Irrespective of the agreement model used for the project, agreements between an integrating authority and the data custodian(s) should cover the following elements:
Project administration elements
- security obligations (for example, access controls, firewall or stand-alone computers, building security, police checks or security clearances for staff, requirements for the safe transmission and storage of data.);
- privacy and confidentiality requirements, including:
- obligations to comply with relevant statutory requirements for confidentiality and privacy
- a requirement to sign confidentiality agreements (for non-APS staff) or acknowledgements (for APS staff) ,
- methods for confidentialising the data before release to data users (unless release of identified or identifiable data is permitted by relevant legislation), and
- requirements around the use of communication, technology and training to minimise the risk of the identity of an individual or organisation being disclosed;
- consequences if there is a misuse of the data or breach of other key obligations in the documents (including sanctions if there is a data breach);
- a description of the activities to be undertaken by the integrating authority (for example, management of the data integration project, reporting obligations, data access arrangements, auditing the data user(s) use of the data);
- a requirement for the integrating authority to register each project once it has been formally approved, using the on-line register of projects;
- an agreement on any outsourcing of work by the integrating authority for components of the project;
- provisions dealing with any cost recovery [1. Cost recovery by Commonwealth agencies must comply with the Australian Government Cost Recovery Guidelines (July 2005) published by the Department of Finance and Deregulation.] and or integration fees that will be payable in respect of the project and the mechanisms of how and when these are to be paid;
- intellectual property issues including the rights to any software used to access or manipulate the data and ownership of the integrated dataset and outputs;
- provisions dealing with when and how a project can be discontinued and the consequences of discontinuation;
- any special conditions to which integrating authorities must adhere, as stipulated by data custodians (for example, return or destruction of the data);
Project specific elements
- a description of the project and project objectives;
- what data will be provided under the agreement and how new data sources can be added to the agreement, including any manipulation or quality assurance steps to be undertaken by the data custodian;
- the data integration activities to be undertaken by the integrating authority (for example, how the separation principle is to be implemented, the type of matching to be used and how to deal with anomalies and outliers etc.);
- obligation on the integrating authority to enter into a contract/other arrangement with the data user(s) which is in a form agreed by the data custodians or which contains certain key provisions specified by the data custodians. This will provide protection and a control mechanism for data custodians to who do not have a direct relationship with the data users.
Standard contract clauses
- a statement of whether or not the document is intended to be legally binding
- liability (for legally binding contract) or responsibility issues (for example acknowledgement by the parties that while care has been taken to maximise the quality of the data, it is provided ‘as is’ with no warranties), obligation to ensure that the arrangements with data user(s) are consistent with these arrangements.
- standard clauses such as the date the agreement takes effect, the date it expires, compliance with laws, issuing of notices, provisions to terminate the agreement (including what would happen if accreditation lapses or is withdrawn), interpretation and dispute resolution.
To assist in the preparation of agreements, some sample agreements have been provided in this guide.
For related information on Drafting Project Agreements see:
- Project agreements - Data custodians and integrating authorities
- Project agreements - Integrating authorities and data users
- Sample agreements