Summary of the 2023 Privacy Impact Assessment Consultation Report

National Disability Data Asset and Australian National Data Integration Infrastructure

The Department of Social Services is working with the Australian Bureau of Statistics (ABS) and Australian Institute of Health and Welfare to create the National Disability Data Asset. We call these 3 Australian government agencies the Commonwealth Partners.

The ABS worked with Maddocks on a Privacy Impact Assessment (PIA). The PIA was for the disability data asset and the underlying system that supports it. That system is called the Australian National Data Integration Infrastructure.

Maddocks is an independent privacy expert. A PIA is a review of a project and how it might affect privacy, including any risks. A PIA suggests ways to manage, reduce or remove privacy risks.

The Commonwealth Partners and Maddocks consulted with stakeholders for the PIA between March and July 2023. Over 150 people came to the sessions. Maddocks wrote a detailed Consultation Report. This summary gives an overview of the feedback and concerns people shared in the consultation sessions.

More information is on the National Disability Data Asset website at Privacy for the National Disability Data Asset.

About the consultation

We wanted to find out what stakeholders think about privacy for the disability data asset and its underlying system. We asked for feedback and any concerns about risks to people’s privacy. Maddocks also asked for feedback about the plans to protect privacy.

Maddocks used the ideas from the consultation to help write the PIA. The Consultation Report and the PIA will help improve the design of the disability data asset and the underlying system that supports it.

Who we consulted

A range of people took part in the consultation sessions. This included:

• people from the disability community including from different backgrounds
• disability organisations that represent people with disability
• privacy organisations
• academics, such as university researchers
• government officials, including officials overseeing the project
• the Office of the Australian Information Commissioner – the national agency that deals with privacy and information access rights
• state and territory agencies that deal with privacy and information access rights
• data providers from Australian, state and territory governments.

How the consultation worked

We held 12 sessions, each with different groups. The sessions were online and ran for 2 hours. Deafblind Australia helped run 2 sessions with people with disability. Inclusion Australia, with help from Down Syndrome Australia, ran a session for people with intellectual disability.

Summary of the feedback

In the consultation sessions, people told us they strongly supported developing the disability data asset. Several people said that the disability data asset could give us better information to develop policy ideas. And this could lead to practical and positive effects on the lives of people with disability.

This feedback summary focuses on the key themes that came up during the sessions. Some comments include the type of stakeholder who gave the opinion. For example, disability organisations.

1. Data handling

Stakeholder feedback

• Several people asked about the rules for keeping and destroying information in the disability data asset. Privacy organisations in particular asked about this.
• Several people asked how we will maintain data quality and accuracy. For example, what we would do about information in the asset that has become inaccurate.

Commonwealth Partner comments

The Commonwealth Partners noted that they are considering how much detail will be in the datasets. A dataset is a collection of information, records and facts.

They are also considering standards for the quality of data.

They will share this information with the public once they decide. The National Disability Data Asset Charter (the Charter) will include a commitment around data quality.

The Commonwealth Partners are also developing an approach to keep and destroy data. This approach is in line with the Archives Act 1983 and the Privacy Act 1988.

2. Use and access

Stakeholder feedback

• Several people asked about limits around access to the data. For example, will disability organisations be able to access detailed data for analysis? Or will they only be able to access summaries of the data?
• Data providers asked how we’ll make sure researchers use and analyse data in the right way. For example, is there a plan for experts to check the quality of analysis and findings before they are published?
• Several people were concerned if the data could be used for different purposes over time. And if this means people could misuse the data.

Commonwealth Partner comments

The Commonwealth Partners noted that only certain groups could access detailed data in the disability data asset for analysis. They must be accredited under the Data Availability and Transparency Act 2022. Currently the groups that could be accredited are Australian, state and territory government agencies and Australian universities.

For-profit and other non-government organisations can’t currently be accredited under this Act. But these organisations can use summaries of the data. They can also access de-identified data if they have a contract with an accredited organisation.

All research projects must have approval to access the data. This approval will depend on data sharing agreements and the approved uses of the data, as set out in the Charter.

3. Transparency and consent

Stakeholder feedback

• There was concern that we could include people’s data in the disability data asset without their consent. This concern came up from several organisations across different sessions.

Commonwealth Partner comments

The Commonwealth Partners explained that the disability data asset will use information that government agencies already have. Government agencies won’t collect any new information just to include in the disability data asset.

Information will only be shared if it is legal to do so. There are various legal pathways, including under the Data Availability and Transparency Act. Strict rules must be met to allow data sharing without consent.

We will publish a list of the datasets included in the asset on the National Disability Data Asset website.

4. Re-identification risk

Stakeholder feedback

• A key concern was the risk that people whose data is in the disability data asset could be re-identified. For example, someone using the data could find out who the people are.
• People asked about the risk of artificial intelligence and machine learning being used to re-identify people in the future.

Commonwealth Partner comments

The Commonwealth Partners noted that the Charter doesn’t allow re-identification for any purpose. There are many ways the Commonwealth Partners will manage this risk. For example, accredited data service providers will use the separation principle. This means that they keep personal information like names and addresses separate from the analytical data, such as employment status.

The Commonwealth Partners also noted the concerns about the greater risk of data being re-identified in the future. They agreed we must review processes as technology and risks change in the future.

5. Disability indicators

Stakeholder feedback

• Several people asked how we would record disability and type of disability across the different datasets that make up the disability data asset. What guidelines or indicators would we use?

Commonwealth Partner comments

The Commonwealth Partners explained that they are working with a range of stakeholders to develop disability indicators. This includes people from the disability community and research experts.

The Commonwealth Partners will use what we learned in the Pilot phase of the project to develop the disability indicators. We agreed it’s important not to take a ‘one size fits all’ approach. We will continue to consider how to define disability in the disability data asset. We will also consider how the data is organised and maintained.

6. Consultation with the disability community

Stakeholder feedback

• Several people asked how much we consulted the disability community. They also asked how involved the disability community is in the design of the disability data asset.
• Someone also asked if information would be in plain language and translated into other languages. In particular, information explaining complex ideas and privacy.

Commonwealth Partner comments

The Commonwealth Partners noted there have been workshops with disability organisations. This was to make sure the design of the asset is in line with what the disability community expects. The National Disability Data Asset Council (the Council) will also oversee the disability data asset. The Council will be made up of government members, researchers and members of the disability community.

Information about the project will be available in different languages and formats. This includes Easy Read, Auslan and plain language.

There is a range of accessible information on the National Disability Data Asset website. We will keep updating the website with more information as we have it.

7. Governance

Stakeholder feedback

• People wanted to understand what guides the laws that will support sharing data into the disability data asset. Data providers in particular asked about this. People asked if the approach would be the same for the whole country, since there are different laws in each state and territory. They also asked if data providers would be able to approve use of data and authorise projects.
• People asked how we will oversee how organisations use data after they get access to the disability data asset.
• Another person asked if there would be a way for people in the community to take action if they felt their personal information had been misused.

Commonwealth Partner comments

The Commonwealth Partners noted that they are still developing the legal framework for the disability data asset. They will base it on the Data Availability and Transparency Act and other key laws. The legal framework doesn’t cover state or territory laws about data. States and territories are deciding their own legal pathways to share data with the disability data asset.

Governments have now agreed to the legal framework. But it wasn’t final at the time of the consultation sessions. Because of this, some government stakeholders said it was hard to comment on the privacy aspects of the asset.

The Council is expected to set up a Disability-informed Ethical Oversight Panel. It will be made up of members from the disability community or people who represent them. The Panel will check that projects applying to use the disability data asset will ‘do no harm’ to the disability community.

8. Ethics

Stakeholder feedback

People pointed out when handling data there was a need to focus on privacy. They also pointed out the need to be aware of different cultures when handling data. In particular, for information about First Nations people with disability.

People recommended that we:

• require organisations and governments to consider the data sovereignty of First Nations people with disability – this includes the rights of First Nations people to manage their own data and to benefit from using their data
• require organisations and governments to have the skills to understand data sovereignty
• require the way we manage the disability data asset to meet ethical, legal and privacy standards. For example, by considering First Nations research methods and data sovereignty throughout projects.

They also recommended people who use the disability data asset get training on:

• different cultures. This will ensure cultural awareness, to make sure approved researchers apply this knowledge when they assess research findings.
• the social model of disability. This model says that society puts limits on what people with disability can do. It seeks to change society to accommodate people with disability. For example, by having accessible ways to get into a building.
• the correct language to use when writing about research findings. This is so the impacts of findings benefit the community and don’t cause harm

Commonwealth Partner Comments

The Commonwealth Partners noted this feedback. They will take it to the Council to consider once the Council is set up.