Get approval to access data

If the information you need is in the public domain, such as an open data set published on the Open Data Portal, then accessing it should be a straightforward exercise. Remember though, some types of information in the public domain are subject to licensing or copyright restrictions, which can define limitations on use, reuse and on-sharing. Ensure you understand any licensing restrictions prior to use.

If the information you need is not available publicly, then getting access will require a few more steps.

Useful resources:

• Queensland Government Open Data Portal
• Queensland Government Open Data policy statement
• Information access and use guideline
• Pre-determining the release status of information guideline
• Creative commons licencing

It’s important in any new initiative to spend time ensuring the right problem is being solved before committing time and resources. The same applies with an information sharing initiative.

Having clear and complete articulation on the benefits and value of establishing an information sharing activity will not only help the information owner understand your need for access, but also help you refine your primary purpose and objective for the information you need to access.

The Information sharing authorising framework can assist in you with building your case for sharing. Specifically, the following modules from the Prepare phase.

• Benefits Proposition
• Information Flow Map

Across Government there may be several instruments which enable access to the information you need. These include specific or general items of legislation, existing Memorandum of understanding (MOUs) or previously established Master sharing agreements (MSAs). Leveraging existing enablers will significantly assist you in accessing the information you need and therefore it is beneficial to spend some time researching and understanding any existing enablers.

The Legislation mapping module of the Information sharing authorising framework may assist with this process.

Risk is usually a primary barrier to establishing any information sharing initiative. It is all too common for data and information owners to refuse access requests and cite excessive risk as the reason why.

It is therefore essential that when developing and negotiating access to data and information that the risks are comprehensively understood. Critically, the risk of not sharing information should be central to any assessment.

Legislation and privacy concerns can also form barriers to access, so an evaluation of the impacts of both should be undertaken. If you are seeking data containing personal information, then the completion of a Privacy Impact Assessment is a must. The following modules from the Information Sharing Authorising Framework may assist:

• Risk Assessment
• Privacy Impact Assessment
• Legislation Mapping
• Information Security Classification

Useful resources:

• OIC guideline: What is personal information?
• OIC guideline: Overview of the Privacy Impact Assessment (PIA) process
• Information security classification framework

If the case for access to information is well defined and the risks of sharing are comprehensively understood and appropriately managed, then all parties should agree to share information.

The document which captures this agreement is called the Master sharing agreement (MSA). An MSA outlines how information can be used in a sharing activity, documents information flows, defines the participating parties and outlines high level sharing principles such as account abilities, security controls, governance models and success measures.

Useful resources:

• Information sharing authorising framework
• Information asset custodianship policy (IS44)
• QGEA Information management roles and responsibilities guideline

Once a sharing agreement is in place, you are ready to receive and use the data according to the permitted usage conditions defined in that agreement. You must ensure that all usage conditions, including security and privacy requirements, continue to be monitored and met throughout the life of the agreement.  When the information or output is no longer required, it should be retired as per the requirements of the agreement, ensuring that any recordkeeping responsibilities are met.

To enable potential leverage from your sharing initiative, you should consider whether the details of the agreement can be published in your agency’s information exchange register, the Information sharing agreements register, or the Information sharing pattern library.

Useful resources:

• Information sharing authorising framework
• Information security classification framework
• Information access and use guideline
• Customer details management policy
• Records governance policy