Summary of the OAIC's assessment of agencies with publication obligations under the Privacy (Tax File Number) Rule 2015

Under the Privacy (Tax File Number) Rule 2015, which regulates the collection, storage, use, disclosure, security and disposal of individuals’ Tax File Number (TFN) information, six specified Australian Government agencies have obligations to make a range of information publicly available in relation to how TFN information is to be handled.

These agencies include the:

• Commissioner of Taxation/Australian Taxation Office (CoT)
• Australian Prudential Regulation Authority (APRA),
• Department of Human Services (DHS),
• Department of Education and Training (DET),
• Department of Veterans’ Affairs (DVA) and
• Department of Social Services (DSS).

In 2016–17 the OAIC conducted an assessment which looked at how well these agencies meet their obligations to publish specified information under TFN Rules 13 and 14. The assessment involved a desktop review of each agency’s website and a targeted survey questionnaire sent to each agency.

During the assessment, the OAIC identified non-compliances relating to:

1. publication of information about the prohibitions on the collection, recording, use and disclosure of TFN information (Rules 13(1)(d) and 14(1)(b))
2. publication of information about the penalties that apply to unauthorised acts and practices relating to TFNs and TFN information (Rules 13(1)(e) and 14(1)(c))
3. publication of information about where to find further detail about the matters set out in Rules 13(1) and 14(1) (Rules 13(1)(f) and 14(1)(d)).

The OAIC’s findings at the time of the assessment are summarised in the following table.

The OAIC has made recommendations to these agencies to ensure they meet their obligations to publish the specified information required by TFN Rules 13 and 14. The OAIC followed up with these agencies on their recommendations in 2018.