Artboard 1Icons/Ionic/Social/social-pinterest

Welcome to this edition of Queensland government bulletin - your essential legal reading!

In this special edition of our fortnightly publication, we take a magnifying glass to the issues and reforms that emerged over 2018 in key areas affecting government. We also cast forward to examine the expected major trends and developments for 2019.

Our Queensland government team will also be presenting at our upcoming Queensland government lawyers half day CPD intensive on Thursday 14 February 2019. You can view the program and register for the seminar by clicking here.

Summer Government Bulletin index:

Data & privacy: A monumental year 

By general counsel Lyn Nicholson

2018 was a monumental year for data privacy and protection - globally and in New South Wales. 

On a global scale, the introduction of the EU General Data Protection Regulation (GDPR), the Facebook-Cambridge Analytica data scandal, and Equifax’s record £500,000 fine (and US$287,000,000 remediation costs) for a 2017 security breach has brought data privacy and protection to the forefront of both government and business considerations. 

On a local scale, data privacy and protection continues to make headlines. 

In this article, we recap the big events (and breaches) that have shaped the data and privacy landscape in NSW this year, stemming from the overreach of data using technology.

In March, a NSW resident successfully challenged Transport for NSW’s collection of personal data through the Opal card ticketing system. The complainant argued against the mandatory registration of pensioner and concession Opal cards, which tracked the public transport movements of an identifiable user. The NSW Civil and Administrative Tribunal ruled in favour of the complainant, finding that there was little basis for the collection of the travel information for the stated purpose of enforcement of entitlement to the concession/pensioner travel card. However, the Tribunal has since overturned the decision, allowing an appeal by Transport for NSW in August. 

In August, more than 1,000 confidential medical records were found in a derelict former aged care facility near Helensburgh. NSW Health responded to the data breach by stating that the building had been illegally accessed. Photos from the aged care facility indicate that the site had been illegally accessed since 2015, meaning that NSW Health had failed to take action to secure the records for up to three years. The NSW Government announced an audit of the archived medical records and apologised to the families of those whose records had been exposed to the breach. Following the findings from the audit by NSW Health, the incident may constitute a breach of the Health Records and Information Privacy Act 2002 (NSW) and Health Privacy Principle 5, which requires an organisation holding health information to protect against unauthorised access, use and misuse. 

At the other end of the spectrum, moving from privacy, the NSW Government’s push towards open data continues with ongoing releases of data by Government agencies and continued investment and co-operation by NSW Government agencies responsible for open data including the NSW Information and Privacy Commissioner who, during May, launched a number of online learning resources to further assist the open data process in NSW. At the time of writing, it appears that NSW open data has been successful in the period that it has been running and unlike a range of media reports that have plagued Federal Government agencies misuse of data, it seems that the NSW move towards open data is continuing and continuing to succeed.

Further, the implementation of the EU’s GDPR in May of this year has had a trickle-down effect on the privacy and data considerations of NSW businesses and public sector agencies. The GDPR has extraterritorial reach, applying to all organisations that handle the personal information of EU residents. If a NSW business or government agency has an establishment in the EU, or offers goods or services, or monitors the behaviour of individuals in the EU, it will now need to comply with GDPR requirements. This includes the implementation of measures that ensure compliance with a prescribed set of privacy principles, with the aim of promoting the transparent handling of personal information. So ubiquitous has the GDPR become that the IPC has provided guidance for NSW agencies on the topic on its website.

Public sector data, the proposed Data Sharing and Release Act and implications for governments

By partner Angela Flannery

The Productivity Commission (PC) released the report from its inquiry into public and private sector data in May 2017. As part of its response to that report, the Australian Government announced in May 2018 that it would create a National Data Commissioner to oversee a new data access framework and pass new legislation to remove red tape inhibiting access to data for research and growth (while at the same time ensuring that privacy and data security are protected). This article looks at the current status of those initiatives and the implications for governments generally from sharing a wide range of public data sets.

Productivity Commission recommendations

In its May 2017 report, the PC argued that fundamental change is needed, noting the current regulatory frameworks governing data availability and use, based as they are on risk aversion and avoidance, are not appropriate and inhibit Australian governments, businesses and not-for-profits from taking advantage of the benefits that would arise from greater exploitation of data. 

Amongst other recommendations, the PC proposed a new Data Sharing and Release Act. Under the proposed legislative framework for data sharing and release, a National Data Custodian would have overall responsibility for the implementation of data management policy in consultation with all levels of government. The Custodian would accredit the processes and capabilities of Accredited Release Authorities. Those Authorities were intended to be sectoral hubs of expertise and would be tasked with taking steps to ensure that as many datasets as possible were made available either to trusted users or more widely, where appropriate risk mitigations were in place. Trusted users would be third parties (from both the public and private sectors) with appropriate governance structures and processes in place to address risks associated with data use or release.

Under this proposed framework, all Australian governments would release non-sensitive publicly funded datasets and, on completion of risk assessments, release other more sensitive datasets (either generally or to trusted users). The PC also recommended that “National Interest Datasets” of particularly important public sector data should be designated. For those National Interest Datasets, new access and use arrangements would apply to the exclusion of any existing regulatory regime (whether at a Commonwealth or State/Territory level).

Government’s response 

On 1 May 2018, the Australian Government announced that it would partially implement the PC’s recommendations and would:

  • create a new National Data Commissioner who would oversee the new data access framework, including managing risks, responding to complaints and monitoring the integrity of the framework. The Commissioner would be assisted by a Data Advisory Council, which would provide advice on ethical data use, technical best practice and industry and international developments. The Australian Bureau of Statistics would provide technical guidance and support to the Commissioner
  • establish a new legislative regime to remove the roadblocks to the sharing of public data sets, whilst ensuring the retention of appropriate data safeguards. As recommended by the PC, the establishment of Accredited Data Authorities would be provided for in the legislation. The Government stated the legislation would also establish a trusted user framework. 

National Data Commissioner

An interim National Data Commissioner has been appointed and has been consulting on the proposed draft data legislation, as discussed further below. Information has also been released on the National Data Advisory Council, with the publication of the draft terms of reference. The Council is intended to comprise up to 10 members, including the Commissioner. It is proposed that its first task would be to advise on the development of the draft legislation. 

Consultation on draft legislation

The Australian Government released a consultation paper on the proposed Data Sharing and Release Bill in mid 2018. The Bill is proposed to apply to data collected by all Commonwealth entities and Commonwealth companies, with exceptions for national security/law enforcement and contractual arrangements for purchased data sets. At a very high level, the Bill is to deal with the following matters:

  • the role of the Commissioner would be enshrined in the legislation
  • data sharing and release would be authorised for specified purposes (such as informing and assessing government policy and research and development with public benefits), provided data safeguards are met.

The data safeguards should be able to be flexibly applied, depending on the relevant data, and would be based on the “Five-Safes” disclosure risk management framework, that is:

  • safe data: can the data disclose identity?
  • safe people: can the users be trusted?
  • safe setting: does the access environment prevent unauthorised use?
  • safe outputs: are the project results likely to disclose identity?
  • safe project: is the purpose of use appropriate (with the permitted categories of purpose to be specified in the legislation)?

The following accredited bodies would be put in place:

  • data custodians: These are the Commonwealth entities that collect the data in the first place. Each data custodian would maintain responsibility for the data it collects, including the sharing and release of that data
  • accredited Data Authorities: These would be entities which have relevant experience in dealing with data, such as the Australian Bureau of Statistics, which meet the criteria set by the Commissioner. The role of the Authorities would be to assist data custodians
  • trusted users: Trusted users are the “end-users” of the shared or released data. A user could only be accredited by demonstrating that it is able to safely use that data.

The draft legislation is not expected to be introduced to Parliament before the next Federal election and therefore there is some doubt as to the timing for its implementation and whether changes may be made based on feedback from the consultation process and also potentially a different approach adopted by a future Government.

Implications 

Data is not only important for government policy and decision making but has the potential to unlock many productivity benefits across the Australian economy more broadly.

The fact that the Australian Government is now proposing a new comprehensive regime does not mean that Australian governments do not currently make public data available. For example, data.gov.au provides public access to many thousands of anonymised public data sets published by federal, State, Territory and local governments. There is also legislation at a State level that provides for data sharing, for example, in New South Wales, the Data Sharing (Government Sector) Act 2015 facilitates data sharing between the Data Analytics Centre and other government agencies. South Australia has in place the Public Sector (Data Sharing) Act 2016 and Victoria has the Victorian Data Sharing Act 2017. But these existing data sharing arrangements are not as extensive as they could be.

As noted in the PC’s report, and the consultation paper on the proposed new legislation, there have been many reasons why governments have not in the past provided greater access to the valuable data that they hold. Risk aversion (particularly in relation to data that relates to individuals) and significant amounts of regulation (not all of which is entirely consistent) are the main barriers. A lack of a consistent approach has also been cited as a factor. 

The Australian Government’s new regime is intended to address these issues. As such, if the proposed framework is implemented, it could assist in ensuring that significantly more data sets are available both across the public sector and for private sector use. The regime could be extended in due course, with the co-operation of State and Territory governments, to assist in greater use of the valuable data sets that are held across all levels of government. 

However, feedback on the proposed framework has not been uniformly positive. For example, there has been particular concern expressed as to how the framework will interact with other existing regulation, particularly the Privacy Act 1988 (Cth). There is also concern as to what remedies will be available where data is misused and how compliance will be able to be enforced. These, and other issues raised by stakeholders, are important issues for consideration and should be addressed in the draft legislation to ensure the new framework achieves its ambitious aims. 

Procurement: New national modern slavery laws and legal challenge for government tenders

By partner Scott Alden & Victoria Gordon

Two significant developments in procurement in 2018 will have huge impacts for the procurement space this year.

Last year, we saw the enactment of both Commonwealth and NSW state modern slavery legislation in Australia, reflecting a growing awareness for the need to address modern slavery both domestically and internationally. 

The Modern Slavery Act 2018 (Cth) (the Modern Slavery Act) passed both houses of parliament late last year and was assented to on 10 December 2018. The key operative provisions of the Modern Slavery Act will commence on a date to be fixed by proclamation (yet to be stated) or six months from the assent date if no proclamation date is fixed earlier. 

The Modern Slavery Act will require entities in Australia that have an annual consolidated revenue of more than $100 million to report annually on the risks of modern slavery in their operations and supply chains, and describe their actions to address those risks. 

NSW also introduced similar legislation in June 2018 to combat this issue, although there are some interesting differences between the two regimes which we expect to see further fleshed out this year. 

The other significant change in procurement in 2018 which will have significant impacts this year is the passing of the Government Procurement (Judicial Review) Act 2018 (Cth) (Government Procurement Actwhich will provide suppliers with a statutory platform to challenge a government procurement process in the Federal Court of Australia or Federal Circuit Court of Australia for a breach of the Commonwealth Procurement Rules. Similar to the Modern Slavery Act, the Government Procurement Act will commence on a date to be fixed by proclamation (yet to be stated) or six months from the assent date (19 October 2018) if no proclamation date is fixed earlier.

This is the first time in Australia that tenderers will have a statutory avenue to challenge government procurement; no longer having to rely on existing remedies for breach of process contract, misleading and deceptive conduct or judicial review under administrative law. 

As well as these significant legislative changes there is also increased pressure on business and government to conduct procurement using sustainable processes, especially since the world’s first International Standard for sustainable procurement - ISO 20400 - was published in late 2017. 

Looking forward in 2019, both public and private organisations must now be more acutely aware of the consequences of choices they make regarding what to buy, how to buy it and who to buy it from.

Planning and environment year in review: Shedding light on the Planning Act 2016 (Qld)

By partner Gerard Timbs & senior associate Amelia Prokuda

The year of 2018 saw the delivery of a number of judgments that shed some much needed light on the operation and interpretation of the Planning Act 2016 (Qld) (PA), including the transitional provisions.

The following judgments delivered in 2018 established key principles that will have important implications for developers and assessment managers, in particular local governments.

Pike v Tighe

The High Court of Australia overturned a decision of the Court of Appeal and confirmed that conditions imposed on development approvals remain binding even after the development the subject of the approval has been completed. The Court noted there was nothing in the SPA that indicated conditions of approval had no effect once the development was completed.

Jakel Pty Ltd v Brisbane City Council & Anor

The transitional provisions in the PA have been a source of confusion in the planning and development industry. In particular, it was unclear whether the Planning and Environment Court was required to decide an appeal about a development application made under the Sustainable Planning Act 2009 (Qld) (SPA), but decided after the commencement of the Planning Act 2016 (Qld) in accordance with the SPA or PA. There was a dispute between the parties as to which Act applied. The Court analysed the transitional and other provisions of the PA in detail and found that on appeal, the Court was required to decide the appeal in accordance with the PA, albeit against planning instruments that were in effect at the time the application was made. 

The regimes under the SPA and PA are very similar but the regime under the PA offers more flexibility. For applications lodged under the SPA, assessment managers must decide them in accordance with the SPA. However, in the event of an appeal against the decision, the applicant may have good prospects of success given the greater flexibility under the PA.

Sunland Group Limited & Sunland Developments No 22 Pty Ltd v Gold Coast City Council

The Planning and Environment Court made declarations that a series of infrastructure charges notices issued by Gold Coast City Council were invalid on the basis the ICNs and more specifically the accompanying information notices failed to comply with the requirements of the SPA. The Council failed to provide reasons, which must go beyond a mere explanation of how the charge has been worked out, and therefore failed to provide an ‘information notice’ in accordance with the requirements of the Act. The decision was the subject of an application for leave to appeal to the Court of Appeal which was heard in November 2018. The Court is yet to deliver its decision. Importantly, the same requirement does not exist under the PA.

Waterman & Ors v Logan City Council & Anor

The case concerned an application by Logan City Council for orders to change its position in an appeal against the Council’s decision to grant a preliminary approval with conditions in respect of a development application for a development permit for material change of use and reconfiguration of a lot. The Council sought to rely on further issues in dispute, including that all aspects of the development application should be refused. Even though the Court was satisfied it had jurisdiction to make the order sought, the Court decided not to make the order as it was not satisfied the Council had given an adequate explanation for the change in position. It did not disclose the advice of its experts in support of the change in position, nor did it disclose whether the Council officer providing instructions had delegated authority or if the decision was passed by a Council resolution. The outcome may have been different had the Council disclosed its material and that material demonstrated an adequate explanation for the change in position.

Contacts

Andrew Hynd, Partner - Technology, Media & Communications 
T: +61 7 3135 0642
E: andrew.hynd@holdingredlich.com

Suzy Cairney, Partner - Major Projects & Procurement 
T: +61 7 3135 0684
E: suzy.cairney@holdingredlich.com

Gerard Timbs, Partner - Planning & Environment
T: +61 7 3135 0644
E: gerard.timbs@holdingredlich.com

Jenny Humphris, Partner - Native Title & Indigenous Law 
T: +61 7 3135 0690
E: jenny.humphris@holdingredlich.com

Trent Taylor, Partner - Data & Privacy 
T: +61 7 3135 
E: trent.taylor@holdingredlich.com

Disclaimer
The information in this publication is of a general nature and is not intended to address the circumstances of any particular individual or entity. Although we endeavour to provide accurate and timely information, we do not guarantee that the information in this publication is accurate at the date it is received or that it will continue to be accurate in the future. We are not responsible for the information of any source to which a link is provided or reference is made and exclude all liability in connection with use of these sources.

Share this