Credit and debit card 2015–16 and 2016–17 financial years data matching program protocol

At a glance

The ongoing credit and debit card data matching program is designed to obtain data on credit and debit card payments received by business through their merchant accounts. This protocol covers the 2015–16 and 2016–17 years. From 1 July 2017 providers will be required to report this detail to the ATO as part of the Government’s legislated compliance measure on improving compliance through third party reporting that was announced in the 2013–14 Budget.

Details will be requested from 12 Australian financial institutions annually of all credit and debit card payments received by merchants who hold a merchant facility account. The ATO will match the data provided by reporters against our records to identify businesses that may not be meeting their taxation registration, reporting, lodgment and/or payment obligations. This information will be cross referenced with other data the ATO holds.

This protocol has been prepared to meet requirements of the Office of the Australian Information Commissioner’s Guidelines on Data Matching in Australian Government Administration (2014) (the Guidelines).

Program objectives

The objectives of this data matching program are to:

• Promote voluntary compliance with taxation obligations and increase awareness in the community of the ways the ATO uses data matching to address non-compliance, by publishing this program protocol.
• Assist in building intelligence about businesses including broader risk, trend and strategic analysis.
• Ensure compliance with registration, lodgment, correct reporting and payment of taxation obligations.

How the data will be used

The data will be used to:

• detect unreported income through discrepancy matching
• identify those operating a business but failing to meet their registration, lodgment or payment obligations
• identify liquidated or de-registered businesses that are continuing to trade (phoenix operators)
• identify ‘cash only’ businesses, by exception
• support analytical models to detect high risk activity and cases for administrative action.

Learn more about what we will do before amending a return.

Previous programs

The merchant credit and debit card data has been collected since the 2008–09 financial year. Since 2013–14 the data has been supplemented with specialised payment systems data.

The data collection has promoted awareness in the community of our data matching capabilities. Publication of the data matching protocol has generated some media interest in the past.

The ongoing merchant credit and debit card data has revealed discrepancies between electronic payments received and information declared in businesses' tax returns. These discrepancies are being investigated. Revenue has been raised in relation to income tax and GST from taxpayer audits, voluntary disclosures and lodgments received based on the merchant credit and debit card data. However, due to the broad and diverse use of this data it is difficult to attach a dollar value to the program.

Data related matters

Data matching and user agency

We are the matching agency and the sole user of the complete data set obtained in the course of this data matching program. The data matching program will be conducted on our secure systems in accordance with approved policies and procedures.

In very limited and specific circumstances we may be permitted by law to disclose individual records to other government agencies.

Learn more about our on-disclosure provisions.

Data providers

Data will be obtained from:

• American Express Australia Limited
• Australia and New Zealand Banking Group Limited
• Bank of Queensland Limited
• Bendigo and Adelaide Bank Limited
• First Data Merchant Solutions Australia Pty Ltd (previously BWA Merchant Services Pty Ltd)
• Commonwealth Bank of Australia
• Diners Club Australia
• National Australia Bank Limited
• St George Bank
• Suncorp-Metway Limited
• Tyro Payments Limited
• Westpac Banking Corporation

A principle based approach has been adopted to ensure that inclusion as a source entity is fair and transparent.

Inclusion of data providers in the program is based on the following principles:

• The data owner or its subsidiary operates a business in Australia that is governed by Australian law.
• The data owner provides merchant facilities for its clients and maintains records of electronic payments received by those clients. The data owner provided these facilities for the period in focus.
• Where the client base of a data owner does not present an omitted income risk or the administrative or financial cost of collecting the data exceeds the benefit the data may provide, the data owner may be excluded from the program.

Data elements

We will obtain the following information from the data providers for the 2015–16 and 2016–17 financial years:

Merchant record fields:

• Unique merchant reference number
• Name of primary account owner
• Birth date of primary account owner
• Merchant's legal business and trading names
• Merchant's business and postal addresses
• Merchant’s Australian Business Number or Australian Company Number
• Bank-State-Branch and account number of the merchant's settlement account
• Merchant contact name and phone number
• Merchant business category code and description
• Merchant’s facility start date.

Transaction record fields per merchant – monthly transaction totals:

• Unique merchant reference number
• Monthly credit amounts and counts for each merchant
• Monthly debit amounts and counts for each merchant
• Monthly refund amounts and count for each merchant
• Monthly sale amounts and counts where card was not present
• Y/N cash out included indicator
• Monthly cash out only amounts and counts for each merchant
• Monthly cash out component amounts of a combined purchase with cash out for each merchant

Number of records

It is estimated that the total number of records obtained annually will be approximately 950,000. It is expected that around 90,000 of those matched will relate to individuals.

Data quality

We expect that the data acquired will be of a high quality as it has been in previous collections. This data is fundamental to effective business operations for merchant acquirers. We have also developed quality assurance processes in conjunction with the data providers to ensure the integrity of the data.

Data will be transformed into a standardised format and validated to ensure that it contains the required data elements prior to loading to our computer systems.

Learn more about:

• How we undertake data matching
• How we protect your personal information
• Our quality assurance framework
• Why we undertake data matching
• The costs and benefits of data matching

Data retention

We are seeking to have the Information Commissioner exercise his discretion and allow the ATO to vary from the data destruction requirements contained in the Guidelines.

The collection of data under this program protocol is expected to start in the second half of the 2016 calendar year.

We are seeking to retain the data for a period of five years from receipt of all verified data files for each relevant financial year. The retention is required for the protection of public revenue.

Current Guidelines allow data to be retained for 12 months. Destroying the data in the timeframes contained in the Guidelines would hinder our ability to protect public revenue because:

• Businesses identified as not meeting their taxation obligations, including being partly or wholly outside the taxation system, may have been operating that way for multiple years. A retention period of five years will enable the ATO to cross reference taxpayer records retrospectively.
• The nature of the discrepancy matching that occurs under this program will be, in some instances, iterative. This includes the data being used to generate lodgment reviews with subsequent lodgments then being compared to the transactional data for accuracy. This process can occur over multiple years.
• It would hinder our ability to conduct long term trend analysis in the fast evolving electronic payments market.

See the submission to the Information Commissioner setting out the basis for seeking the variation to the data destruction guidelines and its impacts on individual privacy.

Public notification of the program

We will notify the public of our intention to undertake this program by:

• publishing a notice in the Federal Register of Legislation – Gazettes in the week commencing 24 October 2016 – view the content of the gazette notice
• publishing this data matching program protocol on our website at www.ato.gov.au/dmprotocols
• advising the data providers they
  • can notify their clients of their participation in this program and providing written materials to assist with this
  • should update their privacy policies to note that personal information is disclosed to us for data matching purposes.
   

Gazette notice content

Commissioner of Taxation

Notice of a data matching program

The Australian Taxation Office (ATO) will continue to acquire annually data relating to credit and debit card payments to merchants. Data will be acquired for the 2015–16 and 2016–17 financial years from the following sources:

• American Express Australia Limited
• Australia and New Zealand Banking Group Limited
• Bank of Queensland Limited
• Bendigo and Adelaide Bank Limited
• First Data Merchant Solutions Australia Pty Ltd (previously BWA Merchant Services Pty Ltd)
• Commonwealth Bank of Australia
• Diners Club Australia
• National Australia Bank Limited
• St George Bank
• Suncorp-Metway Limited
• Tyro Payments Limited
• Westpac Banking Corporation.

The data items that will be obtained are:

• details of merchants with a credit and debit card merchant facility, such as name, address and contact information
• the amount and quantity of the transactions processed.

It is estimated that around 950,000 records will be obtained, including 90,000 matched to individuals.

These records will be electronically matched with ATO data holdings to identify non-compliance with registration, lodgment, reporting and payment obligations under taxation laws.

The objectives are to:

• Ensure compliance with registration, lodgment, correct reporting and payment of taxation obligations.
• Promote voluntary compliance with taxation obligations and increase awareness in the community of the ways the ATO uses data matching to address non-compliance, by publishing this program protocol.
• Assist in building intelligence about businesses including broader risk, trend and strategic analysis.

A document describing this program has been prepared in consultation with the Office of the Australian Information Commissioner. A copy of this document is available at www.ato.gov.au/dmprotocols

The ATO complies with the Office of the Australian Information Commissioner’s Guidelines on data matching in Australian government administration (2014) which includes standards for data matching to protect the privacy of individuals. A full copy of the ATO’s privacy policy can be accessed at www.ato.gov.au/privacy

Legal matters

Learn more about:

• Our privacy policy
• Making a privacy complaint
• Our lawful role
• Our legal authority to undertake a data matching program

Submission to the Information Commissioner

Varying from the data destruction requirements

The Australian Taxation Office (ATO) is seeking approval for the credit and debit card data matching program to vary from one or more of the conditions detailed in Guideline 10 of the Office of the Australian Information Commissioner’s Guidelines on data matching in Australian government administration (2014) (the Guidelines).

We are seeking to retain data for a period of five years from receipt of all verified data files from the data providers for the relevant financial year. We consider that a variation from the usual retention periods for this data matching program is in the public interest as:

• A retention period of five years will enable the ATO to cross reference taxpayer records retrospectively.
• The nature of the discrepancy matching that occurs under this program will be iterative, in some instances occurring over multiple years.
• It would enable the ATO to conduct long term trend analysis in the fast evolving electronic payments market.
• Destruction of the data would inhibit the ATO’s ability to identify taxpayers who may be subject to administrative action and therefore result in loss of public revenue.

We have determined that this variation will not affect the privacy of an individual.

This program will be subject to an evaluation within three years which is consistent with the requirements of Guideline 9.

Additional information justifying this variation is included in the tables below:

• Table 1 – matters considered in accordance with Guideline 10.2 in seeking this variation
• Table 2 – consistency with requirements of the other guidelines issued by the Office of the Australian Information Commissioner

Table 1: Matters considered in seeking this variation to the Guidelines

Matter considered		Consideration
10.2.1	The effect of not abiding by the specified requirements of the Guidelines would have on individual privacy	Retaining data for a period of five years will not increase the risks to an individual’s privacy. We have in place very secure processes for handling and storing data. Once acquired, all data will be stored on our secure computer systems where access is strictly controlled and full audit logs maintained The ATO and our staff operate under stringent secrecy and privacy legislation that prohibits the improper access to or disclosure of protected information. These obligations are supported by significant penalties, including imprisonment. This substantially mitigates the risks of breaches of privacy.
10.2.2	The seriousness of the administrative or enforcement action that may flow from the data matching program	An extension of the retention period will not affect the seriousness of the administrative action that may flow from the match, but will assist in detecting non-compliance or taxation fraud Where we propose to take administrative action where a taxpayer may have reported incorrectly, we will differentiate between those that try to do the right thing and those that set out to deliberately avoid their obligations. Documented procedures, including the Taxpayers’ Charter and compliance model will be followed to ensure fairness and consistency.
10.2.3	The effect that not abiding by the specified requirements of the Guidelines would have on the fairness of the program – including its effect on people’s ability to find out the basis for decisions that affect them and their ability to dispute those decisions	There will be no effect on the fairness of the program or the ability of taxpayers to find out the basis of decisions that impact them or their ability to dispute those decisions Before any administrative action is undertaken, taxpayers will be given at least 28 days to verify the accuracy of the information that has been derived from this data matching program Where administrative action is to be undertaken, we will adhere to the principles established in the Taxpayers’ Charter and compliance model to ensure an equitable and consistent approach is taken If a taxpayer does not agree with an assessment, they maintain the right to dispute the decision. They also have the legal right to appeal against those decisions through the courts and tribunals.
10.2.4	The effect that not abiding by the specified requirements of the Guidelines would have on the transparency and accountability of government operations	There will be no adverse effects on the transparency and accountability of government operations A program protocol is submitted to the Office of the Australian Information Commissioner and we will strictly adhere to the commitments in that document We will publish a notice with general information about the program in the Federal Register of Legislation – Gazettes before administrative action commences. We will also make a copy of the program protocol available on our website.
10.2.5	The effect that not abiding by the specified requirements of the Guidelines would have on compliance of the proposed program with the Australian Privacy Principles in the Privacy Act 1988	There will be no effect on compliance with the Australian Privacy Principles contained in Schedule 1 to the Privacy Act 1988 due to longer retention of the data. The data is collected solely for the stated objectives established in the data matching program protocol.
10.2.6	The effect that abiding by all of the requirements of the Guidelines would have on the effectiveness of the proposed program	The effectiveness of the program would be reduced if the data retention period is not extended There would be a significant reduction in our ability to detect incorrect reporting and taxation fraud without assessing trends in the data collected The destruction of the data in accordance with the current guidelines would impact the integrity of the taxation system by: limiting our ability to identify taxpayers who may be subject to administrative action resulting in the loss of revenue
10.2.7	Whether complying fully with the Guidelines could jeopardise or endanger the life or physical safety of information providers or could compromise the source of information provided in confidence	Not abiding by all the requirements of the Guidelines would not influence or affect the personal safety of any individual identified as part of the program or compromise the source of the information provided in confidence.
10.2.8	The effect that abiding by all the requirements of the Guidelines would have on public revenue – including tax revenue, personal benefit payments, debts to the Commonwealth and fraud against the Commonwealth	Not allowing the variation to the data retention period of the current program would cause us to miss potential breaches of taxation laws and subsequent non-payment of tax. This would result in the Commonwealth foregoing taxation revenue There are risks to the integrity of taxation system when people fail to comply with their obligations. Abiding by all of the requirements of the guidelines will reduce the effectiveness of the proposed compliance activity. We would miss the opportunity to educate those taxpayers trying to do the right thing, and deter those that are non-compliant from repeating the behaviour The effect of abiding by all of the requirements in the guidelines could negatively impact both public revenue and the confidence the public and government have in the ATO as an administrator of the taxation system. People not complying with their taxation obligations, including those operating outside the system, set a bad example to compliant taxpayers and may encourage their non-compliance. Maintaining community and government confidence in the taxation system is critical to our ongoing role.
10.2.9	Whether abiding by all of the requirements of the Guidelines would involve the release of a document that would be an exempt document under the Freedom of Information Act 1982	Upon receipt of a freedom of information request only information relating to the taxpayer’s own affairs will be released to the taxpayer concerned.
10.210	The legal authority for conducting the proposed program in a way inconsistent with the specified requirements of the Guidelines	There is no specific legislative power authorising the conduct of this program inconsistent with the Guidelines The Commissioner of Taxation, or his authorised representative, has formed the opinion that this data is required to enable us to effectively and efficiently carry out its legislated functions under the general powers of administration contained in: Section 3A of the Taxation Administration Act 1953 Section 8 of the Income Tax Assessment Act 1936 Section 1-7 of the Income Tax Assessment Act 1997 Section 356-5 in Schedule 1 of the Taxation Administration Act 1953   The reasons for proposing to operate outside requirements of the Guidelines are detailed above.

Table 2: Matters considered in seeking this variation to the Guidelines

This section outlines where we are being consistent with the requirements of the Guidelines.

Paragraph/Guideline		Action taken/To be taken
Paragraph 6	Status of the Guidelines	The commitment to complying with the Guidelines is embedded in our data management policies and principles and clearly stated in the chief executive instruction.
Guideline 1	Application of the Guide	We apply the guidelines for all data matching programs where it is anticipated the program will include records of 5,000 or more individuals. We recognise that programs where there are multiple data sources but with common objectives and algorithms are treated as a single data matching program.
Guideline 2	Considerations before conducting a data matching program	We conduct a cost-benefit analysis and consider alternate methods prior to proposing to conduct a data matching program. Further, we have rigorous governance arrangements, processes and system controls in place to protect the privacy of individuals.
Guideline 3	Prepare a program protocol	Prior to conducting a data matching program, we prepare a data matching program protocol, submit this to the Office of the Australian Information Commissioner and make a copy publicly available on the ATO website When elements of a data matching program change, the protocol is amended, a copy of the amended protocol is provided to the Office of the Australian Information Commissioner and updated on our website
Guideline 4	Technical standards report	Documentation is prepared and maintained so as to satisfy the requirements of a technical standards report.
Guideline 5	Notify the public	We publish notification of our intention to undertake a data matching program in the Federal Register of Legislation – Gazettes prior to the commencement of the program. This notice will include the following information as required by the Guidelines: a brief description of the objectives of the data matching program the matching agency and source entities involved in the data matching program a description of the data contained in the data set involved in the data matching program the categories of individuals about whom personal information is to be matched the approximate number of individuals affected reference to our privacy policy. Notification of the program is also published on our website and data providers are advised they can advertise their participation in the data matching program.
Guideline 6	Notify individuals of proposed administrative action	Prior to taking any administrative action as a result of the data matching programs, individuals and other entities are given at least 28 days to verify the accuracy of the information provided to us by third parties.
Guideline 7	Destroy information that is no longer required	We are seeking to vary from this requirement.
Guideline 8	Do not create new registers, datasets or databases	We do not create new registers or databases using data obtained in the course of a data matching program.
Guideline 9	Data matching program evaluations	Programs are evaluated within three years of the commencement of the data matching program. These evaluations are provided to the Office of the Australian Information Commissioner on request.
Guideline 10	Variations to guideline requirements	When we intend to vary from the requirements of the Guidelines, we seek the approval of the Office of the Australian Information Commissioner and provide documentation to support the variance.
Guideline 11	Data matching with entities other than agencies	We undertake our own data matching programs. This function is not outsourced. Where data is obtained from an entity other than an individual, we usually do so using our formal information gathering powers. In these instances the entities are advised they are able to notify their clients of their participation in the data matching program.
Guideline 12	Data matching with exempt agencies	We do not usually undertake data matching with agencies that are exempt from the operations of the Privacy Act 1988 under section 7 of that Act and that are subject to the operation of the Guidelines (i.e. any data matching undertaken with an exempt agency would usually be for fewer than 5,000 individuals). In the event a data matching activity would otherwise be subject to these Guidelines except for the exemption status, we still adhere to the principles of the Guidelines and prepare a program protocol, seeking to vary from the Guidelines by not publicly notifying of the program and publishing the protocol. We would still lodge a copy of the protocol with the Office of the Australian Information Commissioner.
Guideline 13	Enable review by the Office of the Australian Information Commissioner	We would not prevent the Office of the Australian Information Commissioner from reviewing our data matching activities and processes. These activities and processes have been reviewed by the Australian National Audit Office and Inspector-General of Taxation.

Go back

More information

What we will do before we amend a return

Where we detect a discrepancy that requires verification we will contact the taxpayer usually by telephone, letter or email.

Before any administrative action is taken, taxpayers will be provided with the opportunity to verify the accuracy of the information obtained by us. Taxpayers will be given at least 28 days to respond before administrative action is taken.

For example, where discrepancy matching identifies that a taxpayer is not reporting all of their income, but in fact they are reporting the income under another entity, the taxpayer will be given the opportunity to clarify the situation.

The data may also be used to ensure that taxpayers are complying with their other taxation obligations, including registration requirements, lodgment obligations and payment responsibilities.

In cases where taxpayers fail to comply with these obligations, after being reminded of them, escalation for prosecution action may be instigated in appropriate circumstances.

Where a taxpayer has correctly met its obligations, the use of the data will reduce the likelihood of contact from us.

Go back

Our on-disclosure provisions

Division 355 of Schedule 1 to the Taxation Administration Act 1953 sets out the other government agencies we can disclose taxpayer information to, and the circumstances we are permitted to make those disclosures. These include agencies responsible for:

• state and territory revenue laws
• payments of social welfare and health and safety programs for determining eligibility for certain types of benefits and rebates
• overseeing superannuation funds, corporations and financial market operators to ensure compliance with prudential regulations
• determining entitlement to rehabilitation and compensation payments
• law enforcement activities to assist with specific types of investigations.

Each request for information by other agencies will be assessed on its merits and must be for an admissible purpose allowed for by taxation laws.

Go back

How we undertake data matching

We use sophisticated identity matching techniques to ensure we identify the correct taxpayer when we obtain data from third parties. This technique uses multiple details to obtain an identity match. For example, where a name, address and date of birth are available all items are used in the identity matching process. Very high confidence matches will occur where all fields are matched.

Additional manual processes may be undertaken where high confidence identity matches do not occur, or a decision taken to destroy the data with no further action.

Where administrative action is proposed, additional checks will take place to ensure the correct taxpayer has been identified. The taxpayers will be provided with the opportunity to verify the accuracy of the information before any administrative action is taken.

Data analysts use various models and techniques to detect potential discrepancies, such as under-reported income or over-reported deductions. Higher risk discrepancy matches will be loaded to our case management system and allocated to compliance staff for actioning.

Lower risk discrepancy matches will be further analysed and a decision made to take some form of compliance or educational activity, or to destroy the data. In accordance with Guideline 7, where a decision is made not to take further action, the information that has been collected will be destroyed within 90 days of the decision not to take further action.

Go back

How we protect your personal information

Our staff are subject to the strict confidentiality and privacy provisions contained in Division 355 of Schedule 1 to the Taxation Administration Act 1953 and include terms of imprisonment in cases of serious contravention of these provisions.

All ATO computer systems are strictly controlled, with features including:

• system access controls and security groupings
• login identification codes and password protection
• full audit trails of data files and system accesses.

We will utilise our secure internet-based data transfer facility to obtain the data from source agencies.

Where this is not possible, data providers will be requested to provide copies of the data on a CD, DVD or USB device encrypted to a standard that satisfies Australian government requirements. The magnetic media device will be password protected, with the password provided under separate cover to us.

Where the data is not collected by an authorised ATO officer, an approved courier service will be used to collect the data. In remote locations not serviced by an approved courier service, the Australia Post ‘Express Post Platinum’ will be used (this provides both tracking and signature for delivery features).

Go back

Our quality assurance framework

Quality assurance processes are integrated into our processes and computer systems and are applied throughout the data matching cycle.

These assurance processes include:

• registering the intention to undertake a data matching program on an internal register
• obtaining approval from the data matching gatekeeper and relevant Senior Executive Service (SES) officers prior to any activity being undertaken
• conducting program pilots or obtaining sample data to ensure the data matching program will achieve its objectives prior to full data sets being obtained
• notifying the Office of the Australian Information Commissioner of our intention to undertake the data matching program and requesting permission to vary from the data matching guidelines (where applicable)
• maintaining access management logs recording details of who has access to the data, why access is required and how it will be used
• processes embedded into compliance activities, such as:
  • review of risk assessments, taxpayer profiles and case plans by senior officers prior to client contact
  • ongoing reviews of cases by subject matter technical experts at key points during the life cycle of a case
  • regular independent panel reviews of samples of case work to provide assurance of the accuracy and consistency of case work.
   

These processes ensure data is collected and used in accordance with our data management policies and principles, and complies with the Information Commissioner's data matching guidelines.

Go back

Why we undertake data matching

We have considered a range of alternatives to this data matching program to ensure entities are complying with their taxation obligations. Relying only on data already held by the ATO is of limited value for the following reasons:

• we only receive data from taxpayers that are correctly registered and meeting their lodgment obligations
• we have no other data to cross-reference to ensure taxpayers are reporting their obligations correctly other than by directly contacting every taxpayer.

This data matching program will allow us to identify taxpayers who are not fully complying with their obligations, as well as those that may be operating outside the taxation system. It will also reduce the likelihood of the ATO unnecessarily contacting taxpayers who appear to be complying with their taxation obligations.

Data matching is an effective method of examining records of thousands of taxpayers to ensure compliance with lodgment and reporting obligations that would otherwise be a resource intensive exercise.

Data matching also assists us in effectively promoting voluntary compliance by notifying the public of areas and activities under scrutiny.

Go back

Costs and benefits of data matching

Costs

There are some incidental costs to us in the conduct of this data matching program, but these will be more than offset by the total revenue protected. These costs include:

• data analyst resources to identify potential instances of non-compliance
• compliance resources to manage casework and educational activities
• governance resources to ensure that the Guidelines and Privacy Act are complied with, and quality assurance work to ensure the rigour of the work undertaken by analysts and compliance staff
• storage of the data.

Benefits

Benefits from conducting this data matching programs include:

• maintaining community confidence in the taxation system by creating a level playing field, as well as maintaining community confidence in the ATO’s capacity to fairly administer the system
• integrity of the taxation system – there are inherent risks in taxpayers not complying with their obligations, including those that deliberately abuse the taxation system – this program will assist the ATO in detecting, dealing with and deterring those that are not meeting their obligations
• enabling enforcement activity and recovery of taxation revenue – without undertaking this data matching program and subsequent compliance activity there are no assurances that a wider risk to revenue does not exist.

Go back

Making a privacy complaint

If a taxpayer is not satisfied with how we have collected, held, used or disclosed its personal information, they can make a formal complaint by:

• using the online complaints form at www.ato.gov.au/complaints
• phoning our complaints line on 1800 199 010
• phoning the National Relay Service on 13 36 77 (if you have a hearing, speech or communication impairment)
• sending us a free fax on 1800 060 063
• writing to us at:

ATO Complaints

PO Box 1271

ALBURY NSW 2640

If a taxpayer is not satisfied with the outcome of the privacy complaint, they can contact the Office of the Australian Information Commissioner. More details on the process can be found on the OAIC website at https://www.oaic.gov.au/privacy/privacy-complaints/External Link

Go back

Our lawful role

The Commissioner of Taxation has responsibility for ensuring taxpayers meet their taxation obligations. Compliance with these obligations is a matter we take seriously and failure to address non-compliant behaviour has the potential to undermine community confidence in the integrity of the taxation and superannuation systems and our capacity to administer those systems.

Our data matching program is one of the strategies used to identity and deal with non-compliant behaviour. Data matching programs also provide a degree of assurance that taxpayers are meeting their obligations.

Go back

Our legal authority to undertake a data matching program

ATO legislation

The data will be obtained under our formal information gathering powers contained in section 353-10 of Schedule 1 to the Taxation Administration Act 1953.

This is a coercive power that obligates the data providers to furnish the information requested. We will use the information for taxation compliance purposes.

Privacy Act

Data will only be used within the limits prescribed by Australian Privacy Principle 6 (APP6) contained in Schedule 1 of the Privacy Act 1988 and in particular:

• APP6.2(b) – the use of the information is required or authorised by an Australian law
• APP6.2(e) – the ATO reasonably believes that the use of the information is reasonably necessary for our enforcement related activities.

Go back

Credit and debit card - 2015-16 and 2016-17 financial years data matching program protocol.