Data-matching Program (Assistance and Tax) Act 1990

The legislation affects four broad classes of entity and the individuals whose data they hold.

First, assistance agencies are defined in s 3(1) as the Education Department, the Social Services Department, the Veterans’ Affairs Department and the Human Services Department (Services Australia). Each of these entities supplies “basic data” at the beginning of every cycle and receives results of concern at the end. They may act on those results to grant, cancel, suspend, vary or recover personal assistance.

Second, the tax agency—the Commissioner of Taxation—receives extracted TFN and identification data in Step 2, supplies tax data in Step 3, and may receive results indicating possible tax evasion in Step 6. The Commissioner may issue or amend assessments or correct identity data on the basis of that information.

Third, the matching agency is ordinarily officers of the Social Services Department designated under s 4(1). Where a direction under s 3A is in force because powers have been delegated to the Chief Executive Centrelink, the matching function shifts to Departmental employees of Services Australia. The matching agency performs all the algorithmic validation, extraction, identity matching, payment matching, income matching and quality-assurance functions. It acts as the sole conduit; source agencies never receive raw data from each other except through the matching agency’s filtered results.

Fourth, assisted persons and their relatives are the natural persons whose data is matched. “Assisted person” means anyone to whom personal assistance is being or has been given or who is claiming it (s 3(1)). “Personal assistance” is itself a defined term that sweeps in a wide array of social security payments, veterans’ pensions and allowances, family assistance, paid parental leave instalments, student assistance schemes and military rehabilitation compensation. Because “child”, “parent”, “spouse” and “dependant” are all defined by reference to the meaning those terms have in the underlying assistance or tax law, the data of spouses, dependent children under 25, and parents can be matched even if those relatives are not themselves receiving assistance.

Any individual—alive or dead—whose family identity data, income data or TFN data is held by an assistance agency or the tax agency for the relevant purposes falls inside the program’s reach. Section 3B extends the Act to Norfolk Island, reinforcing its Australia-wide application to residents of external territories.

Officers of all agencies are personally bound by the confidentiality offence in s 15 and by the rules issued under s 12. The Information Commissioner is given standing to investigate, report and recommend compensation where breaches occur.

Agencies bear positive duties to:

• Conduct matching strictly in accordance with the six-step cycle (ss 6–7).
• Complete each cycle and its internal steps inside the statutory time limits (s 9).
• Destroy particular information received under Steps 1, 4 or 6 within 90 days unless one of the statutory exceptions is engaged (s 10(2)).
• Give written notice before taking adverse action in the circumstances listed in s 11(1) and s 11(2), recording any oral response (s 11(5A)).
• Comply with rules issued by the Information Commissioner (s 12(1)) and furnish the annual and triennial reports required by ss 12(4) and 12(5).
• Participate in privacy investigations and endeavour to reach satisfactory arrangements with the Commissioner (s 13(3)).

Individuals have corresponding rights to:

• Receive particulars of the matched information and the proposed action and a 28-day opportunity to show cause before assistance is cancelled, suspended, reduced or an overpayment recovered (s 11(1)).
• Be given notice of purely administrative corrections either before or as soon as practicable after the action (s 11(1B)).
• Complain to the Information Commissioner about any act or practice that may interfere with their privacy; such complaints are treated as Privacy Act complaints (s 14).
• Have the Commissioner investigate breaches and, where appropriate, recommend compensation or other remedial action (s 13(4)(d)).
• Know that information obtained solely under the Act cannot be recorded or disclosed by officers except in the performance of functions under the Act or with consent (s 15(1)).

The legislation also creates a limited right for source agencies to quote a TFN back to the tax agency when investigating a discrepancy further (s 10(1A)), but only for assistance agencies.

The principal criminal sanction is contained in s 15(1). An officer who has information only because of performing functions or duties under the Act must not make a record of, or disclose, any of that information. The penalty is imprisonment for two years. The offence is subject to Chapter 2 of the Criminal Code (s 2A). Two express defences exist: recording or disclosure in the course of carrying out functions under the Act, or with the consent of the person to whom the information relates (s 15(1A)). Secrecy laws that would otherwise apply to source-agency officers continue to apply to information received under the cycle (s 15(2)), but those laws do not prevent the giving of a s 11 notice (s 15(3)). The Commissioner of Taxation is deemed an officer of the tax agency for this purpose (s 15(4)).

Enforcement of the civil and procedural aspects of the regime is primarily through the Information Commissioner’s investigative powers. Section 13 confers on the Commissioner (when performing privacy functions) the same investigative powers as under Part V of the Privacy Act 1988. Where a breach is found, the Commissioner must first seek to negotiate satisfactory arrangements with the agency (s 13(3)). Failing that, a formal report must be made to the relevant Minister setting out findings, reasons, prevention recommendations and, where appropriate, compensation or remedial recommendations (s 13(4)). If the agency has not taken reasonable steps within 60 days, a follow-up report is laid before Parliament (ss 13(5)–(6)).

Breach of Part 2 or of the s 12 rules is deemed to be an interference with privacy for the purposes of s 13 of the Privacy Act 1988, opening the full complaints-handling machinery of that Act (s 14). The Commissioner may also monitor compliance using regulatory powers under the Privacy Act (note to s 13(7)).

No direct civil pecuniary penalties are created by the Act itself; instead, the threat of parliamentary scrutiny, ministerial intervention and potential compensation recommendations serves as the principal deterrent. Overpayments identified through the program remain recoverable as debts, and assistance paid during an unheeded notice period is automatically a debt (s 11(6)). Appropriations from the Consolidated Revenue Fund are authorised for any additional assistance that must be paid because of the notice requirement (s 15A).

The Act is expressly subordinate to other Commonwealth laws except to the extent of direct inconsistency (s 5(1)). It therefore sits atop, but does not displace, the general secrecy provisions of the Social Security (Administration) Act 1999, the Veterans’ Entitlements Act 1986, taxation secrecy rules and the Privacy Act 1988.

Section 5(2) provides a specific safe harbour: compliance with the data-matching program does not breach guidelines in force under s 17 of the Privacy Act 1988 that relate to TFN data or tax-file number information. Section 5(3) ensures that official oaths or statutory declarations are not infringed when officers act under the matching program.

The definitions of “personal assistance”, “child”, “parent”, “spouse”, “dependant” and “declared income” are all parasitic on the meaning those terms have in the underlying assistance or tax legislation. Consequently the scope of the matching program expands or contracts whenever those portfolio Acts are amended. The inclusion of family assistance within the A New Tax System (Family Assistance) Act 1999, paid parental leave under the Paid Parental Leave Act 2010 and military compensation under the Military Rehabilitation and Compensation Act 2004 automatically widened the dataset without textual amendment to the core definitions.

The reporting and investigation provisions integrate with the Australian Information Commissioner Act 2010. The rule-making power in s 12(2) is declared to be a “privacy function”, subjecting it to the Commissioner’s statutory charter. Investigations under s 13 engage the full suite of Privacy Act Part V powers plus regulatory monitoring under the Regulatory Powers (Standard Provisions) Act 2014 (note to s 13(7)).

Section 3A allows the Secretary of the Social Services Department to direct by legislative instrument that the Department is not an assistance agency where Centrelink powers have been delegated; such directions are registered under the Legislation Act 2003 and commence on the day after registration or a later specified day. The triennial reports required by s 12(5) are subject to the tabling time limits in s 34C of the Acts Interpretation Act 1901.

Finally, the Act’s own confidentiality offence operates cumulatively with any other applicable secrecy offence; an officer could theoretically face parallel liability under both s 15 and a portfolio secrecy provision.

Although the Act remains the 1990 statute, its text as presented reflects a series of amendments that have updated terminology, expanded coverage and strengthened procedural safeguards.

The insertion of s 2A applying the Criminal Code to all offences aligns the Act with the general Commonwealth criminal law policy adopted in the early 2000s. The creation of s 3A (directions by the Secretary) and the redefinition of the matching agency in s 3(1) and s 4(2) respond to the administrative restructuring of Centrelink and Services Australia, allowing the matching function to migrate to Departmental employees when policy responsibility shifts. These changes prevent the legislation from becoming operationally obsolete as machinery-of-government alterations occur.

The definition of “personal assistance” has been successively enlarged. Paragraphs (dd) (family assistance), (e) (parental leave pay) and (daa) (military rehabilitation compensation) were added to capture new or restructured payment streams. The inclusion of seniors health cards and financial supplement under both the Student Financial Supplement Scheme and Chapter 2B of the Social Security Act 1991 reflects legislative decisions to bring integrity checking to newer forms of Commonwealth expenditure. Each addition increases the volume and sensitivity of data available for matching, which in turn explains the simultaneous tightening of destruction rules, sampling protocols and Commissioner oversight.

Section 12 rules are now made by legislative instrument rather than by ministerial guideline, and their commencement is tied to the disallowance period under the Legislation Act 2003. Annual reports must be given to the Information Commissioner as well as Parliament, reflecting the creation of that office and the policy of centralising privacy oversight.

The 90-day destruction rule in s 10(2), the 12-month action rule in s 10(3), and the non-delegable extension power in s 10(3B) were introduced or refined to address concerns that matched data might otherwise be retained indefinitely. The express power in paragraph 14A to conduct iterative sampling with algorithm adjustment was added to improve accuracy while still requiring sample destruction, showing a legislative response to operational experience that false positives were occurring.

These amendments demonstrate a pattern: as the Commonwealth expands the range of transfer payments it makes, the data-matching net widens, but Parliament has responded by layering additional procedural and oversight obligations onto the original 1990 architecture rather than rewriting it.

The Act itself contains no reported judicial decisions, consistent with its design as an administrative integrity tool rather than a rights-creating statute. Challenges, where they occur, are channelled through the Privacy Act 1988 complaints mechanism (s 14) or through merits review of downstream decisions to cancel assistance or issue amended tax assessments.

Section 13(8) expressly preserves the right of any person to complain to the Information Commissioner about interference with privacy notwithstanding the specific investigation regime in s 13. This dual-track approach has produced Commissioner reports dealing with procedural fairness, accuracy of matching algorithms and adequacy of notice. Because the Act deems a breach of Part 2 or the s 12 rules to be an interference with privacy, the Commissioner’s findings are reviewable under the Administrative Decisions (Judicial Review) Act 1977 or via constitutional judicial review, although the text of the Act does not itself create any new justiciable rights.

Controversies have centred on three textual features. First, the breadth of “family identity data” (which includes data about living and deceased spouses, children, parents and even siblings under 25 who are dependants) has been criticised for sweeping in third parties who have no direct relationship with the assistance claim. Second, the ability of the matching agency to return TFN data to assistance agencies in Step 6 (paragraph 16) and during the paragraph 14A sampling loop has raised perennial concerns about function creep, even though the Act confines the purposes for which that TFN may then be used. Third, the 28-day show-cause period in s 11 has been said to be insufficient where complex income or family circumstances are in issue, although the statute contains no mechanism to extend that statutory minimum.

The parliamentary reporting obligations in ss 12(4) and 12(5) have ensured that triennial reviews have repeatedly examined whether the program remains proportionate. Those reviews, required by the Act itself, have generally concluded that the controls—particularly the destruction rules, the single-cycle-at-a-time limit, and Commissioner oversight—continue to provide adequate protection, but have recommended tighter algorithmic transparency and more frequent sampling audits. No amendment has yet altered the fundamental six-step architecture, suggesting that Parliament continues to regard the 1990 design as sound despite the expansion of scope.

Most practitioners assume that once data has been lawfully matched the source agency can retain it indefinitely for compliance purposes. Section 10(4) squarely contradicts that assumption: after completing any action taken under s 10(1), the agency “must not retain any information obtained in the course of such action in a separate permanent register of individuals”. The only permitted repositories are the agency’s ordinary case-management systems, which are themselves subject to normal Privacy Act and secrecy constraints.

Another trap lies in the interaction between the 90-day destruction rule (s 10(2)) and the 12-month action rule (s 10(3)). An agency that receives results on 1 July must decide within 90 days whether it will investigate or act; if it does neither and does not sample, the data must be destroyed. Yet any investigation commenced inside the 90 days can continue for up to 12 months (or longer with non-delegable extension). Agencies that commence “investigations” merely to preserve data have been criticised in Commissioner reports for artificially expanding the exception.

The oral-response recording obligation in s 11(5A) is often overlooked. Where an assistance agency gives a s 11(1) notice and the recipient attends a face-to-face interview, the officer conducting the interview must create a contemporaneous written record noting the date. Failure to do so risks rendering any subsequent adverse decision procedurally unfair or in breach of the rules issued under s 12.

Paragraph 14A creates a closed loop for algorithm tuning that many compliance officers do not realise can involve the return of TFN data from the matching agency to an assistance agency during the iterative process. While the source agency must destroy the sample “as soon as practicable after the matching is complete”, the Act is silent on destruction of any TFN data returned during the loop, leaving agencies to rely on the general s 15 confidentiality obligation and any applicable s 12 rules.

Section 8 permits on-line computer connections for data transfer. In practice this means that the matching agency’s systems are directly linked to both assistance agencies and the tax agency. A misconfigured firewall or an over-broad user access list can therefore constitute an immediate breach of s 15(1) because information becomes available to officers who have no “need to know” for the purposes of the Act.

Finally, the non-delegable nature of extension decisions under s 10(3B) is absolute. Even the Secretary cannot sub-delegate the power to grant a further 12-month period; only the named office-holders (Secretary of an assistance agency other than Human Services, Chief Executive Centrelink, Commissioner or Deputy Commissioner of Taxation) may sign the extension. Many large agencies have discovered too late that purported extensions signed by assistant secretaries are invalid, requiring fresh decisions and exposing the agency to criticism in the Commissioner’s s 13 report.

Compliance begins with governance. Each agency must maintain an up-to-date list of officers or employees who are authorised to perform matching-agency functions (s 4) and ensure that only those persons have access to the on-line links authorised by s 8. A formal memorandum of understanding between the matching agency and each source agency should document when paragraph 14A sampling will be used and the exact destruction protocols for samples.

Before any cycle commences, the matching agency must obtain the current TFN validation algorithm from the tax agency and document the version used. All data supplied in Step 1 must be limited to the statutory categories of “basic data”. Any fields beyond family identity data, income data and TFN data must be stripped before transmission.

During the cycle the matching agency should log the exact start and end times of each Step so that the seven-day and two-month limits in s 9 can be audited. Where a computer malfunction or industrial action interrupts Step 5, that time must be excluded from the calculation and the fact recorded for the annual report to the Information Commissioner.

Source agencies receiving results under Step 6 must immediately segregate the data and commence the 90-day clock. Within that window the agency must either:

(a) make a formal decision to act or investigate, or
(b) apply sampling procedures that have been previously agreed with the Information Commissioner (s 10(5)).

If sampling is chosen, the sampling plan itself should be reviewed every three years to reflect changes in payment types. Any data identified for action must be moved into the ordinary case-management system; no separate “data-match register” may be kept (s 10(4)).

When issuing a s 11 notice the agency must ensure the letter contains particulars of the precise information obtained from the matching program, not merely a generic assertion that “data matching has revealed an inconsistency”. The 28-day period runs from the date the notice is posted to the most recent address known to the agency (s 11(3)). If an oral response is received, a file note must be created on the same day recording the date and the substance of the response.

Annual reports under s 12(4) must contain every matter specified in the rules issued by the Information Commissioner. Agencies should therefore maintain a compliance dashboard that tracks the number of cycles, the number of discrepancies referred, the proportion leading to action, the number of notices issued, the number of show-cause responses received, and the number of adverse decisions ultimately taken. Triennial reports under s 12(5) require a deeper analysis of program effectiveness, including false-positive rates and any adjustments made to algorithms under paragraph 14A.

All officers likely to handle matched data must receive training that emphasises the s 15(1) offence, the narrow exceptions in s 15(1A), and the fact that consent must be obtained from the individual concerned before any disclosure outside the statutory channels. The training should be refreshed whenever the Information Commissioner issues new rules under s 12.

Finally, agencies should establish a single point of contact for the Information Commissioner so that s 13 investigations can be responded to within statutory timeframes. Where a s 13(4) report contains compensation recommendations, the agency should treat those recommendations as presumptively binding unless compelling reasons exist to depart from them; otherwise a further report under s 13(5) will be laid before Parliament identifying the agency’s non-compliance.

By treating the six-step cycle as a statutory code that cannot be varied, by maintaining rigorous destruction and notice disciplines, and by embedding the Information Commissioner’s rules into day-to-day operating procedures, agencies can demonstrate that they are using the extraordinary data-matching powers granted by the 1990 Act in the narrowly circumscribed manner Parliament intended.