Data-matching involves bringing together data from different sources and comparing it. Much of the data-matching done by agencies subject to the Privacy Act aims to identify people for further action or investigation. For example, records from different departments are often compared to identify people who are being paid benefits to which they are not entitled or people who are not paying the right amount of tax. Data-matching poses a particular threat to personal privacy because it involves analysing information about large numbers of people without prior cause for suspicion.

Data-Matching under the Data-Matching Act

The Data-matching Program (Assistance and Tax) Act 1990 (Cth) regulates the use of the tax file number in comparing personal information held by the Australian Taxation Office and by assistance agencies (Centrelink and the Department of Veterans' Affairs). The Explanatory Memoranda to the Bill outline the objectives of the Data-matching Act. For the Explanatory Memorandum to the 1990 Bill, please select PDF. For the Explanatory Memoranda on the 1992 amendments to the Data-matching Act, please select PDF. Personal information is supplied by the assistance agencies and compared with taxpayer information to detect inappropriate payments.

Section 12 of the Act requires the Privacy Commissioner to issue Guidelines for the conduct of the data-matching program (PDF). Guidelines were first issued in September 1991 (to replace those Guidelines originally set down in a schedule to the Act). The current Guidelines were issued in October 1994.

Centrelink, the matching agency as defined in the Data-matching Program (Assistance and Tax) Act 1990 (Cth) revised its data-matching protocol in July 2008 (PDF). This protocol outlines the techniques used to match personal information.

All applicants for welfare assistance must give their tax file number as a precondition to payment. The Data-matching Act authorises its use to obtain income details from the Australian Taxation Office to check that the payments made are correct. The Act and guidelines contain a number of technical controls and fairness provisions which are overseen by the Privacy Commissioner.

A breach of the Act or guidelines constitutes an interference with privacy under s.13 of the Privacy Act and a person may complain to the Privacy Commissioner if he or she considers a breach may have occurred.

Data-Matching under the Voluntary Data-Matching Guidelines

The Privacy Commissioner has also issued advisory Guidelines for the Use of Data-Matching in Commonwealth Administration (PDF) for voluntary adoption by agencies conducting matching other than the programs specifically regulated by the 1990 Act. These Guidelines therefore apply when the TFN is not used in the matching process.

Exemptions to the Requirements of the Voluntary Data-matching Guidelines

Paragraph 26 of the voluntary data-matching guidelines allows agencies to seek exemption from compliance with certain aspects of the guidelines, where the agency believes it to be in the public interest. In such circumstances, the agency submits to the Privacy Commissioner advice about the proposed program, details of the exemption sought and the public interest grounds for seeking the exemption.

The Guidelines also outline that it is the Commissioner's normal practice to make such advice publicly available. Listed below are exemptions that have been granted by the Office:

Australian Tax Office - exemptions from the data destruction requirements

Banking Transparency Strategy Data-matching Project

• The Australian Tax Office's Program Protocol - PDF
• The Australian Tax Office's proposal to conduct a data-matching program in a way inconsistent with one or more requirements of the voluntary data-matching guidelines - PDF
• Summary of the Privacy Commissioner's Response (March 2010) - PDF

State & Territory Government Revenue and Land Titles Offices

• The Australian Tax Office's Program Protocol - PDF
• The Australian Tax Office's proposal to conduct a data-matching program in a way inconsistent with one or more requirements of the voluntary data-matching guidelines - PDF
• Summary of the Privacy Commissioner's Response (May 2005) - PDF

Back to Top