Authorised officers and individuals

The Data Availability and Transparency Act 2022 (the Act) establishes a DATA Scheme for sharing Australian Government data. Under the DATA Scheme, Commonwealth bodies are data custodians of public sector data and they are authorised to share their data with entities that are accredited under the DATA Scheme. The Act also authorises accredited users to collect and use the data._¹

The sharing of public sector data by a data custodian or receiving data as a data user must be authorised by an authorised officer of the entity. The Act recognises the heads of all entities that participate in the DATA Scheme as authorised officers. These include:

• Secretaries of Commonwealth departments and heads of other agencies under the Public Service Act 1999
• CEOs of corporate Commonwealth entities and Commonwealth companies
• Principal officers of prescribed entities under the Freedom of Information Act 1982
• Heads of State and Territory government bodies.

The Act also recognises heads of other bodies corporate covered by the Act to be authorised officers. For example, the Chief Executive Officer or any director of the entity. In relation to Australian universities, these would be at the Vice Chancellor level.

An authorised officer can also authorise certain other persons in the entity to do things in relation to the DATA Scheme. This includes the head of the entity authorising another individual to be the authorised officer for the entity for the purposes of the DATA Scheme.

Only authorised officers can do certain things under the DATA Scheme

Various actions that may be taken by entities under the Act must be taken on behalf of the entity by an authorised officer of the entity or, in some cases, by another person authorised by the authorised officer. For example, an application for accreditation must be made by an authorised officer on behalf of the entity (see section 76). Other important actions include:

• entering into data sharing agreements and ensuring all the requirements of a data sharing agreement are met (see section 18(2))
• entering into variations to data sharing agreements (see section 18(3))
• providing authority to share data in a data sharing project where there is more than one data custodian (see section 13(3))
• deciding (and being responsible for making a record of that decision) that the risk of substantial harm caused by a proposed data integration project is low (see section 16D(4), (5), and (6)).

Only individuals can be authorised officers and only individuals can be authorised to do particular things under the Act. A committee or governance body cannot be an authorised officer or authorised individual.

Authorising others to do certain things under the DATA Scheme 

In some cases, the Secretary, Agency Head, Chief Executive Officer or other entity head may find it administratively efficient to authorise another person to undertake activities under the Act on their behalf.  Table 1 below sets out who can become authorised officers or authorised individuals and what they can be authorised to do under section 137(2), (3) and (4).

Table 1: Authorised officers & individuals

Authorisations cannot be limited 

An authorised officer or authorised individual is responsible for either Activity 1, Activity 2, or Activity 3 as set out in Table 1.

Where an individual is authorised to undertake Activity 3 in Table 1, the individual must be authorised to do all of the activities in Activity 3. The individual cannot be limited in the activities they can do.

Authorisations need to be made by written instrument

Authorisations must be made by the authoriser by a written instrument. Depending on the instrument, there could be limitations imposed on powers or functions of authorised individuals. For example, an individual only authorised to do Activity 2 is not authorised to do the activities in Activity 1 or 3.

By way of an example only, a downloadable sample instrument is provided at the end of this guidance. You may also wish to view the Data Availability and Transparency (Authorised Officer - Treasury) Authorisation 2022 prepared by the Department of the Treasury.

Entities should retain the original of all authorisation instruments. There is no requirement to send a copy of the written instrument to the National Data Commissioner. However, the Commissioner has the power to request and inspect copies of authorisation instruments from time to time.  

Revoking or varying authorisations

The authoriser may revoke an authorisation by written instrument. 

Authorised Individuals cannot delegate their responsibilities

Individuals authorised to be an authorised officer, or to do Activity 2 or 3 in Table 1, cannot delegate their responsibilities or authorise another person to undertake responsibilities on their behalf. They must personally exercise them. 

Designated individuals

The Act authorises a designated individual for the entity to engage in conduct that is, or part of, the sharing, collection or use, if the conduct is within the actual scope of the individual’s designation under the Act. However, where a person is a designated individual for the entity, but not an authorised officer or an authorised individual, that person’s actions will not be taken to have been done for the entity, if the action to be done must be done by an authorised officer or an authorised individual.

For more information about designated individuals, see Guidance Note - ‘Designated Individuals - Individuals within a Scheme entity authorised to deal with scheme data’ (forthcoming).

Decisions by a Commonwealth body (as data custodian) not to share data

Decisions by a Commonwealth body, in its capacity as a data custodian, not to share data do not need to be made by an authorised officer. This decision can be made by a designated individual (which includes authorised officers and authorised individuals) if it is within the scope of their designation.

Similarly, an authorised officer is not required to assist the Commissioner in relation to the annual report (for example, reporting requirements on refusals to share data) if another designated individual of the Commonwealth body may fulfil this responsibility.

The data custodian is best placed to decide on the appropriate level of seniority for making such decisions. For example, an appropriate level of seniority in a Department could be an SES employee.

_{1. Commonwealth bodies under the DATA Scheme include non-corporate Commonwealth entities, corporate Commonwealth entities and Commonwealth companies, as defined in the Public Governance, Performance and Accountability Act 2013. See Flipchart of PGPA Act Commonwealth entities and companies for further guidance. Bodies that meet the definition of ‘prescribed authorities’ under section 4(1) of the Freedom of Information Act 1982.}