Our reference: D2018/007103
[Redacted]
Deputy Commissioner of Taxation
Smarter Data
Australian Taxation Office
By email: [redacted]
Dear Mr Ingersoll
Request for exemption from Guidelines on Data Matching in Australian Government Administration
I refer to correspondence dated 12 June 2018 from [redacted] regarding the Australian Taxation Office’s (ATO) Share Transactions – 20 September 1985 to 30 June 2018 data matching program protocol (amended) (the data matching program).
I understand that the program proposes to match share transaction data obtained from the Australian Securities and Investments Commission (ASIC) and share registries against the ATO’s taxpayer records to identify individuals and businesses who may not be meeting their registration, reporting, lodgement and/or payment obligations.
The ATO is seeking an exemption from the data destruction requirements contained in Guideline 7 of the Guidelines on Data Matching in Australian Government Administration 2014 (the guidelines). Specifically, the ATO considers that the destruction of the datasets within 90 days – as required by Guideline 7 – would inhibit the ATO’s ability to protect public revenue.
Instead, the ATO is seeking to retain the data for seven years from receipt of all the data files from the source entities. The ATO has stated it will then conduct a review prior to the end of this seven year period to determine whether an extension to this timeframe is required. The Office of the Australian Information Commissioner (OAIC) notes that the ATO currently anticipates that it will need to retain the information acquired under this data matching program until all shares contained in the dataset have been transferred within the legislative reporting regime.
This new exemption request would extend the original five year period granted by the former Australian Information Commissioner in November 2016.
Consideration of issues under Guideline 10
Under Guideline 10, in seeking an exemption an agency must:
- advise the Commissioner in writing of the details of the proposed data matching program
- in that advice, specify how the proposed data matching program would be inconsistent with the guidelines
- explain the public interest grounds that justify the inconsistency.
In my view, the ATO’s correspondence satisfies these requirements, including by explaining the public interest grounds for the exemption in the program protocol.
The ATO considers that a variation from the usual retention period for this program is justified for the following reasons:
- the ATO is responsible for the administration of the capital gains tax regime
- individuals may retain shareholdings for many years, at times for their whole life, before disposing of them and potentially triggering a capital gains event
- destruction of the data earlier than requested would inhibit the ATO’s ability to identify taxpayers who may be subject to administrative action and therefore result in loss of public revenue
- it enhances the ATO’s analytics capability and the ATO's ability to assist individuals to comply with their taxation obligations through prefilling alert services.
I agree with the ATO’s statement that retaining data for a longer period does increase the risks to individuals’ privacy. However, the range of safeguards outlined in your correspondence appear to appropriately manage and minimise this increased risk. These safeguards include:
- storing data on secure computer systems where access is strictly controlled, and full audit logs maintained
- adherence to confidentiality and privacy legislation that prohibits the improper access to, or disclosure of, protected information.
Exemption approval
I have considered the information provided by the ATO. I agree that compliance with the data destruction requirements would significantly reduce the effectiveness of the ATO’s data matching program and I am satisfied that the public interest grounds outlined by the ATO justify departing from the guidelines. Complying with Guideline 7 would inhibit the ATO’s ability to protect public revenue through assessing the share transactions of individuals to ensure taxpayers are correctly meeting their taxation obligations on the disposal of shares and similar securities.
I approve the ATO’s request to retain information collected during the data matching program for a period longer than 90 days. I have agreed to this exemption on the understanding that the information will not be retained beyond seven years from the receipt of all data files from the source entity, unless a further exemption is approved.
The exemption is only applicable to the data collected for the Share Transactions –
20 September 1985 to 30 June 2018 data matching program protocol (amended).
Publication on the OAIC website
Under Guideline 10.6, it is the OAIC’s normal practice to make exemption requests publicly available. The ATO has advised it does not request that this advice be kept confidential and, as such, the OAIC will make it publicly available on the OAIC website.
Yours sincerely
Angelene Falk
Acting Australian Information Commissioner
Acting Privacy Commissioner
25 July 2018
CC: [redacted]
