Sensitive Data

Data is considered sensitive if it can be used to identify an individual, species, object, or location in a way that introduces a risk of discrimination, harm, or unwanted attention.

Examples of sensitive data include identifiable or re-identifiable personal and health/medical data, Indigenous data, ecological data (e.g. the location of rare or endangered species), and commercial-in-confidence data.

Sensitive data is commonly subject to legal, ethical and/or regulatory requirements that restrict how it can be accessed, handled and shared.

Personal information is sensitive if it directly identifies a person and includes one or more pieces of information from Table 1 (Part I, Division I, Section 6) of the Privacy Act 1988. This information includes:

• Racial or ethnic origin
• Political opinions
• Membership of a political association
• Religious beliefs or affiliations
• Philosophical beliefs
• Membership of a professional or trade association
• Membership of a trade union
• Sexual orientation or practices
• Criminal record
• Health information (see section 6FA for definition)
• Genetic information
• Biometric information.

While sensitive data cannot be published in its original form, in the majority of cases, it can be shared using a combination of:

• Informed consent
• Data de-identification
• Controlled access