Letter to the Attorney-General

The Hon Kyam Maher MLC
Attorney-General

This annual report will be presented to Parliament to meet the statutory reporting requirements of the Proclamation of the Privacy Committee of South Australia and the requirements of Premier and Cabinet Circular PC013 Annual Reporting.

This report is verified to be accurate for the purposes of annual reporting to the Parliament of South Australia.

Submitted on behalf of the Privacy Committee of South Australia by:

Stephanie Coleman
Presiding Member
Privacy Committee of South Australia

From the Presiding Member

The focus of the Privacy Committee of South Australia (the Committee) is on the operation of the government’s Information Privacy Principles Instruction (IPPI).

During 2025-26, the Committee continued to meet online and conduct urgent business out of session.
The IPPI describes the ways in which public sector agencies collect, store, use and disclose personal information in their possession, through a set of ten principles.

The IPPI is binding for public sector agencies and determines the principal officer of each agency must ensure the principles are implemented, maintained and observed for, and in respect of, all personal information for which their agency is responsible.
Since the implementation of the Personal Information Breach Guideline in 2018, notifications to the Committee have increased each year. Most of the Committee’s business this reporting year related to personal information breach notifications, 260 in total.
Breaches involving only 1 or 2 affected parties accounted for 79% of all breaches, compared to 77% last year.

Human error continues to be the dominate cause of breaches, with over half of all breaches resulting from emails and text messages being sent to the wrong person or documents being physically provided to the wrong person e.g. the wrong discharge summary provided to the wrong patient.

Breaches caused by malicious, deliberate, or criminal activity remained consistent with last year, with reported unauthorised system access decreasing, accounting for 66% of all malicious, deliberate or criminally caused breaches, as opposed to 84% last year. The most common instance of unauthorised system access involved staff accessing information outside of their assigned tasks.

The Committee managed nine privacy complaints this year. This is the most complaints per year over the last six reporting years.
I would like to take this opportunity to publicly acknowledge the service of two members whose term on the Committee concluded during the reporting year. Mr Nathan Morelli for his nine years of service, and Ms Prudence Reid for her four years and nine months’ service. Thank you for your valuable contributions to improving the state government’s role in protecting the privacy of individuals.

Stephanie Coleman
Presiding Member
Privacy Committee of South Australia

Overview: about the Privacy Committee

The Privacy Committee of South Australia (the Committee) was established by Proclamation in the Government Gazette on 6 July 1989 and most recently updated on 11 June 2009.
The functions of the Committee, as described in the Proclamation, are:
(a) to advise the Minister as to the need for, or desirability of, legislation or administrative action to protect individual privacy and for that purpose to keep itself informed as to developments in relation to the protection of individual privacy in other jurisdictions
(b) to make recommendations to the Government or to any person or body as to the measures that should be taken by the Government or that person or body to improve its protection of individual privacy
(c) to make publicly available information as to methods of protecting individual privacy and measures that can be taken to improve existing protection
(d) to keep itself informed as to the extent to which the Administrative Scheme of Information Privacy Principles are being implemented
(g) to refer written complaints concerning violations of individual privacy received by it (other than complaints from employees of the Crown, or agencies or instrumentalities of the Crown, in relation to their employment) to the appropriate authority
(h) such other functions as are determined by the Minister.
The Committee may, under clause 4 of the Proclamation, ‘exempt a person or body from one or more of the Information Privacy Principles on such conditions as the Committee thinks fit’.

Clause 1(2) of the Proclamation establishes its membership. The Committee is to consist of six members appointed by the Minister. Of the six members:

  • three are nominated by the Minister [the Attorney-General] (one of whom must not be a public sector employee, and one must have expertise in information and records management)
  • one is to be nominated by the Attorney-General
  • one is to be nominated by the Minister responsible for the administration of the Health Care Act 2008, and
  • one is to be nominated by the Commissioner for Public [Sector] Employment.

Members of the Privacy Committee during the 2025-26 reporting year were:

Presiding Member
Stephanie Coleman, Director, State Records of South Australia, Attorney-General’s Departmentappointed to
1 Feb 2030
Members, in alphabetical order
Deslie Billich, non-public sector employeeappointed to
30 Jan 2028
Abbie Eggers, Manager, Business Services, Department of Human Servicesappointed to
30 Jan 2028
Nathan Morelli, non-public sector employeeappointed to
31 Jan 2026
Prue Reid, Executive Director, Corporate Affairs, Department for Health and Wellbeingresigned on
12 Mar 2026
Alicia Tsogas, Executive Director, Governance Advisory Services, Department for Health and Wellbeingappointed to
31 Jan 2026
Samuel Whitten, Executive Solicitor, Commercial Environment and Native Title Section in the Crown Solicitor’s Officeappointed to
1 Feb 2030
Trent McGee, Director, Digital Strategy, Technology and Architecture, Office of the Chief Information Officerappointed to 31 Jan 2030

Changes to the Privacy Committee

Ms Prue Reid resigned and was replaced by Ms Alicia Tsogas, initially as Ms Reid’s proxy from 28 April 2026, before being formally appointed on 1 June 2026. Ms Janelle Lemmey also acted as Ms Reid’s proxy while Ms Reid was on leave, from 5 September 2025 until 31 January 2026.

Mr Nathan Morelli completed nine years of service on 31 January 2026 and was replaced by Mr Trent McGee who commenced his appointment on 1 February 2026.

Executive support to the Privacy Committee

Executive support to the Committee is delivered within the resources of State Records of South Australia.

The Committee reports to the Hon Kyam Maher MLC as Attorney-General. The Attorney-General is also responsible for other information management regulation including the State Records Act 1997 and the Freedom of Information Act 1991.

South Australia’s Information Privacy Principles Instruction (IPPI) was introduced in July 1989 by means of Cabinet Administrative Instruction 1/89, issued as Premier & Cabinet Circular No. 12. The IPPI includes a set of ten Information Privacy Principles (IPPs) that regulate the way South Australian public sector agencies collect, use, store and disclose personal information.

The Committee’s performance

The Committee schedules eight meetings each year. There was an extraordinary meeting held in February 2026.

The number of meetings attended by each member during 2025-2026 was:

Member

No. of meetings attended

Stephanie Coleman9
Deslie Billich3
Abbie Eggers8
Nathan Morelli4
Prudence Reid0
Janelle Lemmey (proxy for Prudence Reid)4
Alicia Tsogas (proxy for Prudence Reid)1
Alicia Tsogas1
Samuel Whitten9
Trent McGee5

Financial performance
The Committee does not administer a budget.

Consultants disclosure
The Committee has not engaged any consultants.

Contractors disclosure
The Committee has not engaged any contractors.

Reporting required under any other act or regulation

Exemptions from the IPPI

Clause 4 of the Proclamation provides the Privacy Committee may exempt a person or body from one or more of the Information Privacy Principles (IPPs) on such conditions as the Committee sees fit.

The Annual Report must include details of any exemptions granted during the year to which the report relates.

There were four new exemptions requested during the reporting year, with 23 extensions.
Four new exemptions were granted allowing the SA Health Data Linkage Unit to collect and use personal information received from:

  • Catholic Community Services
  • Various pathology services: PathWest, Pathology QLD, NSW Health Pathology at Westmead and University of Sydney
  • Australian Cancer Council Registry
  • Australian Orthopaedic Association

A range of exemptions associated with the SA Health Data Linkage Unit were extended to 31 December 2028.

Exemptions

2025-26

2024-25

2023-24

2022-23

New

4

2

1

2

Extended

23

21

9

8

Total

27

23

10

10

The full text of these exemptions is included in the Appendix.

Privacy Committee business

The Privacy Committee has a function to “refer written complaints concerning violations of individual privacy received by it (other than complaints from employees of the Crown, or agencies or instrumentalities of the Crown, in relation to their employment) to the appropriate authority”.

In 2025-26 the Privacy Committee received three complaints.

2025-26

2024-25

2023-24

2022-23

9

6

3

3

As at 30 June 2026, of the nine complaints received during 2025-26, six are closed, two remain ongoing and one is on hold (at the complainant’s request).

Since 2018, state government agencies have been required to comply with the Personal Information Data Breaches Guideline (external site) (PDF) (external site) (PDF) (external site) (PDF) (external site) (PDF)developed to provide advice on how to deal with unauthorised access to personal information (privacy breaches). One action within the Guideline is to notify the Privacy Committee so that it can:

  • keep itself informed as to the extent to which the Information Privacy Principles are being implemented, and
  • make recommendations of the measures that should be taken by the government to improve its protection of individual privacy.

The Privacy Committee received 260 notifications during the 2025-26 reporting year.

2025-26

2024-25

2023-24

2022-23

260

225

198

141

Since the introduction of the notification scheme the number of breach notifications has increased each year. The increase can be attributed to a strong reporting culture from the health sector who submit the largest number of breaches.

Improved awareness to notify the Committee by other sectors has also contributed to the number of notifications.

Human error continues to dominate the cause of breaches, with emails sent incorrectly and documents physically provided to the wrong person (excluding by post) accounting for over half of all breaches.

The Committee reviews each breach it receives and provides agencies with suggestions for improvements to process and practices where necessary.

Affected parties by cause of breach

No. of Individuals

Accident

Procedure or System

Malicious, Deliberate or Criminal

Unclear

Total

0 to 2

129

49

24

3

79%

3 to 9

12

6

1

0

7%

10 to 30

5

7

2

0

5%

31 to 100

2

5

0

0

3%

101 to 1000

2

1

1

0

2%

Over 1000

0

2

2

0

2%

Unclear

3

2

2

0

3%

Total

59%

28%

12%

1%

100%

Graph comparing means of privacy breach for 2025-26.

The Committee strongly encourages agencies to advise affected parties of a breach unless there is a significant reason not to do so. This ensures affected parties are aware of any possible implications and builds trust through transparency and accountability by the agency.

State Records continues to support the Committee by reviewing the notifications process to ensure it is delivering the required benefits.

State Records also continues to educate agencies on the importance of only collecting the personal information needed to perform a service and to avoid retaining it longer than legally required, thereby minimising the risk of harm should a breach occur.

Principal officers of state government agencies have the responsibility to ensure the IPPI is implemented, maintained, and observed for, and in respect of, all personal information for which their agency is responsible.

Advice is provided to state government agencies to help them comply with the IPPI and ensure privacy is considered in the development of new projects and initiatives. Policy and other guidance materials are issued to support agencies.

State Records has released a new General Disposal Schedule (GDS 45) authorising the disposal of certain identity verification documents under the State Records Act 1997. This GDS and supporting guidance, provides agencies with an opportunity to reduce the retention of personal information no longer needed for a business purpose, thereby reducing the risks and impacts of a privacy breach.

State Records also developed promotional resources and guidance for agencies for Privacy Awareness Week 2026, including a new webpage on key privacy considerations to be observed when using Artificial Intelligence tools.

The Handling Personal Information and An Introduction to the Information Privacy Principles training courses have also been updated to be more accessible to people with disability and are due to be republished in 2026-27.

The Committee is represented by the Presiding Member on Privacy Authorities Australia (PAA). State Records staff participate in two PAA working groups on policy and communications.

Appendix: Exemptions from the IPPI granted 2025-26

Clause 4 of the Proclamation provides the Committee may exempt a person or body from one or more of the IPPs on such conditions as the Committee sees fit.

All exemptions require:

  • the security of the personal information to be managed in line with the South Australian Protective Security Management Framework (in compliance with Premier and Cabinet Circular 30) and the agency’s security management systems and practices, and
  • destruction or retention of the personal information must be undertaken in accordance with a disposal authority under the State Records Act 1997.

The following exemptions and extensions were granted during 2025-2026.

Exemptions

This exemption is approved to support the transition of SA NT DataLink into SA Health, until the establishment of a new governance model and privacy authorisations. It applies to the SA NT DataLink Data Linkage Unit within SA Health (SA Health DLU) relating to information from Catholic Community Services. It is an exemption from compliance with:

  • Principle 2, where SA Health DLU has collected or received personal information from Catholic Community Services; and
  • Principle 8, allowing SA Health DLU to use the personal information received from Catholic Community Services for a purpose that was not the primary purpose of the collection of that information.

The personal information is limited to Service file ID, Individual ID, C3MS ID, Date of birth, Age (at the start of service and age today), Gender, Address (suburb level), Country of Birth.

All other Principles continue to apply.

Conditions

The information is only to be used for the creation of Master Linkage Keys in the further development of the Master Linkage File as part of the SA NT Data Linkage System. The exemption is provided on the condition the personal information is only to be accessed by officers of SA Health within the Data Linkage Unit.

SA Health remains responsible for the secure transfer and storage of personal information in line with the IPPs.

The Committee must be consulted during the drafting of alternative authorisations for activities not routinely permitted by the Information Privacy Principles Instruction (“privacy authorisations”).

Reports on the status of the transition of SA NT DataLink into SA Health, and the establishment a new governance model and privacy authorisations, must be provided to the Committee at key development stages, or quarterly, whichever is sooner.

This exemption is conditional on SA NT DataLink or successor having a current Agreement in place or undertaking to establish an Agreement with parties in the data linkage process.

Approvals

  • Exemption approved 31 July 2025, granted from 31 July 2025 to 31 December 2025
  • Extension approved 3 December 2025, granted from 1 January 2026 to December 2028

This exemption is approved to support the transition of SA NT DataLink into SA Health, until the establishment of a new governance model and privacy authorisations. It applies to the SA NT DataLink Data Linkage Unit within SA Health (SA Health DLU) relating to information from PathWest, Pathology Qld, NSW Health Pathology at Westmead and University of Sydney. It is an exemption from compliance with:

  • Principle 2, where SA Health DLU has collected or received personal information from PathWest, Pathology Qld, NSW Health Pathology at Westmead and University of Sydney; and
  • Principle 8, allowing SA Health DLU to use the personal information received from PathWest, Pathology Qld, NSW Health Pathology at Westmead and University of Sydney for a purpose that was not the primary purpose of the collection of that information.

The personal information is limited to AIHW_SURE_PPN, full name, previous names, date of birth, date of death, full address, sex, Hospital ID, Hospital URN.

All other Principles continue to apply.

Conditions

The information is only to be used for the creation of Master Linkage Keys in the further development of the Master Linkage File as part of the SA NT Data Linkage System. The exemption is provided on the condition the personal information is only to be accessed by officers of SA Health within the Data Linkage Unit.

SA Health remains responsible for the secure transfer and storage of personal information in line with the IPPs.

The Committee must be consulted during the drafting of alternative authorisations for activities not routinely permitted by the Information Privacy Principles Instruction (“privacy authorisations”).

Reports on the status of the transition of SA NT DataLink into SA Health, and the establishment a new governance model and privacy authorisations, must be provided to the Committee at key development stages, or quarterly, whichever is sooner.

This exemption is conditional on SA NT DataLink or successor having a current Agreement in place or undertaking to establish an Agreement with parties in the data linkage process.

Approvals

  • Exemption approved 31 July 2025, granted from 31 July 2025 to 31 December 2025
  • Extension approved 3 December 2025, granted from 1 January 2026 to December 2028

This exemption is approved to support the transition of SA NT DataLink into SA Health, until the establishment of a new governance model and privacy authorisations. It applies to the SA NT DataLink Data Linkage Unit within SA Health (SA Health DLU) relating to information from Australian Cancer Council Registry. It is an exemption from compliance with:

Principle 2, where SA Health DLU has collected or received personal information from Australian Cancer Council Registry; and

Principle 8, allowing SA Health DLU to use the personal information received from Australian Cancer Council Registry for a purpose that was not the primary purpose of the collection of that information.

The personal information is limited to ACCR Project Person Number and case number, full name, date of birth, sex, postcode at diagnosis, year of diagnosis, treating hospital ID, treating hospital UR, cancer registry ID.

All other Principles continue to apply.

Conditions

The information is only to be used for the creation of Master Linkage Keys in the further development of the Master Linkage File as part of the SA NT Data Linkage System. The exemption is provided on the condition the personal information is only to be accessed by officers of SA Health within the Data Linkage Unit.

SA Health remains responsible for the secure transfer and storage of personal information in line with the IPPs.

The Committee must be consulted during the drafting of alternative authorisations for activities not routinely permitted by the Information Privacy Principles Instruction (“privacy authorisations”).

Reports on the status of the transition of SA NT DataLink into SA Health, and the establishment a new governance model and privacy authorisations, must be provided to the Committee at key development stages, or quarterly, whichever is sooner.

This exemption is conditional on SA NT DataLink or successor having a current Agreement in place or undertaking to establish an Agreement with parties in the data linkage process.

Approvals

  • Exemption approved 31 July 2025, granted from 31 July 2025 to 31 December 2025
  • Extension approved 3 December 2025, granted from 1 January 2026 to December 2028

Extensions

SA Health DLU within SA Health and associated agencies

All were approved on the condition the information is only to be used for the creation of Master Linkage Keys in the further development of the Master Linkage File as part of the SA NT Data Linkage System. The exemption is provided on the condition the personal information is only to be accessed by officers of SA Health within the Data Linkage Unit.

This exemption applies to the SA Health DLU and Consumer and Business Services (CBS) in the Attorney General’s Department. It is an exemption from compliance with:

  • Principle 10, allowing CBS to disclose personal information to the SA Health DLU, and
  • Principle 8, allowing SA Health DLU to use personal information for a purpose that was not the purpose of the collection of that information – namely in the establishment of the Master Linkage File as part of the Data Linkage System.

The personal information to be used is from South Australian births and deaths datasets, and is limited to:

Death Dataset: Unique record identifier (registration number); names (all names where available including surnames, surnames at birth, given names and given names at birth); date of birth; date of death; age at death; place of birth; place of death; sex; Aboriginality and/or Torres Strait Islander indicator; full residential address, including geocodes, where available; correction indicator (if a record previously reported is being re-reported due to a correction in the register); father/co-parent (type, surnames, surnames at birth, given names, occupation); and mother (type, surnames, surnames at birth, given names, occupation). The personal information to be used from the deaths dataset is limited to death records created after 1/1/1990.

Birth Dataset: Unique record identifier (registration number); Names (all names where available including surnames, surnames at birth, given names and given names at birth); Full residential address, including geocodes where available; Sex; Date of birth; Place of birth; Mother’s Aboriginal indicator; Mother’s Torres Strait Islander indicator; Father’s/Co-parent’s Aboriginal indicator; Father’s/Co-parent’s Torres Strait Islander indicator; Mother’s date of birth; Father’s/Co-parent’s date of birth; Birth weight (in grams); Plurality – order (only available for multiple births e.g. twins); Plurality – total (only available for multiple births e.g. twins); Mother’s occupation title; Father’s/Co-parent’s occupation title; correction indicator (if a record previously reported is being re-reported due to a correction in the register); marriage type; date of marriage; place of marriage; and previous children of this relationship (given names, sex, date of birth, living indicator).

The personal information to be used from the births dataset is limited to birth records created after 1/1/1944. The disclosure will include any of the above information provided for other family members that is included in these records. All other Principles continue to apply.

Approvals

  • Approved 2 December 2022, granted from 1 January 2023 to 31 December 2023
  • Approved 15 December 2023, granted from 1 January 2024 to 31 December 2024
  • Approved 20 December 2024, granted from 1 January 2025 to 31 December 2025
  • Approved 3 December 2025, granted from 1 January 2026 to 31 December 2028

This exemption applies to the SA Health DLU and the Department for Child Protection (DCP). It is an exemption from compliance with:

  • Principle 10, permitting DCP to disclose personal information to SA Health DLU, and
  • Principle 8, allowing SA Health DLU to use personal information for a purpose that was not the purpose of the collection of that information – namely to support the linkage with DCP data on Alternative Care, Care and Protection Orders, and Child Protection.

The personal information is limited to: Record identifier; Names – all names including nicknames, aliases and aka; Date of birth; Sex; Aboriginality, Torres Strait Islander indicator; Cultural group; Full address including geocodes where available; Client File Number (85 File Number for Client Information System (CIS) records within the Justice Information System (JIS) – a flag indicating that this child was under the Guardianship of the Minister); and any of the above information provided for other family members and included in these records, i.e. full name and date of birth of the mother and father of the child or young person.

All other Principles continue to apply.

Approvals

  • Approved 2 December 2022, granted from 1 January 2023 to 31 December 2023
  • Approved 15 December 2023, granted from 1 January 2024 to 31 December 2024
  • Approved 20 December 2024, granted from 1 January 2025 to 31 December 2025
  • Approved 3 December 2025, granted from 1 January 2026 to 31 December 2028

This exemption applies to SA Health DLU and the Department for Human Services (DHS) Youth Justice branch. It is an exemption from compliance with:

  • Principle 10, permitting DHS Youth Justice to disclose personal information to SA Health DLU, and
  • Principle 8, allowing SA Health DLU to use personal information for a purpose that was not the purpose of the collection of that information – namely the creation of master linkage keys as part of the SA NT Data Linkage System by the Data Linkage Unit.

The personal information is limited to: Unique record identifier (i.e. episode reference number); Unique person identifier where available; Given name(s) (including all ‘akas’, aliases and nicknames); Date of birth; Sex; Aboriginality and/or Torres Strait Islander indicator; Country of birth; Full address including geocodes where available; and the full name and date of birth of the mother and father of the child or young person where available.

All other Principles continue to apply.

Approvals

  • Approved 2 December 2022, granted from 1 January 2023 to 31 December 2023
  • Approved 15 December 2023, granted from 1 January 2024 to 31 December 2024
  • Approved 20 December 2024, granted from 1 January 2025 to 31 December 2025
  • Approved 3 December 2025, granted from 1 January 2026 to 31 December 2028

This exemption applies to SA Health DLU and the Department for Education (DfE). It is an exemption from compliance with:

  • Principle 10, permitting DE to disclose personal information to SA Health DLU, and
  • Principle 8, allowing SA Health DLU to use personal information for a purpose that was not the purpose of the collection of that information.

The personal information to be used is from the DfE Public Schools Enrolment dataset, including preschools and is limited to: Record Identifier; Personal Identifier; Names; Date of Birth; Sex; Aboriginality, Torres Strait Islander Indicator; Country of Birth; Full address including Geocodes if available; Parent / Guardian Identifier; Date Enrolled; Date Left; Destination School; Census year; Census term; 85 File Number; and any of the above information provided for other family members and included in these records including family code.

All other Principles continue to apply.

Approvals

  • Approved 2 December 2022, granted from 1 January 2023 to 31 December 2023
  • Approved 15 December 2023, granted from 1 January 2024 to 31 December 2024
  • Approved 20 December 2024, granted from 1 January 2025 to 31 December 2025
  • Approved 3 December 2025, granted from 1 January 2026 to 31 December 2028

This exemption applies to SA Health DLU and Department for Education (DE). It is an exemption from compliance with:

Principle 10, permitting DE to disclose personal information to SA Health DLU for the purpose of enabling a more complete understanding of the early childhood sector and pathways in child health and development when developing policy, research and strategic plans, and

Principle 8, allowing SA Health DLU to use personal information for a purpose that was not the purpose of the collection of that information – for the purposes of data linkage.

The personal information to be used is from DE preschool enrolment census data for non-government and private schools. The personal information to be used was initially for the period between 2012 and 2017, representing approximately 110,000 students, with annual updates being sought, with an expectation that each update is to include approximately 18,500 new students.

The personal information includes linkage variables of: Record identifier; Personal identifier; Names – all names including nicknames, aliases and aka; Date of birth; Sex; Aboriginality, Torres Strait Islander Indicator; Country of birth; Full address including geocodes if available; Site name; Site ID; and Census year.

All other Principles continue to apply.

Approvals

  • Approved 2 December 2022, granted from 1 January 2023 to 31 December 2023
  • Approved 15 December 2023, granted from 1 January 2024 to 31 December 2024
  • Approved 20 December 2024, granted from 1 January 2025 to 31 December 2025
  • Approved 3 December 2025, granted from 1 January 2026 to 31 December 2028

This exemption applies to SA Health DLU and the Electoral Commission of South Australia (ECSA). It is an exemption from compliance with:

  • Principle 10, permitting ECSA to disclose personal information to SA Health DLU, and
  • Principles 2 and 8, allowing SA Health DLU to collect and use personal information for a purpose that was not the purpose of the collection of that information.

The personal information to be used is from the ECSA South Australian Electoral Roll dataset and is limited to: Elector Number; Title; Family Name; Given Names; Date of Birth; Country of Birth (3 character code); Sex; Address Line 1, 2 and 3 (including State and postcode); and any of the above information provided for other family members and included in these records.

Excluded from the dataset is information relating to ‘silent electors’ and those individuals who have sought to be ‘provisionally enrolled’.

All other Principles continue to apply.

Approvals

  • Approved 2 December 2022, granted from 1 January 2023 to 31 December 2023
  • Approved 15 December 2023, granted from 1 January 2024 to 31 December 2024
  • Approved 20 December 2024, granted from 1 January 2025 to 31 December 2025
  • Approved 3 December 2025, granted from 1 January 2026 to 31 December 2028

This exemption applies to SA Health DLU and the South Australian Housing Authority (SAHA). It is an exemption from compliance with:

  • Principle 10, permitting SAHA to disclose personal information from the Housing SA dataset and the Homelessness to Home (H2H) dataset to SA Health DLU, and
  • Principle 8, allowing SA Health DLU to use personal information for a purpose that was not the purpose of the collection of that information – namely for the creation of master linkage keys as part of the establishment of the Data Linkage System.

The personal information from the Housing SA dataset is limited to: Unique Person Identifier; System Date; Names, all names including nicknames, aliases and aka; Date of Birth; Sex; Title; Aboriginality and/or Torres Strait Islander identifier; Country of Birth; Full address including geocodes if available; and any of the above information provided for other family members and included in these records.

The personal information from the Homelessness to Home (H2H) dataset is limited to: H2H customer number; Housing SA customer number; Given names; Surname; Date of birth; Sex; Aboriginality and/or Torres Strait Islander indicator; Country of birth; Full address details, including past addresses where available; System date; and any of the above information provided for other family members and included in these records.

All other Principles continue to apply.

Approvals

  • Approved 2 December 2022, granted from 1 January 2023 to 31 December 2023
  • Approved 15 December 2023, granted from 1 January 2024 to 31 December 2024
  • Approved 20 December 2024, granted from 1 January 2025 to 31 December 2025
  • Approved 3 December 2025, granted from 1 January 2026 to 31 December 2028

This exemption applies to SA Health DLU and the Department for Correctional Services (DCS). It is an exemption from compliance with:

  • Principle 10, permitting DCS to disclose personal information to SA Health DLU, and
  • Principle 8, allowing SA Health DLU to use personal information for a purpose that was not the purpose of the collection of that information – namely to enable researchers and policy analysist to develop and disseminate a more comprehensive understanding of health, education and justice system pathways and outcomes.

The personal information to be disclosed by DCS relates to individuals who have been sentenced to a period of supervision, either in a custodial setting or in the community and is limited to: DCS IDs; JIS PIN; Entry and exit dates; Surnames (including previous names and maiden names); Given Name(s) (all including “aka’s”, aliases and nicknames); Date of Birth (DD/MM/YYYY); Sex; Residential address and postcodes (including previous addresses); and Aboriginal and Torres Strait Islander indicator.

All other Principles continue to apply.

Approvals

  • Approved 2 December 2022, granted from 1 January 2023 to 31 December 2023
  • Approved 15 December 2023, granted from 1 January 2024 to 31 December 2024
  • Approved 20 December 2024, granted from 1 January 2025 to 31 December 2025
  • Approved 3 December 2025, granted from 1 January 2026 to 31 December 2028

This exemption applies to SA Health DLU and the Department of Human Services (DHS) – SA Concessions. It is an exemption from compliance with:

Principle 8, allowing SA Health DLU to use the personal information received from DHS – SA concessions for a purpose that was not the primary purpose of the collection of that information; and

Principle 10, permitting SA Health DLU to disclose personal information from the DHS – SA concession dataset to the Data Linkage Unit within SA NT DataLink and successors.

The personal information is limited to dataset name, Unique ID, record date, person ID, name(s) including alias and nicknames, date of birth, Aboriginal Torres Strait Islander Status, address and previous address where available and phone number.

All other Principles continue to apply.

Approvals

  • Approved 24 July 2024, granted 9 July 2024 to 31 December 2024
  • Approved 20 December 2024, granted 1 January 2025 to 31 December 2025
  • Approved 3 December 2025, granted from 1 January 2026 to 31 December 2028

This exemption applies to SA Health DLU and the Department of Human Services (DHS) – Child and Family Support System Pathways (CFSS). It is an exemption from compliance with:

  • Principle 8, allowing SA Health DLU to use the personal information received from DHS – Child and Family Support System Pathways (CFSS) for a purpose that was not the primary purpose of the collection of that information; and
  • Principle 10, permitting SA Health DLU to disclose personal information from the DHS – Child and Family Support System Pathways (CFSS) dataset to the Data Linkage Unit within SA NT DataLink and successors.

The personal information is limited to name, date of birth, place of birth, sex, Aboriginal Torres Strait Islander Status, family ID, family name, family start date, address, site name, site State.

All other Principles continue to apply.

Approvals

  • Approved 24 July 2024, granted 9 July 2024 to 31 December 2024
  • Approved 20 December 2024, granted 1 January 2025 to 31 December 2025
  • Approved 3 December 2025, granted from 1 January 2026 to 31 December 2028

This exemption applies to SA Health DLU relating to information from SA Department for Health and Wellbeing (DHW) Flinders Medical Centre – Flinders First Infant Risk Study. It is an exemption from compliance with:

  • Principle 8, allowing SA Health DLU to use the personal information received from DHW Flinders Medical Centre – Flinders First Infant Risk Study for a purpose that was not the primary purpose of the collection of that information; and
  • Principle 10, permitting SA Health DLU to disclose personal information from DHW Flinders Medical Centre – Flinders First Infant Risk Study dataset to the Data Linkage Unit within SA NT DataLink and successors.

The personal information is limited to family ID (urn), name, date of birth, sex, plural, birth order, birth outcome, date of death, birth weight, gestational weeks, postcode, maternal name, maternal date of birth, deliver date time, date admitted, date discharged, maternal partner name.

All other Principles continue to apply.

Approvals

  • Approved 24 July 2024, granted 9 July 2024 to 31 December 2024
  • Approved 20 December 2024, granted 1 January 2025 to 31 December 2025
  • Approved 3 December 2025, granted from 1 January 2026 to 31 December 2028

This exemption applies to SA Health DLU relating to information from Department for Health and Wellbeing (DHW) – Chronic Obstructive Pulmonary Disease cohort. It is an exemption from compliance with:

  • Principle 8, allowing SA NT DataLink to use the personal information received from DHW – Chronic Obstructive Pulmonary Disease cohort for a purpose that was not the primary purpose of the collection of that information; and
  • Principle 10, permitting SA NT DataLink to disclose personal information from DHW - Chronic Obstructive Pulmonary Disease cohort dataset to the Data Linkage Unit within SA NT DataLink and successors.

The personal information is limited to name, date of birth, sex, patient ID.

All other Principles continue to apply.

Approvals

  • Approved 24 July 2024, granted 9 July 2024 to 31 December 2024
  • Approved 20 December 2024, granted 1 January 2025 to 31 December 2025
  • Approved 3 December 2025, granted from 1 January 2026 to 31 December 2028

This exemption applies to SA Health DLU relating to information from SA Department for Health and Wellbeing (DHW) – Coronary Angiogram Database of SA. It is an exemption from compliance with:

  • Principle 8, allowing SA Health DLU to use the personal information received from DHW – Coronary Angiogram Database of SA for a purpose that was not the primary purpose of the collection of that information; and
  • Principle 10, permitting SA Health DLU to disclose personal information from DHW – Coronary Angiogram Database of SA dataset to the Data Linkage Unit within SA NT DataLink and successors.

The personal information is limited to name, date of birth, sex, patient ID, event dates.

All other Principles continue to apply.

Approvals

  • Approved 24 July 2024, granted 9 July 2024 to 31 December 2024
  • Approved 20 December 2024, granted 1 January 2025 to 31 December 2025
  • Approved 3 December 2025, granted from 1 January 2026 to 31 December 2028

This exemption applies to SA Health DLU relating to information from SA Department for Health and Wellbeing (DHW) – SA Biopsy Positive Giant Cell Arteritis. It is an exemption from compliance with:

  • Principle 8, allowing SA Health DLU to use the personal information received from DHW – SA Biopsy Positive Giant Cell Arteritis for a purpose that was not the primary purpose of the collection of that information; and
  • Principle 10, permitting SA Health DLU to disclose personal information from DHW – SA Biopsy Positive Giant Cell Arteritis dataset to the Data Linkage Unit within SA NT DataLink and successors.

All other Principles continue to apply. The personal information is limited to name, date of birth, sex, patient ID, event dates.

Approvals

  • Approved 24 July 2024, granted 9 July 2024 to 31 December 2024
  • Approved 20 December 2024, granted 1 January 2025 to 31 December 2025
  • Approved 3 December 2025, granted from 1 January 2026 to 31 December 2028

This exemption applies to SA Health DLU relating to information from the University of Adelaide – North West Adelaide Health Study. It is an exemption from compliance with:

Principle 2, where SA Health DLU has collected or received personal information from the University of Adelaide – North West Adelaide Health Study; and

Principle 8, allowing SA Health DLU to use the personal information received from the University of Adelaide – North West Adelaide Health Study for a purpose that was not the primary purpose of the collection of that information.

The personal information is limited to name, date of birth, age, gender, address, previous address, study flag.

All other Principles continue to apply.

Approvals

  • Approved 24 July 2024, granted 9 July 2024 to 31 December 2024
  • Approved 20 December 2024, granted 1 January 2025 to 31 December 2025
  • Approved 3 December 2025, granted from 1 January 2026 to 31 December 2028

This exemption applies to SA Health DLU relating to information from the University of Adelaide – Florey Adelaide Male Ageing Study. It is an exemption from compliance with:

  • Principle 2, where SA Health DLU has collected or received personal information from the University of Adelaide – Florey Adelaide Male Ageing Study; and
  • Principle 8, allowing SA Health DLU to use the personal information received from the University of Adelaide – Florey Adelaide Male Ageing Study for a purpose that was not the primary purpose of the collection of that information.

The personal information is limited to name, date of birth, age, gender, address, previous address, study flag.

All other Principles continue to apply.

Approvals

  • Approved 24 July 2024, granted 9 July 2024 to 31 December 2024
  • Approved 20 December 2024, granted 1 January 2025 to 31 December 2025
  • Approved 3 December 2025, granted from 1 January 2026 to 31 December 2028

This exemption applies to SA Health DLU relating to information from the University of Adelaide – The South Australian Dental Longitudinal Study cohort 1 and 2. It is an exemption from compliance with:

  • Principle 2, where SA Health DLU has collected or received personal information from the University of Adelaide – The South Australian Dental Longitudinal Study cohort 1 and 2; and
  • Principle 8, allowing SA Health DLU to use the personal information received from the University of Adelaide – The South Australian Dental Longitudinal Study cohort 1 and 2  for a purpose that was not the primary purpose of the collection of that information.

The personal information is limited to name, age at baseline, sex, address.

All other Principles continue to apply.

Approvals

  • Approved 24 July 2024, granted 9 July 2024 to 31 December 2024
  • Approved 20 December 2024, granted 1 January 2025 to 31 December 2025
  • Approved 3 December 2025, granted from 1 January 2026 to 31 December 2028

This exemption applies to the SA Health DLU relating to information from The Australian Centre for Social Innovation (TACSI). It is an exemption from compliance with:

  • Principle 2, where SA Health DLU has collected or received personal information from The Australian Centre for Social Innovation (TACSI); and
  • Principle 8, allowing SA Health DLU to use the personal information received from The Australian Centre for Social Innovation (TACSI) for a purpose that was not the primary purpose of the collection of that information.

The personal information is limited to ID, name, date of birth, Aboriginal Torres Strait Islander Status, person creation date, family ID, family name, gender, family created date, family start date, address, site State, site name.

All other Principles continue to apply.

Approvals

  • Approved 24 July 2024, granted 9 July 2024 to 31 December 2024
  • Approved 20 December 2024, granted 1 January 2025 to 31 December 2025
  • Approved 3 December 2025, granted from 1 January 2026 to 31 December 2028

This exemption applies to SA Health DLU relating to information from Good Start Early Learning - GoodStart. It is an exemption from compliance with:

  • Principle 2, where SA Health DLU has collected or received personal information from Good Start Early Learning - GoodStart; and
  • Principle 8, allowing SA Health DLU to use the personal information received from Good Start Early Learning - GoodStart for a purpose that was not the primary purpose of the collection of that information.

The personal information is limited to ID, child_group, family_ID, child name, child gender, child first attended date, primary contact name, primary contact relationship, primary contact date of birth, primary contact address, SA1 code, SA2 code.

All other Principles continue to apply.

Approvals

  • Approved 24 July 2024, granted 9 July 2024 to 31 December 2024
  • Approved 20 December 2024, granted 1 January 2025 to 31 December 2025
  • Approved 3 December 2025, granted from 1 January 2026 to 31 December 2028

This exemption applies to SA Health DLU relating to information from the Northern Territory and various third-party datasets. It is an exemption from compliance with:

  • Principle 2, allowing SA Health DLU to collect personal information from third parties outside the South Australian government for the purpose and connected with the technical data linkage functions of the SA NT DataLink; and

Principle 8, allowing SA Health DLU to use that personal information for a purpose that was not the primary purpose of the collection of that information.

Approvals

  • Approved 15 December 2023, granted 1 January 2024 to 31 December 2024
  • Approved 20 December 2024, granted 1 January 2025 to 31 December 2025
  • Approved 3 December 2025, granted from 1 January 2026 to 31 December 2028

Northern Territory and Other Third Party Datasets*

Deed/Schedule 2

Years – to most recent

Identifying information

Northern Territory Government

NT Department of the Attorney General & Justice - Deed of Agreement

NT Births Register

1/1/1868 –

31/07/2023

Registration Number, Name and previously known names, DOB, Place of Birth, Sex, Aboriginal Torres Strait Islander Indicator, Multiple Birth Plurality Order, Multiple Birth Plurality Total, Birth Weight (grams)

+

For Mother and Father separately:  Address and Postcode, Name and Mothers Maiden Name, DOB, Place of Birth, Occupation, Aboriginal Torres Strait Islander Indicator

+

Date of Marriage, Place of Marriage, Marriage type (traditional/legal)

+

Previous children of this relationship: Names, Sex, DOB, living indicator)

NT Deaths Register

1/1/1870 – 31/07/2023

Registration Number, Full Name and previously known names, DOB, Date of Death, Age at Death, Place of Death, Place of Birth, Sex, Aboriginal Torres Strait Islander Indicator, Residential Address and Postcode.

Integrated Justice Information System incl. IOMS for adults

1/1/1997* – 2/4/2019

Data for linkage provided from 1992, research data only available from 1997.

IJIS Identifier, DOB, Sex, Name and previously known names, Indigenous Status, Address and Postcode (at time of birth, last known and time stamp).

NT Police, Fire and Emergency Services - Deed of Agreement

Police Real-time OnIine Management Information System

1/7/2014 – 26/11/2019

Person Identifier, Name, DOB, Gender, Race, Current Address and Postcode, Location Identifier (internal identifier for address number), Date of Address (most recent link), Date of extract.

NT Department of Health - Deed of Agreement

Client Master Index  (CMI)

1/1/1991 – 27/07/2023

Hospital Record Number (HRN), Alternate HRN flag, Primary HRN, DOB, Deceased Flag, Sex, Names, previous names and aliases, Indigenous Status, Address and Postcode.

Inpatient Activity

1/7/2000 – 30/06/2022

Based on date of discharge

HRN, Discharge date, episode number.

Perinatal Trends

(incl. DPH from 2014)

1/1/1986 – 31/12/2021

Peri Identifier +

  • For Mother:   Unique person identifier, link to CMI indicator, DOB, Aboriginal Status,   Location (suburb)
  • For Baby: Unique   baby identifier, link to the CMI, Establishment of Birth (eg Royal Darwin   Hospital), DOB,  Aboriginal Status,   Living Status of baby at birth, Sex,    Birth Weight (grams), Number of births from pregnancy (plural), Order   of Birth (sequence in which delivered).

Immunisation Register [HISTORIC -   DECOMMISSIONED]

1/1/1991 – 30/6/2018

HRN, Names, previous names and aliases, DOB, Sex, Indigenous Status, Address and Postcode at time of immunisation, Immunisation Event Date.

NT Cancer Register

1/1/1991 – 31/12/2020

Patient identifier, Current HRN, Expired or Duplicate HRNs, Names and aliases, Address and Postcode at time of diagnosis, Current Address and Postcode, Country of Birth, Indigenous Status, Sex, DOB, Estimated DOB (y/n), NT BDM Death Registration Number, Date of Death if notified.

Tumour record number, date of diagnosis.

Primary Health Care Collection

1/7/2008 – 30/06/2022

HRN, Event Id, Date of Medical Event.

Emergency Department Activity Collection

1/7/2000 – 30/06/2022

HRN, episode id, attendance date.

Hospital Pharmacy

1/7/2006 – present

No data transferred. The agreement allows for the release of project specific linkage keys and HRNs for HREC approved projects.

Hearing Health Data Collection

- Remote

- Urban

1/1/2008  - 31/12/2019

1/1/2014 – 31/12/19

Remote: HRN, Names, DOB, Sex, Ethnicity, Community, Secondary Community, Deceased, Deceased Date,. Date  stamp.

Urban: Client Id (historical), HRN, Names, DOB, Ethnicity, Address and Postcode, Mailing Address and Postcode, Date stamp.

NT Rheumatic Heart Disease Register

1997 – 22/1/2018

HRN, Names and preferred names, DOB, Sex, Aboriginal Status, deceased indicator, Date of Death, Primary health Care Clinic, Region of Clinic, Date stamp.

NT Notifiable Diseases System

1/1/1999 – 31/12/2020

Notification identifier, HRN, Sex, Names, DOB, Address, Residential Location, Residential Postcode, Indigenous Status, Date stamp.

BreastScreenNT

28/11/1994 – 31/12/2017

Client Identifier, Names, Postal Address, Residential Address and Postcode, DOB, Maiden Name, Country of Birth, Aboriginal Torres Strait islander status, Appointment date, Appointment Reference Number.

CervicalScreenNT

[HISTORIC COLLECTION]

11/3/1996 – 31/11/2017

Client ID, HRN, Names, previous names and Aliases, DOB, Address and Postcode, Client State, Aboriginal Torres Strait islander status, Year of Death, Date of test, Unique results identifier.

Mental Health Activity Collection

- Acute Inpatient (via Inpatient Activity)

- Community CCIS

1/7/2004  – 30/6/2022

1/7/2004 – 30/6/2022

HRN, Discharge date, Episode number

HRN, Event Start Date, Event Identifier

Hospital Admission Trends

1/1/1992 – 30/06/2022

HRN, Indigenous Status, DOB, Sex, Locality Code, State, separation date of inpatient event. Episode number.

Territory Families, Housing and Communities - Deed of Agreement

Child Protection

1/7/1998 – 30/6/2021

HRN Child protection Flag sits along side the HRN in the CMI Dataset for the purposes of identifying the person exists in the Child Protection Dataset.

Integrated Offender Management System (Juveniles)

1/1/1997 – 2/4/2019

IJIS Identifier, DOB, Sex, Name and previously known names, Indigenous Status, Address and Residential Postcode (at time of birth, last known and time stamp).

NT Department of Housing - Deed of Agreement

Tenancy Management System (Urban)

1/1/1991 – 30/6/2014

For Primary Client: Primary Client Number, Group Number, Application Number, Client Name and previously known names, Sex, DOB, Ethnic Origin, Address and Postcode.

For Accompanying Members: Accompanying Client Number, Relationship to Primary Client, Association Type, Name and previously known names, Sex, DOB, Ethnic Origin.

NT Department of Education - Deed of Agreement

Student Activity; Attendance; Enrolments; Assessment of Student Competencies

1/1/2005 –31/12/2021

Master Student ID, Student ID, Name(s), DOB, Gender, Address and Postcode, Indigenous Status, Census Year (e.g. 2021), Year Level (e.g. Year 9).

NAPLAN (NTG, Catholic Ed & Christian Schools)

1/1/2008 –31/12/2021

Student ID, Name, DOB, Gender, Assessment Year Level (3,5,7,9), Calendar Year

Non Government Sector

Menzies School of Health Research - Deed of Agreement

Ear Health Clinical Database (BIGDATA)

1/1/1992 – 31/12/2018

BIGDATA_id, Participant Identifier, NTG Public Hospital Record Number (HRN*), DOB, Sex, Name, Community Location, State, date of collection.

*HRN agreement from NT Dept of Health to receive this field from 1991, this links to the Primary HRN, Alternate HRN, DOB, Death timestamp, Sex, Names, Indigenous Status, Address and Postcode.

Aboriginal Community Controlled Health Organisations

Central Australian Aboriginal Congress - Deed of Agreement

Communicare:

Congress Urban Medical Clinics

Congress Remote auspiced:

- Amoonguna Health Service

- Mutitjulu Health Service

- Santa Teresa (Mpwelarre) Health Service

- Utju (Areyonga) Health

1//1/2008 – 21/6/2021

(start dates vary for CAAC Remote)

Patient ID, HRN, Names, Previous Names and Aliases, Sex, DOB, Indigenous Status, Primary Address, Previous Addressed and dates, Date of Death, Date of extract.

Katherine West Health Board - Deed of Agreement

Communicare

1/1/2010 – 30/06/21

Site Identifier, patient identifier, HRN, , Previous Names and Aliases, Sex, DOB, Indigenous Status, Primary Address, Previous Addressed and years resident, Date of Death, Date of last contact, Date of extract.

Miwatj Aboriginal Health Corporation - Deed of Agreement

Communicare

01/01/2010 – 30/06/2021

Site Identifier, patient identifier, HRN, , Previous Names and Aliases, Sex, DOB, Indigenous Status, Primary Address, Previous Addressed and years resident, Date of Death, Date of last contact, Date of extract.

Ngaanyatjarra Health Service (WA) - Deed of Agreement

Communicare

1/1/2010 – 11/10/2021

Site Identifier, patient identifier, HRN, , Previous Names and Aliases, Sex, DOB, Indigenous Status, Primary Address, Previous Addressed and years resident, Date of Death, Date of last contact, Date of extract.

Danila Dilba Health Service - Deed of Agreement

Communicare

1/1/2010 – 30/06/2021

Site Identifier, patient identifier, HRN, , Previous Names and Aliases, Sex, DOB, Indigenous Status, Primary Address, Previous Addressed and years resident, Date of Death, Date of last contact, Date of extract.

Commonwealth/National Collections

Australia and New Zealand Dialysis and Transplant Registry - Deed of Agreement

ANZData (SA and NT)

1/1/1963 – 31/12/2022

Patient ID, Record Date, Initial and subsequent hospital/unit identifiers, Initial and subsequent state/territory, Names (including maiden, previous aliases, and nick names) m DOB, Date of Death, Gender, Racial Origin, Country of Birth, initial and subsequent postcodes

Commonwealth of Australia acting through the Department for Education - Deed of Agreement

The provision of Australian Early Development Census (AEDC) data for the purposes of analysis, research and undertaking data

linkage projects

Australian Early Development Census (Cwth) (national collection)
All states

2009 - 2021

Year, Student Identifier, Name, DOB, Sex, School Identifier, School Name, Address, State of residence, Country of Birth, Place of Birth

Australian Coordinating Registry, QLD BDM** - Application and Letter of Approval

Codified Cause of Death for SA and NT

ACR COD-URF National Cause of Death Unit Record File for SA and NT

**Some identifying information was provided to the SA NT DataLink linkage unit up until 2021, this is not used as the link to Births and Deaths Data is via a Registration Number and Mortality Identifier provided to the Integration Unit (ie no personal information is required to generate project specific linkage  keys from BDM)

2006 – 2022

This links to Births and Deaths Data via a Registration Number and Mortality Identifier providing additional information on cause of death for researchers.

Information collected but not used in the Master Linkage File:

Registration Identifier, Mortality Identifier,

Birth Day, Birth Month

Not received since 2021.  Is not included in the Master Linkage File.

*in keeping with the Separation Principle of Data Linkage. SA NT DataLink’s Master Linkage File only holds person and record identifiers; the Researcher is provided with de-identified data Content data by the Data Custodian, appended to Project Specific Linkage Keys generated by SA NT DataLink.

Data provided by the Data Custodians in the NT subject to the information ACT (NT).

All other Principles continue to apply.

Approvals

  • Approved 24 July 2024, granted 9 July 2024 to 31 December 2024
  • Approved 20 December 2024, granted 1 January 2025 to 31 December 2025