Chief Data Officer Guideline: Information sharing agreements under the PRIS Act

About information sharing agreements under the PRIS Act

The Privacy and Responsible Information Sharing Act 2024 (PRIS Act) enables government agencies and specified external entities to responsibly share government information where they may otherwise not be able to do so. The Chief Data Officer issues guidelines under section 201 of the PRIS Act to support responsible information sharing. Parties to an information sharing agreement must have regard for these guidelines. As information sharing commonly involves the exchange of data, references to data in this document should be read as meaning government information.

An information sharing request is the first step for sharing data. If the request is supported and meets the requirements of the PRIS Act, the entities determine appropriate safeguards and then enter into an information sharing agreement, which sets out how data will be disclosed and handled for a permitted purpose. Once the parties have signed this agreement, data can be shared and used according to the terms of the agreement. 

This guideline explains how to prepare an information sharing agreement.

The PRIS Act enables public entities to share data with each other or with specified external entities. Within the agreement, an entity that shares data they hold is known as a data provider, and an entity that will receive and use the data is known as a data recipient.

Before you start

Information sharing agreements are not the starting point for information sharing under the PRIS Act. Before developing an agreement, parties should have completed the request, response and assessment steps. Guidelines on these matters have been issued by the Chief Data Officer. This Guideline focuses on developing and maintaining an information sharing agreement. 

What must I include in an information sharing agreement?

1. Provide details about the agreement

The agreement must state that it is an information sharing agreement for the purposes of the PRIS Act and specify the period of time it will be in force. An agreement can operate for a maximum of five years, after which time the parties may enter into a new agreement for a further period of up to five years. An information sharing agreement comes into force when the Chief Data Officer is notified.

An information sharing agreement established under the PRIS Act must refer to the request to share data (or a Minister’s information sharing direction).

2. Identify the parties to the agreement

The entities that will share data are known as ‘parties’. Each data provider and data recipient for a project must be a party to (and sign) the information sharing agreement.

Information sharing agreements are flexible and can be applied in different ways. A public entity can participate as both a data provider and a data recipient in relation to different information, within a single information sharing agreement. An agreement can also be multilateral, involving two or more providers, or two or more recipients, or both.

The agreement must identify each party and whether the party is a data provider or a data recipient or both. 

3. Include information from the assessments for sharing data

Before entering into an information sharing agreement, the parties conduct the assessments outlined in Chief Data Officer Guideline: Assessments for data sharing under the PRIS Act. 

The agreement must describe the following matters:

• Activities: Identify one or more of the permitted purposes under the PRIS Act that align with your data sharing project. Include a description of the project activity that will use the shared data for the permitted purpose.
• Recipients: An agreement may authorise a data recipient to also provide the shared data and/or any derived information to another entity that is not a party to the agreement, or to publish project outputs. This is known as further disclosure and is sometimes called “on-sharing”. The agreement must name any approved entities and circumstances in which further disclosure is permitted.
• Information: The agreement must clearly describe the data that will be shared. This may include categories of data, specific datasets, lists of data variables and their characteristics, such as date range, geographic scope, population or cohort. Consider attaching these details in a separate schedule to the agreement.  The agreement may also outline any known limitations in the data that affect the way it can be used, and any support a data provider will deliver to enable a data recipient to effectively use and manage the data.
• Settings: The agreement must specify the agreed methods for handling the shared data. This should include how the data will be transferred, stored, accessed, protected and used, including safeguards and breach response arrangements. 
• Outputs: The project may use or interpret the data to generate outputs (known as derived information), such as models, analysis, reports or linked datasets. Describe these outputs in the agreement and specify ownership, use rights and any restrictions on the outputs or intellectual property created as a result of the project. The agreement must set out how the shared data and any outputs will be managed when the agreement ends or a party withdraws.

Any safeguards identified during the assessments must be included in the agreement.

If an Aboriginal information use plan is required, you must attach it as a schedule to the agreement. You may wish to note whether a privacy impact assessment was conducted and how it is made publicly available. 

4. Secrecy provisions, confidential and commercially sensitive data

If the data sharing project relies on the PRIS Act to override a secrecy provision in another Act, the agreement must identify the relevant Act and section number(s) for the secrecy provision and note whether there is any offence or penalty associated with the secrecy provision.

If any of the shared data is confidential or commercially sensitive, the agreement must outline the data provider’s legal obligations and specify how a data recipient must handle the confidential or commercially sensitive data.

5. Explain how contraventions will be managed

You must explain how disagreements between the parties will be managed and whether data sharing may continue or will be suspended while a dispute is being resolved.

The agreement must require each data recipient to comply with key sections of the PRIS Act in relation to managing an information breach involving the shared data. It must also explain what will happen if a data recipient handles data in a way that is not permitted by the agreement. This may include legal or administrative actions, such as escalation pathways, termination clauses, contractual remedies or penalties. Note that section 181 of the PRIS Act allows an information sharing agreement to be enforced as a contract.

6. Outline processes for changing or terminating an agreement

The information sharing agreement may be varied by agreement between the parties, for example to add or remove a data provider or a data recipient, or to make changes to the project description if required. The parties must review the assessments conducted prior to the entering into the agreement, unless the variation is minor. These details must be noted in the agreement.

The agreement must explain that a party can withdraw from the agreement at any time and outline arrangements to be followed if the agreement is terminated or if a party withdraws, including the required notice period and any obligations, noting impacts on the project’s continuity.

An information sharing agreement may be terminated in specific circumstances, which must be outlined in the agreement. Triggers for terminating an agreement may include unauthorised use or further sharing of the data or project outputs, or if the parties mutually agree to terminate the agreement.

The agreement remains in force until its end date, unless terminated earlier. Obligations for handling shared data, derived information and managing information breaches will continue after the agreement ends or a party withdraws. This and any other continuing obligations must be clearly stated in the agreement.

An information sharing agreement may also address any other matters that the parties consider appropriate to include, such as a review of the agreement at specified intervals.

7. Sign the agreement

The agreement is signed by the principal officer or authorised representative of each party.

8. Notify the Chief Data Officer

A data provider must notify the Chief Data Officer within 30 days:

• after a new PRIS information sharing agreement is signed and provide the Chief Data Officer with a copy of the agreement;
• if a PRIS information sharing agreement is varied and provide the Chief Data Officer with a copy of the variation agreement;
• if a party to a PRIS information sharing agreement withdraws from the agreement; and
• if a PRIS information sharing agreement is terminated under section 180 of the PRIS Act.

If you need help…

For advice or assistance in preparing an information sharing agreement, please contact the Office of Digital Government by email at data.sharing@dpc.wa.gov.au.

Download a copy of the Guideline below.