permitted; and (ii) ensuring that data that is handled under this Act is protected from unauthorised access, use or disclosure; and (e) to make consequential and other amendments to other Acts. 2 Commencement This Act comes into operation on the day after the day on which this Act receives the Royal Assent. 3 Definitions (1) In this Act— Board of Inquiry has the same meaning as in the Inquiries Act 2014; Centre means the persons employed or engaged by the Secretary to the Department to support the Chief Data Officer in the performance of the Chief Data Officer's functions, powers and duties under this Act; Chief Data Officer means the person employed as the Chief Data Officer under section 6; commissioner, of a Royal Commission, has the same meaning as in the Inquiries Act 2014; -- 4 of 33 -- Part 1—Preliminary Victorian Data Sharing Act 2017 No. 60 of 2017 3 Authorised by the Chief Parliamentary Counsel data means any facts, statistics, instructions, concepts or other information in a form that is capable of being communicated, analysed or processed (whether by an individual or by a computer or other automated means); data analytics body means— (a) the Secretary to a Department; or (b) any of the following prescribed by the regulations for the purposes of this paragraph— (i) a body established or appointed for a public purpose by or under an Act; (ii) a body established or appointed for a public purpose by the Governor in Council, or by a Minister, otherwise than under an Act; (iii) a person holding an office or position established by or under an Act (other than the office of member of the Parliament of Victoria) or to which the person was appointed by the Governor in Council, or by a Minister, otherwise than under an Act; (iv) any other data sharing body; (v) any other designated body; data analytics work means the examination and analysis of data for the purpose of drawing conclusions as a result of that examination and analysis, but does not include data integration; -- 5 of 33 -- Part 1—Preliminary Victorian Data Sharing Act 2017 No. 60 of 2017 4 Authorised by the Chief Parliamentary Counsel data integration means the combination or collation of data contained in 2 or more data sets; data sharing body means— (a) a public service body; or (b) a public entity; or (c) Victoria Police; or (d) any of the following prescribed by the regulations for the purposes of this paragraph— (i) a body established or appointed for a public purpose by or under an Act; (ii) a body established or appointed for a public purpose by the Governor in Council, or by a Minister, otherwise than under an Act; (iii) a person holding an office or position established by or under an Act (other than the office of member of the Parliament of Victoria) or to which the person was appointed by the Governor in Council, or by a Minister, otherwise than under an Act; Note A data analytics body is a data sharing body under this Act. de-identified, in relation to data, means data that no longer relates to an identifiable individual or an individual who can be reasonably identified; -- 6 of 33 -- Part 1—Preliminary Victorian Data Sharing Act 2017 No. 60 of 2017 5 Authorised by the Chief Parliamentary Counsel Department has the same meaning as in the Public Administration Act 2004; designated body means— (a) an exempt body; or (b) an exempt body official; or (c) a special body, other than Victoria Police; or (d) a special body Head, other than the Chief Commissioner of Victoria Police; or (e) a Board of Inquiry or a Formal Review; or (f) a member of a Board of Inquiry or a Formal Review; or (g) a Royal Commission; or (h) a commissioner of a Royal Commission; exempt body has the same meaning as in the Public Administration Act 2004; exempt body official has the same meaning as in the Public Administration Act 2004; Formal Review has the same meaning as in the Inquiries Act 2014; handling, in relation to data, means the collection, holding, management, use, disclosure or transfer of that data; Health Complaints Commissioner has the same meaning as in the Health Records Act 2001; health information has the same meaning as in the Health Records Act 2001; -- 7 of 33 -- Part 1—Preliminary Victorian Data Sharing Act 2017 No. 60 of 2017 6 Authorised by the Chief Parliamentary Counsel identifiable data means one or more of the following— (a) health information; (b) personal information; (c) identifiers; (d) unique identifiers; identifier has the same meaning as in the Health Records Act 2001; individual means a natural person; Information Commissioner has the same meaning as in the Freedom of Information Act 1982; personal information has the same meaning as in the Privacy and Data Protection Act 2014; public entity has the same meaning as in the Public Administration Act 2004; public entity Head has the same meaning as in the Public Administration Act 2004; public sector has the same meaning as in the Public Administration Act 2004; public service body has the same meaning as in the Public Administration Act 2004; public service body Head has the same meaning as in the Public Administration Act 2004; responsible officer means— (a) for a public service body—the public service body Head; or (b) for a public entity—the public entity Head; or (c) for Victoria Police—the Chief Commissioner of Victoria Police; or -- 8 of 33 -- Part 1—Preliminary Victorian Data Sharing Act 2017 No. 60 of 2017 7 Authorised by the Chief Parliamentary Counsel (d) for a designated body—the head (however described) of that body; or (e) for a body that is prescribed as a data analytics body or a data sharing body— the head (however described) of that body; restricted data means the following— (a) data that could reasonably be expected to disclose, or enable a person to ascertain, the identity of a confidential source of information in relation to the enforcement or administration of the law; (b) data that could reasonably be expected to disclose the existence or identity of a person included in a witness protection program; (c) data that could reasonably be expected to prejudice national security; (d) data that could reasonably be expected to disclose investigative measures or procedures, including but not limited to intelligence gathering methodologies, investigative techniques or technologies, covert practices or information sharing arrangements between law enforcement agencies; (e) data to which a provision prescribed in the regulations applies; Royal Commission means— (a) a Royal Commission established under the Inquiries Act 2014; or (b) a Royal Commission established under the prerogative of the Crown; -- 9 of 33 -- Part 1—Preliminary Victorian Data Sharing Act 2017 No. 60 of 2017 8 Authorised by the Chief Parliamentary Counsel secrecy provision means a provision of an Act that restricts or prohibits the disclosure of information (whether that restriction or prohibition is absolute or subject to qualifications or exceptions), other than a provision prescribed in the regulations as a provision to which Division 2 of Part 4 does not apply; Secretary to the Department means the Secretary to the Department responsible for the administration of this Act; special body has the same meaning as in the Public Administration Act 2004; special body Head has the same meaning as in the Public Administration Act 2004; unique identifier means an identifier (usually a number) assigned by an organisation to an individual uniquely to identify that individual for the purposes of the operations of the organisation but does not include an identifier that consists only of the individual's name and does not include an identifier within the meaning of the Health Records Act 2001; Victoria Police has the same meaning as in the Victoria Police Act 2013; Victorian protective data security framework has the same meaning as in the Privacy and Data Protection Act 2014. (2) For the purposes of this Act, a body holds data if the data is contained in a document that is in the possession or under the control of the body, whether alone or jointly with other persons or bodies, irrespective of where the document is situated, whether in or outside Victoria. -- 10 of 33 -- Part 1—Preliminary Victorian Data Sharing Act 2017 No. 60 of 2017 9 Authorised by the Chief Parliamentary Counsel 4 Act binds the Crown This Act binds the Crown in right of Victoria and, so far as the legislative power of the Parliament permits, the Crown in all its other capacities. 5 Purpose of data sharing Data must only be handled under this Act for the purpose of informing government policy making, service planning and design. -- 11 of 33 -- Part 2—Chief Data Officer Victorian Data Sharing Act 2017 No. 60 of 2017 10 Authorised by the Chief Parliamentary Counsel Part 2—Chief Data Officer 6 Chief Data Officer The Secretary to the Department may employ a person under Part 3 of the Public Administration Act 2004 to be the Chief Data Officer for the purposes of this Act. 7 Functions and powers of Chief Data Officer (1) The Chief Data Officer has the following functions— (a) to conduct data integration and data analytics work to inform government policy making, service planning and design; (b) to build capability in data analytics across the public sector; (c) to lead and coordinate cross-jurisdictional data sharing and data integration work on behalf of the State of Victoria; (d) to make available to data sharing bodies and designated bodies— (i) integrated data sets; and (ii) the results of data analytics work; (e) to collaborate with data sharing bodies and designated bodies; (f) functions incidental to the functions referred to in paragraphs (a) to (e); (g) any other functions conferred on the Chief Data Officer under this Act or any other Act. (2) The Chief Data Officer has all the powers necessary to perform his or her functions, including the powers conferred on the Chief Data Officer under this Act or any other Act. -- 12 of 33 -- Part 3—Data requests Victorian Data Sharing Act 2017 No. 60 of 2017 11 Authorised by the Chief Parliamentary Counsel Part 3—Data requests 8 Chief Data Officer may request data (1) The Chief Data Officer, in accordance with section 5, may give a written notice to the responsible officer of a data sharing body or a designated body requesting that the data sharing body or designated body provide to the Chief Data Officer data that is— (a) held by the data sharing body or designated body; and (b) specified in the notice. (2) A notice under subsection (1) must specify— (a) the data requested; and (b) the reasons for the request; and (c) how the data will be handled. (3) The Chief Data Officer must not request restricted data. 9 Data sharing body must respond to data request (1) This section applies if the Chief Data Officer gives a notice under section 8 requesting that a data sharing body provide specified data. (2) The responsible officer of the data sharing body must respond in writing to the Chief Data Officer within 10 business days of the date of receiving the notice or within a longer period as is agreed by the Chief Data Officer, either— (a) by providing the specified data; or (b) by written notice stating that the data sharing body does not intend to provide some or all of the specified data in accordance with section 14. -- 13 of 33 -- Part 3—Data requests Victorian Data Sharing Act 2017 No. 60 of 2017 12 Authorised by the Chief Parliamentary Counsel (3) If the responsible officer of the data sharing body does not intend to provide some or all of the specified data, the response to the request must— (a) be given to the Secretary to the Department in addition to being given to the Chief Data Officer; and (b) state the reasons for that intention in accordance with section 14. 10 Designated body may respond to data request If the Chief Data Officer gives a notice under section 8 requesting that a designated body provide specified data— (a) the designated body may provide some or all of the specified data to the Chief Data Officer, but is not required to do so; and (b) the designated body is not required to respond to the request. 11 Chief Data Officer may request information about data holdings (1) The Chief Data Officer, in accordance with section 5, may give a written notice to the responsible officer of a data sharing body or a designated body, requesting that the data sharing body or designated body provide information about the data holdings of the data sharing body or the designated body. (2) The information that may be requested includes, but is not limited to— (a) the kind of data sets held by the data sharing body or designated body; and (b) the number of data sets held by the data sharing body or designated body; and -- 14 of 33 -- Part 3—Data requests Victorian Data Sharing Act 2017 No. 60 of 2017 13 Authorised by the Chief Parliamentary Counsel (c) the kind of information contained in the data sets held by the data sharing body or designated body; and (d) the accuracy, currency and completeness of the data sets held by the data sharing body or designated body. (3) A notice under subsection (1) must specify— (a) the information requested; and (b) the reasons for the request; and (c) how the information will be handled. 12 Data sharing body must respond to data holding request (1) This section applies if the Chief Data Officer gives a notice under section 11 requesting that a data sharing body provide specified information about the body's data holdings. (2) The responsible officer of the data sharing body must respond in writing to the Chief Data Officer within 10 business days or within a longer period as agreed by the Chief Data Officer, either— (a) by providing the specified information; or (b) by written notice stating that the data sharing body does not intend to provide some or all of the specified information in accordance with section 14. (3) If the responsible officer of the data sharing body does not intend to provide some or all of the specified information, the response to the request must— (a) be given to the Secretary to the Department in addition to being given to the Chief Data Officer; and -- 15 of 33 -- Part 3—Data requests Victorian Data Sharing Act 2017 No. 60 of 2017 14 Authorised by the Chief Parliamentary Counsel (b) state the reasons for that intention in accordance with section 14. 13 Designated body may respond to data holding request If the Chief Data Officer gives a notice under section 11 requesting that a designated body provide information about the body's data holdings— (a) the designated body may provide some or all of the specified information to the Chief Data Officer, but is not required to do so; and (b) the designated body is not required to respond to the request. 14 Reasons for refusing to provide specified data or information The responsible officer of a data sharing body may refuse to provide data requested by the Chief Data Officer under section 8, or information requested by the Chief Data Officer under section 11, if the responsible officer considers for any reason that the data or information should not be provided, including but not limited to the following reasons— (a) that the provision of the data or information would constitute a breach of one or more of the following— (i) client legal privilege or legal professional privilege; (ii) contract; (iii) an equitable obligation of confidence; (iv) an order of a court or tribunal; -- 16 of 33 -- Part 3—Data requests Victorian Data Sharing Act 2017 No. 60 of 2017 15 Authorised by the Chief Parliamentary Counsel (v) subject to Part 4, a law of the Commonwealth, a State or a Territory; or (b) that the provision of the data or information would be likely to prejudice one or more of the following— (i) the investigation of a breach, or possible breach, of a law of the Commonwealth, a State or a Territory, or the administration or enforcement of such a law; (ii) a coronial inquest or inquiry; (iii) a proceeding before a court or tribunal; or (c) that the responsible officer believes on reasonable grounds that the provision of the data or information would be likely to endanger the health, safety or welfare of one or more individuals. -- 17 of 33 -- Part 4—Use and disclosure of data Victorian Data Sharing Act 2017 No. 60 of 2017 16 Authorised by the Chief Parliamentary Counsel Part 4—Use and disclosure of data Division 1—Authorised use and disclosure of identifiable data 15 Data sharing body or designated body may disclose identifiable data (1) The responsible officer of a data sharing body or designated body, in accordance with section 5, may disclose identifiable data to the Chief Data Officer in response to a request under section 8. (2) The responsible officer of a data sharing body or designated body, in accordance with section 5, may disclose identifiable data to a data analytics body for the purpose of data integration. 16 Chief Data Officer may disclose identifiable data for the purpose of data integration Subject to section 23, the Chief Data Officer, in accordance with section 5, may disclose identifiable data received from data sharing bodies and designated bodies under this Act to a data analytics body for the purpose of data integration. 17 Chief Data Officer or data analytics body may use identifiable data for the purpose of data integration The Chief Data Officer or a data analytics body, in accordance with section 5, may collect, hold, manage and use identifiable data received from data sharing bodies and designated bodies under this Act for the purpose of data integration. 18 Restrictions on the use of identifiable data for the purpose of data analytics work (1) The Chief Data Officer or a data analytics body must take reasonable steps to ensure that data received from data sharing bodies and designated bodies under this Act no longer relates to an -- 18 of 33 -- Part 4—Use and disclosure of data Victorian Data Sharing Act 2017 No. 60 of 2017 17 Authorised by the Chief Parliamentary Counsel identifiable individual or an individual who can reasonably be identified before using that data for the purpose of data analytics work. (2) For the purposes of subsection (1), the Chief Data Officer or a data analytics body must have regard to the following— (a) the de-identification techniques applied to treat the data; (b) the technical and administrative safeguards and protections implemented in the data analytics environment to protect the privacy of individuals; (c) any other considerations specified in the guidelines issued by the Chief Data Officer. 19 Restriction on the disclosure of results of data analytics work Before disclosing the results of data analytics work, the Chief Data Officer or a data analytics body must ensure that the results to be disclosed include only de-identified data. Division 2—Authorised use and disclosure of data to which a secrecy provision applies 20 Data sharing body or designated body may disclose data to which a secrecy provision applies If a secrecy provision applies to the data disclosed by the responsible officer of a data sharing body or designated body to the Chief Data Officer, the disclosure of that data does not contravene the secrecy provision if it is in accordance with, and for the purposes of, this Act. -- 19 of 33 -- Part 4—Use and disclosure of data Victorian Data Sharing Act 2017 No. 60 of 2017 18 Authorised by the Chief Parliamentary Counsel 21 Data sharing body or designated body must inform Chief Data Officer of secrecy provision If the responsible officer of a data sharing body or designated body who discloses data to the Chief Data Officer in accordance with this Act is aware of a secrecy provision that applies to that data, the responsible officer must inform the Chief Data Officer of that secrecy provision. 22 Chief Data Officer may use data to which a secrecy provision applies If a secrecy provision applies to the data received by the Chief Data Officer under this Act, the collection, holding, management or use of that data does not contravene the secrecy provision if it is in accordance with, and for the purposes of, this Act. 23 Chief Data Officer may disclose data to which a secrecy provision applies (1) If a secrecy provision applies to the data received by the Chief Data Officer under this Act, the disclosure of that data by the Chief Data Officer does not contravene the secrecy provision if— (a) the Minister responsible for administering the secrecy provision has authorised the disclosure; and (b) in the case of data that is subject to a secrecy provision set out in the Taxation Administration Act 1997, the Commissioner of State Revenue has authorised the disclosure; and (c) the disclosure is in accordance with, and for the purposes of, this Act and, in the case of identifiable data, is in accordance with section 16. -- 20 of 33 -- Part 4—Use and disclosure of data Victorian Data Sharing Act 2017 No. 60 of 2017 19 Authorised by the Chief Parliamentary Counsel (2) Data may be lawfully disclosed— (a) for the purpose of complying with subsection (1)(a), to the Minister responsible for administering the secrecy provision; and (b) for the purpose of complying with subsection (1)(b), to the Commissioner of State Revenue. Division 3—Relationship with other Acts 24 Handling of data under other Acts (1) This Part does not affect the handling of data that would otherwise be permitted by or under the Privacy and Data Protection Act 2014, the Health Records Act 2001 or any other Act. (2) Except as expressly provided by this Part, this Act does not affect obligations under the Privacy and Data Protection Act 2014 or the Health Records Act 2001 in relation to the handling of identifiable data. (3) If the Chief Data Officer or a data analytics body becomes aware that this Act, the Privacy and Data Protection Act 2014 or the Health Records Act 2001 has been, or is likely to have been, breached in relation to data handled under this Act while in the control of the Chief Data Officer or of the data analytics body, the Chief Data Officer or the data analytics body must, as soon as practicable after becoming aware of the possible breach, inform— (a) in the case of a breach of this Act or the Privacy and Data Protection Act 2014, the Information Commissioner; and (b) in the case of a breach of the Health Records Act 2001, the Health Complaints Commissioner; and -- 21 of 33 -- Part 4—Use and disclosure of data Victorian Data Sharing Act 2017 No. 60 of 2017 20 Authorised by the Chief Parliamentary Counsel (c) in any case, the data sharing body or designated body who provided the data. 25 Exemption from Freedom of Information Act 1982 (1) The Freedom of Information Act 1982 does not apply to— (a) a document that is in the possession of the Chief Data Officer, containing— (i) data provided to the Chief Data Officer under section 9 by the data sharing body or under section 10 by a designated body; or (ii) information provided to the Chief Data Officer under section 12 by the data sharing body or under section 13 by a designated body; or (iii) data sets created following data integration conducted by the Chief Data Officer under this Act; or (b) a document that is in the possession of a data analytics body, containing— (i) data provided to the data analytics body under section 15(2) by a data sharing body or a designated body; or (ii) data provided to the data analytics body under section 16 by the Chief Data Officer; or (iii) data sets created by a data analytics body following data integration conducted by the data analytics body under this Act. (2) In this section— document has the same meaning as in the Freedom of Information Act 1982. -- 22 of 33 -- Part 5—Offences Victorian Data Sharing Act 2017 No. 60 of 2017 21 Authorised by the Chief Parliamentary Counsel Part 5—Offences 26 Unauthorised access to, use of or disclosure of data or information—summary offence (1) A person must not, without reasonable excuse, access, use or disclose any data or information obtained by the person under this Act other than— (a) in accordance with this Act; or (b) in connection with the performance of functions under this Act. Penalty: 240 penalty units or imprisonment for 2 years or both. (2) Without limiting what may be a reasonable excuse, it is a reasonable excuse if the person took reasonable steps not to access, use or disclose the data or information. Note See also section 72 of the Criminal Procedure Act 2009, which deals with the evidential burden of proof. 27 Unauthorised access to, use of or disclosure of data or information—indictable offence (1) A person must not access, use or disclose any data or information obtained by the person under this Act if the person knows or is reckless as to whether the data or information may be used (whether by the person or any other person) to— (a) endanger the life or physical safety of any person; or (b) commit, or assist in the commission of, an indictable offence; or (c) impede or interfere with the administration of justice. Penalty: 600 penalty units or imprisonment for 5 years or both. -- 23 of 33 -- Part 5—Offences Victorian Data Sharing Act 2017 No. 60 of 2017 22 Authorised by the Chief Parliamentary Counsel (2) An offence against subsection (1) is an indictable offence. -- 24 of 33 -- Part 6—Reporting and review Victorian Data Sharing Act 2017 No. 60 of 2017 23 Authorised by the Chief Parliamentary Counsel Part 6—Reporting and review 28 Report to the Health Complaints Commissioner (1) The Chief Data Officer must provide a report to the Health Complaints Commissioner on the operation of the Centre in relation to health information at intervals of no longer than 12 months. (2) A report under subsection (1) must include the following— (a) the steps taken by the Chief Data Officer to ensure compliance with the Health Records Act 2001; (b) details of the data integration and data analytics work projects undertaken by the Centre that have used health information during the reporting period and whether the projects have met key objectives and achieved specified outcomes; (c) the number of requests for data containing health information made by the Chief Data Officer; (d) the number of times a data sharing body has failed or refused to respond to a request for data containing health information from the Chief Data Officer; (e) an assessment of issues and challenges that have arisen; (f) any other information requested by the Health Complaints Commissioner. -- 25 of 33 -- Part 6—Reporting and review Victorian Data Sharing Act 2017 No. 60 of 2017 24 Authorised by the Chief Parliamentary Counsel 29 Report to the Information Commissioner (1) The Chief Data Officer must provide a report to the Information Commissioner on the operation of the Centre in relation to personal information (other than health information) at intervals of no longer than 12 months. (2) A report under subsection (1) must include the following— (a) the steps taken by the Chief Data Officer to ensure compliance with the Privacy and Data Protection Act 2014, including but not limited to the Information Privacy Principles and the Victorian protective data security framework; (b) details of the data integration and data analytics work projects undertaken by the Centre that have used personal information (other than health information) during the reporting period and whether the projects have met key objectives and achieved specified outcomes; (c) the number of requests for data containing personal information (other than health information) made by the Chief Data Officer; (d) the number of times a data sharing body has failed or refused to respond to a request for data containing personal information (other than health information) from the Chief Data Officer; (e) an assessment of issues and challenges that have arisen; (f) any other information requested by the Information Commissioner. -- 26 of 33 -- Part 6—Reporting and review Victorian Data Sharing Act 2017 No. 60 of 2017 25 Authorised by the Chief Parliamentary Counsel 30 Review of Act after 5 years The Minister must— (a) cause a review to be made of the first 5 years of operation of this Act; and (b) cause a copy of a report of the review to be laid before each House of Parliament on or before the end of the period of 12 months after the day on which the review is completed. -- 27 of 33 -- Part 7—Other matters Victorian Data Sharing Act 2017 No. 60 of 2017 26 Authorised by the Chief Parliamentary Counsel Part 7—Other matters 31 Delegation (1) The Chief Data Officer may by instrument delegate any power, function or duty of the Chief Data Officer under this Act or the regulations made under this Act, other than this power of delegation, to a person employed in or engaged by the Department responsible for administering this Act. (2) The Secretary to a Department may by instrument delegate any power, function or duty of the Secretary (in the Secretary's capacity as a data analytics body) under this Act or the regulations made under this Act, other than this power of delegation, to a person employed in or engaged by the Department. (3) The responsible officer of a data sharing body, a designated body or a data analytics body may by instrument delegate any power, function or duty of the responsible officer under this Act or the regulations made under this Act, other than this power of delegation, to a person employed in or engaged by the data sharing body, designated body or data analytics body, as the case requires. 32 Regulations (1) The Governor in Council may make regulations for or with respect to any matter or thing required or permitted by this Act to be prescribed or necessary to be prescribed to give effect to this Act. (2) Without limiting subsection (1), the regulations may— (a) prescribe a body to be a data sharing body; and -- 28 of 33 -- Part 7—Other matters Victorian Data Sharing Act 2017 No. 60 of 2017 27 Authorised by the Chief Parliamentary Counsel (b) prescribe a body to be a data analytics body; and (c) prescribe a class of data to be restricted data; and (d) prescribe a provision to be a secrecy provision to which Division 2 of Part 4 does not apply. (3) The regulations may— (a) be of general or limited application; and (b) differ according to differences in time, place or circumstances; and (c) confer a discretionary authority or impose a duty on a specified person or a specified class of person. 33 Chief Data Officer may issue policies and guidelines (1) The Chief Data Officer may issue policies and guidelines in relation to the administration of this Act. (2) Policies or guidelines issued under subsection (1) may cover the following matters— (a) privacy and confidentiality preserving procedures for treating data; (b) data security safeguards in relation to data handling and storage under this Act; (c) secure technology platforms for data handling and storage under this Act; (d) risk mitigation frameworks for data handling and storage, such as proportionate risk assessment tools and techniques; (e) protocols for data integration and data analytics work projects, such as project design, governance and data handling arrangements; -- 29 of 33 -- Part 7—Other matters Victorian Data Sharing Act 2017 No. 60 of 2017 28 Authorised by the Chief Parliamentary Counsel (f) any other matters the Chief Data Officer considers relevant. (3) The Chief Data Officer may publish policies and guidelines issued under this section. (4) A data sharing body, a designated body or a data analytics body must have regard to policies or guidelines issued under subsection (1). -- 30 of 33 -- Part 8—Amendment of other Acts and repeal of amending Part Victorian Data Sharing Act 2017 No. 60 of 2017 29 Authorised by the Chief Parliamentary Counsel Part 8—Amendment of other Acts and repeal of amending Part 34 Amendment of Privacy and Data Protection Act 2014 (1) In Schedule 1 to the Privacy and Data Protection Act 2014, in the definition of unique identifier, for "but does not include an identifier within the meaning of the Health Records Act 2001" substitute "and does not include an identifier within the meaning of the Health Records Act 2001". (2) In clause 10.1(b) of Schedule 1 to the Privacy and Data Protection Act 2014, after "required" insert "or authorised". 35 Amendment of Family Violence Protection Amendment (Information Sharing) Act 2017 (1) In section 20 of the Family Violence Protection Amendment (Information Sharing) Act 2017, in proposed section 15A of the Privacy and Data Protection Act 2014, subsections (2), (3) and (6) are repealed. (2) In section 20 of the Family Violence Protection Amendment (Information Sharing) Act 2017, in proposed section 15A(7) of the Privacy and Data Protection Act 2014— (a) the definitions of family violence assessment purpose, family violence protection purpose, linked person and primary person are repealed; (b) in the definition of person of concern, for "2008;" substitute "2008.". -- 31 of 33 -- Part 8—Amendment of other Acts and repeal of amending Part Victorian Data Sharing Act 2017 No. 60 of 2017 30 Authorised by the Chief Parliamentary Counsel 36 Repeal of amending Part This Part is repealed on the first anniversary of the day on which this Act comes into operation. Note The repeal of this Part does not affect the continuing operation of the amendments made by it (see section 15(1) of the Interpretation of Legislation Act 1984). ═════════════ -- 32 of 33 -- Endnotes Victorian Data Sharing Act 2017 No. 60 of 2017 31 Authorised by the Chief Parliamentary Counsel Endnotes 1 General information See www.legislation.vic.gov.au for Victorian Bills, Acts and current authorised versions of legislation and up-to-date legislative information. † Minister's second reading speech— Legislative Assembly: 18 October 2017 Legislative Council: 2 November 2017 The long title for the Bill for this Act was "A Bill for an Act to establish the office of Chief Data Officer, to promote the sharing and use of public sector data for the purpose of supporting government policy making, to amend the Privacy and Data Protection Act 2014 and for other purposes." -- 33 of 33 --