Australian Government announces A$65 million investment to reform country’s data system
On 1 May the Australian Government announced an investment of A$65 million over the next four years to reform the Australian data system and introduce a range of reform measures to implement the Productivity Commission’s recommendations on data availability and use.
The reforms will focus on three key areas, namely a new Consumer Data Right, establishment of a National Data Commissioner and new legislative and governance arrangements. These reforms are expected to help empower Australians, governments, industries and researchers to use and share data, while maintaining the strict privacy, security and transparency safeguards essential to maintain trust in the system.
Creation of a new Consumer Data Right
The Productivity Commission recommended the Australian Government introduce a Consumer Data Right to improve consumer control over the data which businesses hold about consumers' use of products and services.
Providing consumers better access to this data, and the ability to direct data be transferred to data recipients, would make it easier for them to find a better deal and share their information only with parties they trust. For example, consumers could share their data with trusted service providers or with comparison services to investigate other service offerings. This in turn is expected to drive greater competition between businesses to attract new customers and encourage new business models to unlock the value of consumer data.
In November 2017, the Australian Government announced that it will a national Consumer Data Right, allowing customers open access to their banking, energy, phone and internet transactions. In February 2018, the Australian Government Treasury released a review report into Open Banking in Australia. Open Banking will be the first implementation of the Consumer Data Right.
The Consumer Data Right will be designed to ensure strong privacy protections and security safeguards. Government and industry will develop appropriate data standards for the protection, access and transfer of data.
To ensure appropriate oversight and regulation of the Consumer Data Right, the Office of the Australian Information Commissioner and the Australian Competition and Consumer Commission will have separate but complementary enforcement roles and there will be robust information sharing arrangements between the two.
The Office of the Australian Information Commissioner will have primary responsibility for individual consumer complaints, and the Australian Competition and Consumer Commission will focus on ensuring the system as a whole operates as intended, including supporting competition and good consumer outcomes. Consumers will be able to direct complaints to a single contact point, run by the OAIC, who will handle complaints using a 'no wrong door' approach.
The Consumer Data Right will be introduced primarily through changes to the Competition and Consumer Act 2010. The Treasurer will lead implementation of the Consumer Data Right.
Establishment of a National Data Commissioner
The Productivity Commission recommended establishing a new statutory role with a supporting office, to take responsibility for a reformed national data system.
The Australian Government will establish a position to be called the National Data Commissioner and will introduce a new data sharing and release framework. The National Data Commissioner will be the trusted overseer of the public data system.
The Commissioner will provide a consistent and well-defined approach to data management, including proactively managing risks, dealing with complaints and monitoring the integrity of the data sharing and release framework. This would increase community trust and confidence in the way government manages and uses its data.
The Australian Bureau of Statistics will provide technical guidance and support to the National Data Commissioner, while a new National Data Advisory Council will advise the National Data Commissioner on ethical data use, technical best practice, and industry and international developments.
Drafting and implementing new legislative and governance arrangements
The Productivity Commission recommended a legislative pathway to modernise Australia’s regulatory framework governing data availability and use.
The Australian Government will introduce laws underpinning a new system for data sharing and release in Australia.
The legislation will establish institutional and governance arrangements including Accredited Data Authorities and a trusted user framework to facilitate better sharing of data. The legislative package will set clear rules and expectations for data sharing and release, including making clear when data can be shared, and embedding strong safeguards for sensitive data and effective risk management practices.
In 2009, Australia’s National Statistical Service instituted an administrative process to accredit agencies to serve as 'Integrating Authorities' for data being brought together to create more valuable, statistical and research datasets. The Government plans to enact similar governance arrangements for Accredited Data Authorities in a data sharing and release legislative package.
Accredited Data Authorities will engage with data custodians and users will work together to implement a trusted user framework along the lines of the Five Safes model developed in the United Kingdom. Data sharing agreements between data custodians, Accredited Data Authorities and data users will be a key part of the governance framework. These agreements will articulate risk management processes to effectively assess and manage the risks associated with sharing and release of data for which they are responsible. However,, accountability for the risks of sharing and releasing data will remain with data custodians.
The Productivity Commission noted that in some cases, secrecy provisions in existing laws could unreasonably hinder data sharing and release for matters of public interest. The Government has responded that the data sharing and release legislative package will provide a robust authorisation process, balancing the operation of secrecy provisions with data sharing and release for public interest purposes. The new legislation will not affect existing protections applying to particularly sensitive data, such as national security and law enforcement data.