How we undertake data matching
The ATO's identity-matching capability is used to identify individual and/or non-individual entities reported to us from several external sources. The process is mainframe-based and uses an ATO-designed software solution (technical standard). Aligning with guideline 4.7, this standard, supports all our data-matching programs.
We use over 60 sophisticated identity-matching techniques to ensure we identify the correct taxpayer when we obtain data from third parties. This technique uses multiple identifiers to obtain an identity match. The identity-matching process appends matching information to the original reported transaction to include an ATO identifier number and a three-character outcome code that indicates to the user the level of matching confidence for the transaction. For example, where a name, address and date of birth are available, all items are used in the identity-matching process. Very high confidence matches will occur where all fields are matched.
Additional manual processes may be undertaken where high confidence identity matches do not occur, or a decision taken to destroy the data with no further action. Our manual identity-matching process involves an ATO officer reviewing and comparing third-party data identity elements against ATO information on a one-on-one basis, seeking enough common indicators to allow confirmation (or not) of an individual's identity. We commonly call this process manual uplifting.
Data analysts use various models and techniques to detect potential discrepancies, such as under-reported income or over-reported deductions. Higher risk discrepancy matches will be loaded to our case management system and allocated to compliance staff for actioning.
Lower risk discrepancy matches will be further analysed, and a decision made to take some form of compliance or educational activity, or to destroy the data.
To maintain integrity of the administration of the tax and superannuation systems, only those with a direct and genuine ‘need to know’ can access the technical standards for our identity and discrepancy matching solutions.
Where administrative action is proposed, additional checks will take place to ensure the correct taxpayer has been identified. The taxpayers will be provided with the opportunity to verify the accuracy of the information before any administrative action is taken.
What we do before we issue a payment or apply a benefit
Where we detect a discrepancy that requires verification, we will contact the taxpayer usually by SMS, phone, or email. Before any administrative action is taken, taxpayers will be given the opportunity to verify the accuracy of the information obtained by us. The time taxpayers will have to respond may be relatively short to enable us to make the payment or apply the benefit as quickly as possible.
What we do before we amend a return
Where we detect a discrepancy that requires verification, we will contact the taxpayer usually by phone, letter or email.
Before any administrative action is taken, taxpayers will be given the opportunity to verify the accuracy of the information obtained by us. Taxpayers will be given at least 14 days to respond before administrative action is taken.
The data may also be used to ensure that taxpayers are complying with their tax and superannuation obligations, including registration, lodgment and payment.
In cases where taxpayers fail to comply with these obligations, after being reminded of them, prosecution action may be instigated in appropriate circumstances.
Where a taxpayer has correctly met their obligations, the use of the data will reduce the likelihood of contact from us.
Making a privacy complaint
If you're not satisfied with how we have collected, held, used or disclosed your personal information, you can make a formal complaint by:
PO Box 1271
ALBURY NSW 2640.
If you're not satisfied with the outcome of the privacy complaint, you can contact the Office of the Australian Information Commissioner. More details on the process can be found on the OAIC website at oaic.gov.au/privacy/making-a-privacy-complaintExternal Link.