Implementation report for the 2023 Privacy Impact Assessment

National Disability Data Asset and Australian National Data Integration Infrastructure

The National Disability Data Asset brings together information about all Australians. This helps us to better understand and meet the needs of people with disability.

The Australian National Data Integration Infrastructure is the underlying system that allows us to connect data for the National Disability Data Asset.

A Privacy Impact Assessment (PIA) was done for the National Disability Data Asset in 2023. The PIA recommended ways to manage, reduce or remove privacy risks.

The Department of Social Services, Australian Bureau of Statistics and Australian Institute of Health and Welfare are working together on the National Disability Data Asset. We wrote this report to explain what we have done to meet the recommendations of the PIA.

Meeting the PIA recommendations

The PIA made 6 recommendations.

We worked with stakeholders and governance groups on each recommendation. This included the National Disability Data Asset Council (the Council) and the Australian National Data Integration Infrastructure Board (the Board).

Five of the 6 recommendations are now complete. Recommendation 1 is nearly complete.

Recommendation 1: Principles for adding datasets into the National Disability Data Asset in the future

The Council are finalising a set of principles. The principles will guide decisions about whether datasets should or should not be included in the National Disability Data Asset.

The principles will work together with the National Disability Data Asset Charter (the Charter). The Charter explains how the National Disability Data Asset should and should not be used. It contains principles and rules.

Once the Council have finished working on the principles for adding datasets, we will share them on the National Disability Data Asset website. We will do this in the first half of 2025.

Recommendation 2: Collection notices for data providers

Data providers are government agencies that provide data to the National Disability Data Asset and its underlying system. We wrote some words data providers can use in their collection notices about the National Disability Data Asset. Data providers give these notices to people when they ask for personal information.

We gave the suggested words to data providers in late 2024. They can update or add the words to their notices over time. The words include a link to the full privacy statement on the National Disability Data Asset website.

Recommendation 3: Managing the risk of re-identifying data – review of processes

We developed a strategy to protect the identity of people whose data is in the National Disability Data Asset. We will review the strategy:

• at least once a year
• if we find any major new or changed risks.

This will make sure we keep using best practice when de-identifying data and managing re-identification risks. The review will look at technology and risks as they change in the future.

We will complete the first review by July 2025.

Recommendation 4: Managing the risk of re-identifying data – rules for what is shared

In April 2024, we developed:

• a strategy to protect the identity of people whose data is in the National Disability Data Asset
• the data access, use and release protocol.

The protocol is a set of rules for keeping data safe in the National Disability Data Asset and its underlying system. It includes a process to check that the results of data analysis are correctly de-identified before they leave the underlying system.

Recommendation 5: Managing data breaches

We developed a Data Breach and Incident Response Plan in April 2024.

It explains:

• an approach for dealing with data breaches and incidents in the underlying system
• what each relevant governance group or organisation involved in the data breach must do
• who we need to notify about any breach.

We ran an exercise in October 2024 to see if we can find better ways to respond to a breach. This helped us improve our processes and the Data Breach and Incident Response Plan.

Recommendation 6: Developing a compliance framework

In December 2024, we developed a compliance framework for the National Disability Data Asset and its underlying system. This framework will help assess and report on whether everyone is following the data sharing agreements.

Learn more

We will keep working to protect privacy and keep data safe and secure as we develop the National Disability Data Asset.

Find out more on the National Disability Data Asset website.

You can also email questions to ndda@abs.gov.au.