Review of the Victorian Public Service COVID-19 Data Sharing Framework
The Data Sharing Framework expired on 31 December 2020. The Department of Premier and Cabinet is reviewing the framework in line with Cabinet's endorsement to extend the Data Sharing Policy and Heads of Agreement beyond coronavirus (COVID-19). The revised framework will support public health, recovery and cross-portfolio data needs, and InsightsVictoria. For more information, email the Victorian Centre for Data Insights: .
This policy responds to the urgent need for data sharing between VPS agencies and with Commonwealth agencies to support the management of COVID-19 response and recovery. It establishes that VPS agencies have a ‘responsibility to share’ to meet the challenges posed to the Victorian community by COVID-19. It adopts the Commonwealth Data Sharing Principles to help the VPS fulfil that responsibility.
Policy context and purpose
The Commonwealth and state governments all acknowledge that access to data is critical for responding to and recovering from the impacts of COVID 19. On 1 May 2020, Ministers at the COAG Australian Data and Digital Council (ADDC) agreed as a priority to facilitate COVID-19 related data sharing and examine barriers. Ministers also agreed to create a cross-jurisdictional Data and Analytics Working Group.
This policy is an important part of Victoria’s contribution to the national effort and will assist VPS agencies to access the data they need to meet the challenges of COVID-19. It facilitates the expeditious sharing of data between VPS agencies and with the Commonwealth, while ensuring the right safeguards and controls are in place.
Establishing the ‘responsibility to share’
This policy establishes a clear responsibility on VPS agencies to share data between themselves and with Commonwealth agencies.1 This obligation applies where the requesting agency (either another VPS agency or a Commonwealth agency) has demonstrated a clear need for data to address a COVID-19 priority, and there is no legitimate basis to refuse the request.
A requesting agency may issue a formal request for data under this policy, setting out the need for the data. The agency in receipt of the request must respond within 14 days by providing the data or setting out the reasons for refusal in writing. A copy of the refusal should be sent to the Secretary, Department of Premier and Cabinet. These arrangements are similar to the framework established under the Victorian Data Sharing Act 2017 (VDS Act).
As per the VDS Act, a legitimate reason for refusal includes where the sharing would contravene a law or legal obligation, would prejudice an inquiry or legal proceeding, or may endanger an individual. A request may also be refused if the proposed sharing arrangement does not satisfy the Commonwealth Data Sharing Principles.
Applying the Commonwealth Data Sharing Principles
In deciding whether or not to share, VPS agencies should be guided by the Commonwealth Data Sharing Principles, which are set out in the Office of the National Data Commissioner’s . The Commonwealth Data Sharing Principles are based on the Five Safes Framework, which is the internationally recognised risk management framework used widely in the Victorian Government. It promotes a flexible, principles-based approach to enable safe and effective sharing of data held by the public sector in a way that delivers public benefit, protects privacy and maintains confidentiality. Adopting the Commonwealth Data Sharing Principles not only reflects that many of the core considerations are the same in the Victorian context,2 it also ensures a nationally consistent approach wherever possible. This aligns with the approach adopted by the ADDC Data and Analytics Working Group which proposes that all data custodians in states and territories apply the Commonwealth Data Sharing Principles when considering COVID-19 data sharing with the Commonwealth. A consistent approach facilitates uniformity in data sharing conditions and streamlines governance.
Coordination of requests to and from the Commonwealth
The ADDC Data and Analytics Working Group has requested that COVID-19 data sharing between states and the Commonwealth be coordinated through a central point. The Victorian Centre for Data Insights (VCDI) has been nominated to facilitate Victorian requests. In this respect, requests to and from Commonwealth agencies should be coordinated through the Chief Data Officer of the Victorian Government at .
Where to go for help
VCDI is available to assist agencies to navigate this policy and the Commonwealth Data Sharing Principles, including guidance around data sharing agreements and memorandums of understanding where they are required. Queries can made directly to VCDI at . The Office of the Victorian Information Commission (OVIC) and Health Complaints Commissioner (HCC) can assist agencies with issues concerning personal information and health information respectively. OVIC and HCC have issued to help VPS agencies understand their privacy obligations during COVID-19. The Commonwealth also has helpful online resources, including information about .
Governance and review
The administration of this policy will be overseen by the Missions Coordination Committee (MCC). The policy will continue in effect until 31 December 2020 or the date on which the MCC is disbanded, whichever is later. It is the intention that this policy will be reviewed prior to its cessation, to consider whether elements of the policy are carried forward to ensure the VPS continues to realise the value of sharing data to improve policy and services for Victorians.
1 The ‘responsibility to share’ is found in the Commonwealth Data Sharing Principles, which defines sharing as making data available to another agency, organisation or person under agreed conditions.
2 Noting that where there are definitional differences between the Commonwealth Data Sharing Principles and Victorian law and policy (e.g. the definition of ‘personal information’), Victorian definitions shall apply.
Reviewed 31 January 2021