Public sector data sharing offers public benefit but raises risks of privacy harm. This article considers the Victorian legal framework for such data sharing, highlighting risks to privacy (individual and social), and describing additional protection offered by the Charter of Human Rights & Responsibilities Act 2006 (Vic), including by reference to the varied origins of privacy and data protection legislation. It argues that Victorian courts have taken a wrong turn in applying the Victorian Charter privacy right, diverging from overseas approaches and the principle of legality, and weakening its protection. Drawing parallels with Queensland and the ACT, it identifies remedies, explaining how appropriately applied human-rights based privacy rights could uphold social value, maximise social licence and minimise privacy harms.