Our reference: D2018/000509
[redacted]
Deputy Commissioner of Taxation
Smarter Data
Australian Taxation Office
By email: [redacted]
Dear [redacted]
Request for exemption from Guidelines on Data Matching in Australian Government Administration
I refer to correspondence dated 18 December 2017 from [redacted] regarding the Australian Taxation Office’s (ATO’s) Visa Holders Data Matching Program for the 2017-18, 2018-19 and 2019-20 financial years data matching program protocol (the data matching program).
I understand that the purpose of the data matching program is to match visa data held by the Department of Home Affairs (formerly the Department of Immigration and Border Protection) with tax information from the ATO to select populations for administrative action relating to tax return integrity, income tax and GST non-compliance and fraud.
The ATO is seeking an exemption from the data destruction requirements contained in Guideline 7 of the Guidelines on Data Matching in Australian Government Administration (guidelines) in order to retain the data for a period up to three years. Specifically, the ATO considers that destruction of the datasets within 90 days — as required by Guideline 7 — would inhibit the ATO’s ability to protect public revenue.
Consideration of issues
Under Guideline 10, in seeking an exemption an agency must:
- advise the Commissioner in writing of the details of the proposed data matching program
- in that advice, specify how the proposed data matching program would be inconsistent with the guidelines
- explain the public interest grounds that justify the inconsistency.
In my view, the ATO’s correspondence satisfies these requirements, including by explaining the public interest grounds for the exemption in the program protocol.
The ATO considers that a variation from the usual retention period for this program is justified for the following reasons:
the retention of this data is required for the protection of public revenue, and destroying the data earlier than the requested extension would hinder the ATO’s ability to protect public revenue
visas frequently cover periods longer than a single financial year, and in addition, taxpayers on occasion lodge returns and forms past the ordinary due date, particularly those visiting Australia who perhaps are less familiar with Australia’s tax and superannuation system. Without continued access to this data for the period outlined, the ATO would experience challenges in verifying information so as to identify taxpayers who should be the subject of administrative action
further refining and testing risk identification models takes substantial time and longitudinal evaluation, and reducing the availability of data would negatively impact the ATO’s ability to monitor and improve the performance of the ATO’s models
destruction of the data would inhibit the ATO’s ability to identify taxpayers who should be subject to administrative action and would therefore result in loss of public revenue.
In its correspondence to the Office of the Australian Information Commissioner (OAIC), the ATO has explained that it has determined that varying the destruction conditions of the guidelines will have no effect on individuals’ privacy. The OAIC’s view is that increased data retention periods do increase privacy risks. However, the range of safeguards outlined in your correspondence appear to appropriately manage and minimise this increased risk.
Exemption approval
I have considered the information provided by the ATO. I agree that compliance with the data destruction requirements would significantly reduce the effectiveness of the ATO’s data matching program and I am satisfied that the public interest grounds outlined by the ATO justify departing from the guidelines. Complying with Guideline 7 would inhibit the ATO’s ability to protect public revenue through identifying tax compliance risks in the visa holding population.
I approve the ATO’s request to retain information collected during the data matching program for a period longer than 90 days. I have agreed to this exemption on the understanding that the information will not be retained beyond three years from the receipt of all data files from the source entity, unless a further exemption is approved.
This exemption is only applicable to the data collected for the Visa Holders Data Matching Program for the 2017-18, 2018-19 and 2019-20 financial years.
Publication on the OAIC website
Under Guideline 10.6, it is the OAIC’s normal practice to make exemption requests publicly available. The ATO has not requested that this advice be kept confidential and, as such, we will make it publicly available on the OAIC website.
Yours sincerely
Timothy Pilgrim PSM
Australian Information Commissioner
Australian Privacy Commissioner
20 February 2018
CC: [redacted]
