PC News - August 2017
Data availability and use - capturing the opportunities of the digital age
Frameworks and protections for data access require major reform to ensure Australia does not miss the economic opportunities provided by the new era of digitisation.
Effective use of data is integral to the efficient functioning of the modern economy. Extraordinary growth in data generation and usability has enabled a kaleidoscope of new business models, products and insights. Improved data access and use can enable development of innovative products and services that transform everyday life, drive efficiency and safety, create productivity gains and allow better decision making.
In 2014, the Financial System Inquiry recommended a review of the benefits and costs of increasing the availability and improving the use of data. And in 2015, the Harper Review of Competition Policy recommended consideration be given to ways of improving individuals’ ability to access their own data to inform consumer choices. The Australian Government subsequently asked the Productivity Commission to undertake an investigation into options for improving the availability and use of data – from both the public and private sectors. The Commission’s final report was released in May 2017.
Risks from better data use are real but manageable
Increasing data availability and enabling wider use would provide enormous benefits, but there are risks involved. These risks vary with the nature of the data holding, and the purpose for which it is used. Participants in the Commission’s inquiry indicated significant risks related to the potential to identify persons or businesses within datasets. In the Commission’s view, these risks – and the desire for privacy and confidentiality – should not be downplayed. They are real and important. But many of them are able to be managed – better than they are now – with the right policies and processes.
Fundamental change is needed
The Commission argues that the legal and policy frameworks under which public and private sector data is collected, stored and used (or traded) in Australia are ad hoc and not contemporary. Privacy has dominated access decisions to date, but privacy is only one, very defensive, aspect of data use. Adding more ad hoc adjustments to existing structures and legislation will not bring about the cultural change necessary in Australia to securely harness the opportunities presented by data. Fundamental and systematic change is needed to the way Australian governments, businesses and individuals handle data.
The Commission has recommended the creation of a new, broad-reaching Framework designed to endure beyond current technologies, policies, personnel and institutional structures. It takes account of the significant differences in data types and uses, and recognises that any associated risks must be managed well.
The Commission concluded that legislative change is needed as a basis for reform. This would involve the creation of a new Commonwealth act – the Data Sharing and Release Act (DSR Act) that would apply to all digital data. By giving consumers new rights to use their digital data and data holders permission to be pro-active about data possibilities, the DSR Act creates a new lens through which to view data; the lens of a valuable asset being created and utilised, not merely a risk or an overhead.
Australia’s health data – an underutilized resource that could improve health outcomes
Australia’s health sector exemplifies both the opportunities for greater data use and many of the limitations of current data frameworks and protections.
Due to a multitude of legal, institutional and technical reasons, health information in Australia is poorly used compared to the use of health data in other developed countries. This has significant implications. At the individual level, patients are often required to act as information conduits between the various health care providers from whom they are receiving treatment. Inadequate information can lead to errors in treating patients. At the system level, inefficient collection and sharing leads to data gaps and unnecessary expenditure. Further, the lengthy approval process for researchers requesting access to personal data limits their ability to make potentially life-saving discoveries.
Improved access to health data can enable policy makers and researchers to:
- identify emerging health issues within communities and factors that contribute to particular medical conditions;
- assess the safety of pharmaceuticals and other treatment options on an ongoing basis; and
- evaluate the effectiveness and efficiency of health program delivery and policy.
In the United Kingdom, administrative hospital records linked (via a unique patient health service number) between a number of cancer screening registries have been used to improve how and when cancer is diagnosed (to increase early detection and survival). Undertaking similar analysis in Australia would require linking of data held by a range of groups, including data from Medicare Australia, the Australian Government Department of Health and its counterparts in the States and Territories, various cancer registries and other organisations.
The new Framework
The Commission’s recommended Framework comprises two facets:
- A new legislated consumer right enabling opportunities for active data use by those who originate the data (i.e. individuals and businesses) and consequent fundamental reinvigoration of Australia’s competition policy.
- A structure for data sharing and release that would allow access arrangements to be dialled up or down according to the different risks associated with different types of data, uses and use environments.
Under current arrangements consumers have little capacity to choose how digital data about them is used, and organisations and governments frequently make decisions about the use of individuals’ data on their behalf (taking into account privacy principles).
The Commission recommends establishing a new Comprehensive Right for Australian consumers (both individuals and small businesses) to obtain and use their own digital data. This new right would provide:
- powers for consumers (including small businesses) to view, request edits or corrections, and be advised of trade to third parties of digital data held about them, similar to privacy rights but with a focus on supporting data use in the digital era; plus
- a new right to have a copy of their consumer data provided either to them or directly to a nominated third party, such as a new service provider, in order to obtain a competitive offer or other benefit.
The right for individual and small business consumers to request that their data be transferred to a third party has the potential to enhance competition between providers in open markets, and would create greater opportunity for innovation by firms, lift accountability and improve service delivery.
Individuals are likely to be more willing to allow data about themselves to be used by private and public organisations, provided they understand why and how the data is being used, can see tangible benefits, and have control over who the data is shared with.
The second facet of the Commission’s recommended Framework is the creation of a data sharing and release structure that signals to all data custodians a strong and clear cultural shift towards better data use and which can be dialled up for the sharing or release of higher-risk datasets.
Facet 1 – A comprehensive right for Australia’s consumers
Facet 2 – A scalable risk based approach
- For datasets designated as National Interest Data (see summary of key recommendations below), all current restrictions to access and use would be replaced by new arrangements under the proposed DSR Act. National Interest Datasets would be resourced by the Commonwealth as national assets.
- A suite of Accredited Release Authorities would provide integration, maintenance of, and streamlined access to, National Interest Datasets as well as to other datasets to be linked and shared or released.
- A streamlining of ethics committee approval processes would provide more timely access to identifiable
data for research and policy development purposes.
The incremental costs of more open data access and use will be outweighed by the opportunities to reap the benefits presented by digital data.
A new framework for sharing and release of data: summary of the Commission’s key recommendations
A comprehensive right for consumers
Consumer data must be provided on request to consumers (both individuals and small businesses) or to a designated third party in order to exercise a number of rights, summarised as the Comprehensive Right to access and use digital data. This Comprehensive Right would enable consumers to share in perpetuity joint access to and use of their consumer data with the data holder; receive a copy of their consumer data; request edits or corrections to it for reasons of accuracy; be informed of the trade or other disclosure of consumer data to third parties; and request data holders to transfer data in machine-readable form, either to the consumer or to a nominated third party.
The Australian Government should introduce an outcome-based definition of consumer data that is broadly sufficient to enable the provision of a competing or complementary service or product for a consumer. The precise scope of consumer data, as well as necessary data transfer mechanisms, security arrangements and requirements necessary to authenticate a consumer request, should be determined by industry participants on an industry-specific basis. Industry agreement on these should be in the form of a data-specification agreement, registered with the Australian Competition and Consumer Commission (ACCC). All holders of consumer data should include in their privacy policies, terms and conditions, or on their websites a list of parties to whom consumer data has been traded or otherwise disclosed over the past 12 months.
The ACCC should be resourced to undertake the progressive approval and registration of industry-specific data specification agreements, assess the validity of charges levied by data holders in the application of the Comprehensive Right and handle complaints relating to the exercise of the Right by individuals and small businesses.
A risk-based approach to data sharing and release
As a contribution to innovation, all Australian governments should direct the early release of all non-sensitive publicly funded datasets – whether held by a government agency or other body receiving public funding for data collection activities.
A realistic assessment of the risks attached to public release of identifiable information that is already public (in a less accessible form) should be undertaken by all governments, with the intention of releasing low risk data, and mitigating risks where possible to enable far greater public release of data, including that which could be used for program or agency performance management purposes.
Publicly funded entities, including all Australian Government and State and Territory agencies, should create and publish comprehensive, easy to access registers of data, including metadata and linked datasets, that they fund or hold.
The Australian Government should establish an Office of the National Data Custodian (NDC) to take overall responsibility for the implementation of data policy, in consultation with all levels of government. The Office of the NDC would streamline and make transparent approval processes for access to data, with specific functions including recommending the designation of National Interest Datasets, accreditation of data release authorities, advising on ethics and emerging risks and opportunities in data use, and provision of practical guidance material for data custodians.
Selected public sector and public interest entities should be approved as Accredited Release Authorities with responsibility for deciding on the release of data sets; collating, curating, linking and ensuring the timely updating of National Interest Datasets and other datasets; and providing risk-based data access to trusted users.
National Interest Datasets
The Australian Government, in consultation with State and Territory governments, should establish a public process whereby datasets are nominated and designated as National Interest Datasets. National Interest Datasets that contain non-sensitive data should be available for immediate release; those that include sensitive data on individuals would be available to trusted users with management of any associated risks.
Legislative reform
New Commonwealth legislation – the Data Sharing and Release Act – should be passed drawing on the full range of Commonwealth powers to regulate digital data, in order to authorise the better sharing and release of data.
The new Act should establish the Comprehensive Right of consumers to access their data from government and private data holders alike, for the purposes of improving the services that are offered to them by alternative providers. The Act should also establish the risk-based approach to data sharing and release, the National Data Custodian, and Accredited Release Authorities.
Where possible, the new Act would override secrecy provisions or restrictions on use that actively prevent access to data within and across the public sector, including between Australian governments.
The Australian Government has established a cross-portfolio taskforce to prepare the Government’s response to the Productivity Commission’s inquiry report. pmc.gov.au/public-data/data-availability-and-use-taskforce
Data Availability and Use
- Read the Inquiry Report released May 2017