Our reference: D2018/014947
[Redacted]
Deputy Commissioner
Smarter Data
Australian Taxation Office
By email: [Redacted]
Request for exemption from Guidelines on Data Matching in Australian Government Administration
Dear [Redacted]
I refer to correspondence dated 4 July 2018, which the OAIC first received via email on 10 October 2018, regarding the Australian Taxation Office’s Sharing Economy Accommodation 2016-17 financial years data matching program protocol. I apologise for the regrettable delay in our response to this matter.
I understand that the program proposes to match data provided by sharing economy platforms, and by financial institutions used by sharing economy platform providers, against ATO records. This is to identify individuals who rent property on a short term basis but may not be meeting their registration, reporting, lodgement and/or payment obligations.
The ATO is seeking an exemption from the data destruction timeframes contained in Guideline 7 of the Guidelines on Data Matching in Australian Government Administration 2014 (the Guidelines). Specifically, the ATO is seeking to retain each financial year’s data for five years from receipt of the final instalment of verified data files from the data providers, on the basis that this is required for the protection of public revenue.
Consideration of issues under Guideline 10
Under Guideline 10, in seeking an exemption an agency must:
- advise the Commissioner in writing of the details of the proposed data matching program
- in that advice, specify how the proposed data matching program would be inconsistent with the guidelines
- explain the public interest grounds that justify the inconsistency.
In my view, the ATO’s correspondence satisfies these requirements. This includes explaining the public interest grounds for the exemption in the program protocol, such as that:
- individuals identified as not meeting their taxation obligations may have been operating that way for many years. A retention period of five years will enable the ATO to cross reference taxpayer records retrospectively
- if the data retention period is not extended, this would inhibit the ATO’s ability to identify taxpayers who may be subject to administrative action and therefore result in loss of public revenue
- if the data retention period is not extended, the ATO would miss the opportunity to educate taxpayers trying to do the right thing, and deter those that are non-compliant from repeating the behaviour
- it would enable the ATO to conduct long term trend analysis and risk profiling of the short term accommodation market.
I agree with the ATO’s statement that retaining data for a longer period does increase the risks to individuals’ privacy. However, the range of safeguards outlined in your correspondence appear to appropriately manage and minimise this increased risk. These safeguards include:
- storing data on secure computer systems where access is strictly controlled, and full audit logs maintained
- adherence to privacy and secrecy legislation that prohibits the improper access to, or disclosure of, protected information.
Exemption approval
I have considered the information provided by the ATO and agree that compliance with the data destruction requirements would significantly reduce the effectiveness of the ATO’s data matching program. I am satisfied that the public interest grounds outlined by the ATO justify departing from the guidelines. Complying with Guideline 7 would inhibit the ATO’s ability to protect public revenue through identifying individuals who are failing to meet their taxation obligations and assisting them to comply.
I approve the ATO’s request to retain information collected during the data matching program for a period longer than 90 days. I have agreed to this exemption on the understanding that the information will not be retained beyond five years from the receipt of the last instalment of data files from the data provider, unless a further exemption is approved.
The exemption is only applicable to the data collected for the Sharing Economy Accommodation 2016-17 to 2019-20 financial years data matching program protocol.
Publication on the OAIC website
Under Guideline 10.6, it is the OAIC’s normal practice to make exemption requests publicly available. The ATO has advised it does not request that this advice be kept confidential and, as such, the OAIC will make it publicly available on the OAIC website.
Yours sincerely,
Angelene Falk
Australian Information Commissioner
Privacy Commissioner
28 February 2019
Copy to: [Redacted]
