Get approval to access data

If the information you need is in the public domain, such as an open dataset published on the Open Data Portal, then accessing it should be straightforward. However, remember that some types of information in the public domain are subject to licensing or copyright restrictions that limit use, reuse or on-sharing. Ensure you understand any licensing restrictions prior to use.

If the information is not publicly available, gaining access will require a few more steps.

Useful resources:

• Queensland Government Open Data Portal
• Queensland Government open data policy statement
• Information access and use guideline
• Creative commons licencing

It’s important in any new initiative to spend time ensuring the right problem is being solved before committing time and resources. The same applies with an information sharing initiative.

Having clear and complete articulation on the benefits and value of establishing an information sharing activity will not only help the information owner understand your need for access, but also help you refine your primary purpose and objective for the information you need to access.

The Data sharing framework can assist in you with building your case for sharing. It details steps to prepare a request through to negotiating data exchange.

Across government, several instruments that enable access to the information you need may apply. These may include:

• specific or general items of legislation
• existing memorandum of understandings (MOUs)
• previously established master sharing agreements (MSAs).

Identifying and using these existing arrangements can make access easier and faster.

Risk is usually a primary barrier to establishing any information sharing initiative. Data and information owners may refuse access requests because they consider the risks to be too high.

Therefore, ensure you understand the risks when developing and negotiating access to data and information. The risk of not sharing information should be central to any assessment.

Legislation and privacy concerns can also form barriers to access, so their impacts should be assessed. If you are seeking data containing personal information, then the privacy impact assessment should be completed.

The Data sharing framework guides users through the data sharing process. At each step, it sets out the key considerations and links to the relevant resources, including::

• risk:  the Five Safes lens, 'do no harm', and the impact assessments at Table 1
• privacy impact assessment (PIA): Office of the Information Commissioner’s (OIC) step-by-step PIA guide and re-identification risk guidance
• legal authority:  the legislative context, and the requirement to consult legal before sharing
• information security classification: the Information security classification framework (QGISCF) and the Information and cyber security policy (IS18).

Useful resources:

• The Queensland privacy principles (QPPs)
• Privacy impact assessments

If the case for access to information is well defined and the risks of sharing are well understood and appropriately managed, then all parties should be able to agree to share information.

The document which captures this agreement is called the Master sharing agreement (MSA). An MSA:

• outlines how information can be used in a sharing activity
• documents information flows
• defines the participating parties
• outlines high-level sharing principles such as accountabilities, security controls, governance models and success measures.

Useful resources:

• Data sharing framework
• Information asset custodianship policy (IS44)
• Queensland Government Enterprise Architecture (QGEA) information management roles and responsibilities guideline

Once a sharing agreement is in place, you are ready to receive and use the data according to the permitted usage conditions defined in that agreement. You must ensure that all usage conditions, including security and privacy requirements, continue to be monitored and met throughout the life of the agreement.  When the information or output is no longer required, it should be retired as per the requirements of the agreement. This ensures that any recordkeeping responsibilities are met.

To enable potential leverage from your sharing initiative, you should consider whether the details of the agreement can be published in:

• your agency’s information exchange register
• the information sharing agreements register
• the information sharing pattern library.

Useful resources:

• Data sharing framework
• Information security classification framework
• Information access and use guideline
• Customer details management policy
• Records governance policy