Data-matching Program (Assistance and Tax) Rules 2021

The Rules revolve around a small set of legal and operational concepts that determine how the program is designed, executed and overseen.

• Program and program protocol. The Rules apply only to “the matching program referred to in the Data‑matching Act” (section 6). The matching agency must maintain a program protocol describing the program’s overview, objectives, data frequency and nature, participating agencies, legal authority for collections (for each source agency), use of identification numbers (including tax file numbers), data quality and security measures, actionable outcomes and notice templates, public notice arrangements and time limits (section 7(1)-(3)). The protocol must also set out the justification, alternatives considered, and costs and benefits (section 7(4)). The protocol must be provided to the Information Commissioner and published unless publication is likely contrary to the public interest (section 8).

• Technical standards report. Before a program commences the matching agency must prepare a technical standards report covering the nature and quality of source data, matching algorithm specifications, operating procedures, use of identification numbers, data definitions and recognition rules, validation procedures, data quality remediation techniques, and security controls (section 11(1)-(2)). The report must be maintained and provided to the Information Commissioner and source agencies (section 11(3)). Agencies must comply with the technical standards (section 12(1)), and the Information Commissioner may require variations (section 13(1)-(2)).

• Matching lifecycle and steps. The Rules reference Steps 1, 4 and 5 of a data matching cycle (sections 16-17). When no discrepancy is produced, the matching agency must destroy personal information as soon as practicable after commencing Step 5 and no later than 24 hours after completion of Step 5 (section 16(1)-(2). Where discrepancies are produced, the matching agency must supply results to relevant source agencies within seven days of the relevant step’s completion, and source agencies must follow section 10 of the Data‑matching Act in dealing with results (section 17(1)-(2)).

• Discrepancy, dispute and action. The Rules define “discrepancy” as a program result warranting further action by a relevant source agency (section 5). “Action” is defined by reference to section 10 of the Data‑matching Act and, for the tax agency, expressly includes requesting a taxpayer to lodge a return (section 5). The Rules specify steps for confirming matches before administrative action (section 14), notifying individuals if the agency will check with the individual instead of checking source data (section 15), and retaining written records where those records are made under section 11(5A) of the Data‑matching Act (section 15(5)).

• Data retention and destruction. The Rules prescribe rapid destruction of non‑discrepant data (section 16), and time limits for retention of discrepant data , destroy within 14 days where the source agency takes no further action and, where action is taken, destroy on “final completion of the action” as defined (section 17(3) and (5)-(6)). The definition of final completion varies by circumstance, including AFP or DPP carriage, recovery or waiver of debt, issuance of tax assessments with a 90‑day appeal expiry rule, or a 12‑month rule for other situations (section 17(6)).

• Limits on new registers. Source agencies are prohibited from linking or merging information to create a new separate permanent register or database of individuals subject to the program (section 18(1)), subject to narrowly drawn exceptions for registers of individuals warranting further inquiry and exclusion registers, and strict deletion obligations after action is completed (sections 18(2)-(5)).

• Oversight and reporting. The Information Commissioner is responsible for monitoring compliance, providing advice, and must include an assessment of compliance in the annual report, utilising investigatory and audit powers in the Privacy Act where necessary (section 19). Agencies must report periodically to the Information Commissioner on agreed matters and specific metrics (section 20); reports to Parliament must address the same enumerated matters (section 21).

• Interaction with Privacy Act. The Rules explicitly do not intend to affect the operation of the Privacy Act or the Australian Privacy Principles (section 22(1)), preserving that framework as a baseline.

Terminology points to note in practice: “matches undertaken” has a specific counting convention (total number of records received by matching agency after separation into individual records, section 5), and the Rules frequently cross‑reference provisions of the Data‑matching Act (not reproduced here) for substantive powers and notice requirements (sections 5, 7(3)(8), 15 and 17(2) among others). The Rules therefore operate as a procedural and technical framework that prescribes what must be documented, how quality and security must be addressed, and how data subjects must be notified and protected by retention rules.

The Rules allocate duties across three main actor groups and inform affected individuals.

• Matching agency. The matching agency is the primary duty holder for creating and maintaining the program protocol and the technical standards report (sections 7(1) and 11(1)), for preparing those documents in consultation with source agencies (section 7(2)), and for performing the match and delivering match results to source agencies within prescribed timeframes (section 17(1)). The matching agency bears the cost and responsibility for specifying matching algorithms, operating procedures, data definitions, security controls and procedures to confirm validity (section 11(2)(b)-(c), (e)). It must also destroy non‑discrepant source data promptly (section 16(1)-(2)).

• Source agencies (assistance agencies, tax agency). Source agencies are the agencies that supply data into the program and have duties to comply with the program protocol and technical standards (sections 9 and 12(1)). They must establish reasonable procedures for confirming validity of results before relying on them for administrative action (section 14). When discrepancies arise, source agencies must deal with results in accordance with section 10 of the Data‑matching Act (section 17(2)), may refer discrepancies to other source agencies (section 17(4)), and must obey destruction and retention rules in section 17(3) and (5)-(6). The Rules explicitly require assistance agencies to inform individuals that a program protocol is available from the Information Commissioner (section 10(2)), imposing a duty to assist with transparency and notice.

• Information Commissioner. The Information Commissioner is given oversight responsibilities: receive program protocols and technical standards reports (sections 7(1), 11(3)), approve amendments to program protocols (section 10(1)), require variations to the technical standards report (section 13(1)), monitor compliance and include an assessment in the annual report (section 19(1)-(2)), and may require periodic reports and specific metrics from agencies (section 20). The Commissioner’s role is both supervisory and investigatory: the Rules allow use of Privacy Act investigatory and audit powers (section 19(2)). The Commissioner also has discretion to withhold publication of a protocol where publication would be contrary to the public interest (section 8(2)).

• Individuals subject to matching. Persons whose personal information is used in the program are affected in at least four ways. First, the Rules require notice arrangements (section 7(3)(9) and section 15) and retention of written records linked to their file where applicable (section 15(5)). Second, individuals benefit from mandatory validation procedures before administrative action is taken (section 14) and a minimum 28‑day response period when an agency proposes to check with an individual rather than source data (section 15(1)(b)). Third, strict destruction timelines limit unnecessary retention of their personal information when no discrepancy is found (section 16). Fourth, a prohibition on creating new permanent registers guards against the aggregation of matched data into new long‑lived databases (section 18).

• Parliament and public. The Rules require agencies to prepare reports to Parliament addressing a set list of measurable items, including costs, benefits, number of matches, proportion of matches resulting in discrepancies and actions taken (section 21). The program protocol must generally be published and made publicly inspectable unless the Information Commissioner decides nondisclosure is in the public interest (section 8). Thus Parliament and the public may obtain oversight material, subject to the Commissioner’s discretion.

• Taxpayers in particular. The Rules define “action” for the tax agency to include a request that a taxpayer lodge a return (section 5), clarifying that tax administration consequences such as assessments and requests to file returns fall within the dataset of possible administrative outcomes driven by matches.

Who pays and who decides. The matching agency incurs the main design, technical and operational costs of the protocols and algorithms. Source agencies bear costs of data provision, validation procedures, recordkeeping to meet the reporting metrics set out in section 20, and any administrative action taken as a result of matches. The Information Commissioner decides on approval of protocol amendments, variation of technical standards, and on whether protocol publication would be contrary to the public interest (sections 10(1), 13(1), and 8(2)). Individuals are the object of data processing decisions and have rights to notice and complaint under the Privacy Act (sections 15 and 22(1)).

The Rules create a network of mandatory duties, consultation and reporting obligations, plus procedural rights of individuals.

Key duties

• Maintain program protocol. The matching agency must maintain a program protocol that contains a specified list of information: overview, objectives, matching nature and frequency, participants, legal authority for collections, explanation of identification numbers (including TFNs), quality and security measures, possible actions and notice templates, what notice has been or will be given, and time limits (section 7(1)-(3)). It must also explain justification, alternatives, costs and benefits and other effectiveness measures considered (section 7(4)). The matching agency must develop the protocol in consultation with source agencies (section 7(2)).

• Publish and make protocols inspectable. The matching agency must provide a copy of the protocol to the Information Commissioner and publish it and cause a Gazette notice unless the Commissioner finds publication contrary to public interest (section 8(1)-(2)).

• Comply with protocol and technical standards. All agencies participating in the program must comply with the program protocol (section 9) and comply with the technical standards report (section 12(1)).

• Prepare and maintain technical standards report. The matching agency must prepare a technical standards report before commencing a program, covering data quality, matching algorithms and rules, validation procedures and security measures, and provide it to the Information Commissioner and source agencies (section 11(1)-(3)).

• Validation before action. Source agencies must establish reasonable procedures to confirm validity of matching results before relying on them for administrative action, unless there are reasonable grounds to believe the results are unlikely to be in error (section 14). Agencies must consider consistency in content and context of data when forming that view (section 14).

• Notification to individuals. If a source agency proposes to confirm a match by checking with an individual rather than checking source data, the agency must give written notice of prescribed matters (the match, initial conclusions, explanation of techniques used, proposed administrative action, and that no check of source data has been performed), allow at least 28 days to respond, and notify the right to complain under the Privacy Act (section 15(1)). If there is a data accuracy dispute but the agency still considers action warranted, the agency should inform the individual of their right to lodge a Privacy Act complaint (section 15(2)). Agencies must not take administrative action that interferes with appeal or review rights unless required by law (section 15(3)). Where data supplied prior to 1 January 1991 is to be used, the agency must give written notice before first use or as soon as practicable (section 15(4)). Written records made under section 11(5A) of the Data‑matching Act must be retained on or linked to the individual’s file (section 15(5)).

• Data destruction. Matching agency must destroy non‑discrepant personal information as soon as practicable after commencing Step 5 of the data matching cycle and no later than 24 hours after completion of Step 5 unless delay is caused by malfunction or industrial action (section 16(1)-(2)). For discrepancies, results must be supplied to source agency within seven days (section 17(1)); if source agency decides to take no further action it must destroy that information within 14 days where reasonably practicable (section 17(3)). Where action proceeds, the information must be destroyed on final completion of the action as defined (section 17(5)-(6)).

• Restrictions on new registers. Source agencies must not permit information used in the program to be linked or merged in a way that creates a new separate permanent register or database about the individuals whose information was used (section 18(1)). Exceptions are narrow and include a register for individuals warranting further inquiry and a register for excluding individuals from selection for investigation; any such register must contain only the minimum information required and must have deletion obligations (sections 18(2)-(5)).

• Reporting. Matching and source agencies must report periodically to the Information Commissioner on matters agreed with the Commissioner and may be required to report on a detailed list of metrics including costs and benefits, numbers of matches, discrepancies, notices and recoveries (section 20). Reports to Parliament must address a substantially similar list of items (section 21).

• Cooperation with Information Commissioner. The Information Commissioner is empowered to monitor compliance and to include compliance assessment in the annual report; agencies must cooperate with audits and investigations under the Privacy Act (section 19).

Rights

• Right to notice and response. Individuals have a right to receive reasonable written notice and a reasonable response period (at least 28 days) when the agency relies on an individual check rather than source data to confirm a match (section 15(1)(b)). They must be informed of the match, the agency’s initial conclusions, the techniques used, proposed administrative action, and that no source data check has occurred (section 15(1)(a)).

• Right to make a Privacy Act complaint. Individuals must be notified of their right to make a complaint under the Privacy Act (section 15(1)(c) and 15(2)).

• Protection from premature administrative action. Agencies must not, unless required or authorised by law, take administrative action that interferes with an individual’s opportunity to exercise any rights of appeal or review (section 15(3)). That creates a protective procedural buffer before action that might limit review rights.

• Transparency and public inspection. Individuals and the public have a potential right to access the program protocol, subject to the Information Commissioner’s public‑interest exception (section 8).

Delegations and discretion

• Reasonable grounds exceptions. Section 14 permits source agencies not to undertake pre‑action validation if there are “reasonable grounds to believe that such results are not likely to be in error.” The Rules require agencies to have regard to consistency in content and context, but the assessment remains an agency judgement. This creates administrable discretion with potential oversight by the Information Commissioner.

• Information Commissioner discretion. The Commissioner decides approval of protocol amendments (section 10(1)), whether to vary technical standards (section 13(1)), and whether the public interest requires nonpublication of protocols (section 8(2)). These exercise points centralise decision‑making about transparency and technical adequacy.

Consequences for non‑compliance are administrative and regulatory rather than criminally specified in the Rules. The Rules state non‑compliance may be investigated by the Information Commissioner under the Data‑matching Act (section 13(3)) and the Commissioner may use the investigatory and audit powers under the Privacy Act (section 19(2)), but do not themselves create pecuniary penalties or offences. The instrument also preserves the operation of the Privacy Act and the Australian Privacy Principles (section 22(1)), so Privacy Act enforcement mechanisms remain available.

The Rules frame enforcement principally as administrative oversight and investigatory power, rather than imposing new offences or financial penalties within the instrument itself.

Investigation and audit powers

• Information Commissioner oversight. The Information Commissioner is designated to monitor compliance with the Rules and to provide advice to agencies on their responsibilities (section 19(1)). The Commissioner must include an assessment of program compliance with the Data‑matching Act, these Rules and the Privacy Act in the annual report (section 19(2)). The Commissioner may exercise investigatory and audit powers contained in the Privacy Act in order to carry out this function (section 19(2)). That cross‑reference brings the Privacy Act’s existing investigatory mechanisms into play for compliance monitoring.

• Contraventions and investigation. The Rules state that a failure to comply with a technical standards report as varied will be taken to be a contravention of the instrument and may be investigated by the Information Commissioner pursuant to section 13(2) of the Data‑matching Act (section 13(3)). This explicitly links non‑compliance with the technical standards to the investigatory regime of the Data‑matching Act.

Approval and corrective powers

• Variation and approval powers. The Information Commissioner may require variations to the technical standards report (section 13(1)), and must approve and file any amendments to the program protocol, making them available for public inspection (section 10(1)-(2)). These powers enable the Commissioner to direct changes to operational documents and insist on public filing, which are corrective measures short of formal penalties.

Administrative remedies and transparency

• Reporting, public scrutiny and parliamentary reporting. The Rules impose detailed reporting obligations to the Information Commissioner (section 20) and to Parliament (section 21) on costs, benefits, numbers of matches and outcomes. The collection of those metrics and their publication to Parliament create reputational and democratic oversight pressures that function as enforcement levers, potentially eliciting remedial action or further scrutiny.

Lack of express penalty provisions in the Rules

• No statutory fines or criminal offences specified. The Rules do not create specific monetary penalties, administrative fines, or criminal offences for contravention of these instrument provisions. Instead, enforcement is channelled through the Information Commissioner’s investigatory powers under the Privacy Act and possible consequences under the Data‑matching Act (section 13(3)). The Rules therefore rely on existing statutory enforcement mechanisms rather than adding new sanctions within the instrument.

Interaction with the Privacy Act and other enforcement avenues

• Privacy Act enforcement remains. The Rules expressly do not intend to affect the operation of the Privacy Act or the Australian Privacy Principles (section 22(1)). That preserves the Privacy Commissioner’s and Information Commissioner’s existing enforcement pathways under the Privacy Act, including complaint investigation, determinations and, where available, civil penalties under the Privacy Act’s enforcement framework.

Practical enforcement sequence

• Administrative oversight first. In practice the Enforcement sequence under these Rules is administrative: the Information Commissioner reviews protocols and technical standards, may require variations, conducts audits and investigations under the Privacy Act, and reports findings publicly and to Parliament (sections 10, 13, 19-21). Where investigations identify systemic non‑compliance, the Commissioner’s annual report and parliamentary reports form public records that can prompt further administrative or legislative responses.

• Data‑matching Act consequences. The Rules reference potential investigatory action pursuant to the Data‑matching Act (section 13(3) referencing Data‑matching Act s13(2)). Any consequences derived from that Act would need to be determined from the Data‑matching Act itself; the Rules do not themselves create additional statutory penalties.

In short, the Rules embed a compliance regime built on required documentation, oversight and reporting, backed by the Information Commissioner’s investigatory and audit powers under the Privacy Act and linking to investigatory provisions of the Data‑matching Act, but they do not create new standalone offences or fines in this instrument.

The Rules are expressly designed to sit within the existing statutory framework and cross‑reference multiple instruments. The instrument identifies legal relationships and cross‑references which shape compliance and rights.

Primary statutory base

• Made under the Data‑matching Act. The Rules are made under subsection 12(2) of the Data‑matching Act (preamble and section 3). Many operative terms and processes in the Rules reference provisions in the Data‑matching Act. For example, “action” is defined by reference to section 10 of the Data‑matching Act and notice requirements under section 11 of the Data‑matching Act are referenced in the Rules (section 5; section 7(3)(8); section 15).

Interaction with the Privacy Act

• Privacy Act remains operative. The Rules explicitly state that nothing in the instrument is intended to affect the operation of the Privacy Act or the Australian Privacy Principles (section 22(1)). The Information Commissioner is given authority to use investigatory and audit powers under the Privacy Act in monitoring compliance (section 19(2)). This places the Privacy Act as a baseline regulatory overlay, meaning that compliance with these Rules does not exempt an agency from obligations under the Privacy Act.

Cross‑references to Data‑matching Act substantive provisions

• Reliance on Data‑matching Act processes. The Rules leave substantive actions and notice mechanisms to the Data‑matching Act. Section 17(2) requires source agencies to deal with results “in accordance with section 10 of the Data‑matching Act.” Section 15 references notice obligations under section 11 of the Data‑matching Act. The Rules therefore operate as supplementary procedural and technical constraints while deferring to the Data‑matching Act for statutory powers to act on discrepancies.

Reporting to Parliament and statutory reporting obligations

• Reports to Parliament as required by the Data‑matching Act. The Rules require that reports prepared for the purposes of sections 12(4) and 12(5) of the Data‑matching Act address specific enumerated matters (section 21(1)). The Rules therefore specify the content of statutory reports under the Data‑matching Act but do not replace the Act’s reporting obligation itself.

Interaction with administrative law and review pathways

• Protection of appeal and review rights. Section 15(3) instructs agencies not to take administrative action that interferes with an individual’s opportunity to exercise rights of appeal or review unless required or authorised by law. This references broader administrative law and review pathways outside these Rules. It preserves an individual’s existing legal avenues where administrative action might be subject to merits review or judicial review mechanisms.

Criminal law and investigative agencies

• AFP, DPP and prosecutions. The Rules define “final completion of the action” in contexts involving the Australian Federal Police or the Director of Public Prosecutions (section 17(6)(1)-(2)), recognising scenarios where the carriage of a matter by law enforcement or prosecutorial authorities affects retention timelines. This indicates the Rules’ interface with criminal investigations and prosecutions without creating new criminal powers.

Tax law intersection

• Tax agency actions. The instrument defines that “action” for the tax agency includes requesting a taxpayer to lodge a return (section 5). The definition of final completion for tax matters includes a 90‑day period after the taxpayer’s rights of appeal under the Income Tax Assessment Act 1936 have expired (section 17(6)(4)), explicitly referencing tax appeal rights and integrating timing from tax legislation into retention rules.

Records and information law

• Retention of written records. Section 15(5) requires written records made in accordance with section 11(5A) of the Data‑matching Act to be retained on or linked to the individual’s file. This cross‑reference ties the Rules to recordkeeping obligations under the Data‑matching Act, and more generally to records law and administrative recordkeeping practices.

Publication versus public interest exemptions

• Publication and public interest test. The Rules require publication of the program protocol and a Gazette notice unless the Information Commissioner is satisfied publication would be contrary to the public interest (section 8(1)-(2)). That introduces an administrative balancing test where transparency obligations can be limited on public interest grounds; the Commissioner’s determination will engage secrecy and public interest principles applicable in public administration.

In effect, the Rules do not operate in isolation. They are a procedural and technical layer that leverages and depends upon the Data‑matching Act for substantive matching powers and notice authorities and upon the Privacy Act for investigatory and enforcement tools. Agencies must therefore map obligations under all three instruments when designing, operating and reviewing matching programs.

The instrument itself contains a limited, explicit amendment history and commencement detail.

• Repeal of 1994 Guidelines. The Rules repeal the Data‑Matching Program (Assistance and Tax) Act 1990 - Guidelines issued on 31 October 1994 (preamble and section 4). The instrument therefore replaces the 1994 Guidelines with these Rules as the operative procedural framework under the Data‑matching Act.

• Authority and date. The instrument is made under subsection 12(2) of the Data‑matching Act (section 3). The signature page indicates the Rules were issued by the Australian Information Commissioner, Private Commissioner (signed Angelene Falk) and dated 8 June 2021 (preamble). Those administrative details show who authorised the instrument and when.

• Commencement mechanics. The Rules commence on the first day on which the instrument is no longer subject to disallowance (section 2 and the preamble). The preamble clarifies that means once 15 sitting days have expired in both Houses of Parliament after tabling. The instrument therefore uses a commencement mechanic common for legislative instruments subject to parliamentary disallowance.

• No other amendments recorded within the text. The instrument does not record prior amendments to itself, transitional provisions beyond repeal of the 1994 Guidelines, or staged commencement of parts. It is a single instrument replacing the earlier Guidelines and specifying ongoing obligations. Any subsequent amendments to these Rules would therefore appear as separate instruments or legislative amendments not contained within this text.

• Amendment process for protocols and technical standards. The Rules themselves provide an internal amendment process for program protocols and technical standards: amendments to program protocols must be approved by the Information Commissioner, filed and made available for public inspection (section 10(1)), and the Information Commissioner may require a variation to the technical standards report (section 13(1)), which agencies must comply with (section 13(2)). These are operational amendment mechanisms that affect program documents rather than the Rules instrument.

• Interaction with Data‑matching Act provisions. The Rules rely on the Data‑matching Act for enforcement and investigatory mechanisms (section 13(3)), so any legislative changes to the Data‑matching Act or the Privacy Act could change how these Rules operate in practice. The Rules do not themselves restructure statutory powers, but they embed processes that assume continuity of the enabling statutory provisions.

To identify further amendment history beyond what is recorded here, users should consult the Federal Register of Legislation and the Data‑matching Act for subsequent legislative instruments, amendments, or replacement instruments. As of the instrument text, the clear historical change is the replacement of the 1994 Guidelines with these 2021 Rules, effective upon expiration of disallowance periods.

The text of the Rules contains no citations to case law, and it does not record any litigation history. The instrument references statutory investigatory and enforcement mechanisms,principally the investigatory powers under the Privacy Act and investigatory provisions of the Data‑matching Act (section 19(2); section 13(3)),but it does not provide or summarise any judicial decisions, administrative determinations, or legal challenges arising from the Rules.

What this means for legal research and risk assessment

• No litigated interpretations within the instrument. Because the Rules do not themselves reference litigation, there is no authority within the text interpreting phrases such as “reasonable procedures,” “reasonable grounds,” “public interest,” or specifics of timing and destruction obligations. Those phrases therefore remain open to judicial or administrative interpretation in the event of dispute.

• Relevant case law will be external. Any litigation history relevant to these Rules will arise from cases or administrative determinations applying the Data‑matching Act, the Privacy Act, or general administrative law to programs operated under this instrument. To understand precedent or judicial treatment of matching programs, one must search judicial databases and administrative determinations for decisions concerning the Data‑matching Act or Privacy Act in the context of data matching.

• Enforcement decisions may produce administrative determinations. The Information Commissioner’s investigatory powers under the Privacy Act could lead to determinations or reports that are publicly released or otherwise challenge agency practice. Those determinations, while not litigation, may be persuasive administrative law materials.

• Practical implication for counsel and compliance. In the absence of binding judicial interpretation embedded in the Rules, agencies and advisers should treat the Rules as establishing mandatory procedural and technical standards and plan for conservative compliance where terms such as “reasonable” and “public interest” require judgement. Where ambiguity arises, agencies should document the rationale for their decisions (e.g. in the program protocol and technical standards report) to provide a contemporaneous evidentiary record for any future administrative review or litigation.

If a reader requires case law or administrative determinations applying these or predecessor rules, a search of decisions under the Data‑matching Act and Privacy Act, and of Information Commissioner reports subsequent to the Rules’ commencement, will be necessary. The instrument itself contains no litigation history to report.

This section highlights operational, procedural and compliance traps that the Rules create or expose. Each “gotcha” points to a specific textual provision and the practical risk it creates if overlooked.

1. Strict destruction timelines for non‑discrepant data (section 16). The matching agency must destroy personal information used in a cycle that does not produce a discrepancy as soon as practicable after commencing Step 5 and no later than 24 hours after completion of Step 5, except for computer malfunction or industrial action (section 16(1)-(2)). Gotcha: retention systems or backup processes that retain records longer than 24 hours, or failure to purge copies from backups and logs, will breach the Rules unless the stipulated exceptions apply. Agencies must design system‑level deletion and backup policies aligned to this tight window.

2. Rapid turnaround for supplying discrepant results (section 17(1)). Where a discrepancy occurs as a result of Steps 1, 4 or 5, the matching agency must supply results to the relevant source agency within seven days. Gotcha: operational delays in triage, manual validation or data transfer processes can breach the seven‑day supply requirement. Agencies must have automated pipelines or documented contingency plans.

3. Time limits on further retention after no further action (section 17(3)). If a source agency decides to take no further action, related information must be destroyed within 14 days where reasonably practicable. Gotcha: agencies must document decisions to take no action and the destruction process; “reasonably practicable” is a judgment call that may be disputed later.

4. Complex definition of “final completion of the action” with multiple time anchors (section 17(6)). Final completion can vary by law enforcement carriage, DPP carriage, debt recovery status, tax assessments (90 days after appeal rights expire), or a default 12‑month period for other situations. Gotcha: different dispositions have different retention endpoints. Agencies handling transfers to AFP or the DPP must coordinate retention policies and ensure data is destroyed only when the relevant external body signals final completion or when other defined criteria are met.

5. Publication may be withheld on public interest grounds (section 8(2)). The Information Commissioner can withhold protocol publication where it would be contrary to public interest. Gotcha: the protocol must nonetheless be provided to the Commissioner and the protocol must contain the justification, alternatives and a costs and benefits statement (section 7(3)-(4)). Agencies that hide protocols may face heightened scrutiny from Parliament or the Commissioner about whether the public interest test was correctly applied.

6. Broad reporting requirements with granular metrics (sections 20-21). The list of metrics agencies must report includes numbers and proportions of matches, discrepancies, notices, actions, overpayments, recoveries and cases where action proceeded despite disputes. Gotcha: agencies without robust case management and tracking systems will struggle to produce these metrics reliably. Data engineering and recordkeeping costs can be substantial.

7. “Matches undertaken” counting methodology (section 5). The definition counts records after they have been separated into individual records for partners, children, parents and other names. Gotcha: raw file counts may be misleading unless agencies apply the same separation method; different operational interpretations can distort reported match volumes and outcomes.

8. Use of identification numbers, particularly TFNs (section 7(3)(6) and section 11(2)(b)(iii)). The protocol and the technical standards report must explain the use of identification numbers for personal assistance and specifically tax file numbers. Gotcha: any use of TFNs imposes high privacy sensitivity and legal constraints; agencies must document legal authority and necessity carefully.

9. Discretionary exception for pre‑action validation (section 14). Source agencies may rely on matches without checking source data where they have reasonable grounds to believe results are unlikely to be in error. Gotcha: reliance on this exception without documented reasoning invites later challenge; agencies should record the basis for any “reasonable grounds” judgement in the case file or technical documentation.

10. Prohibition on creating new permanent registers (section 18(1)). Source agencies must not permit linking that creates a new separate permanent register. Gotcha: data warehouses, analytic indices and persistent linking tables can unintentionally create such registers; agencies must audit databases and architecture to ensure temporary linkage during a program does not leave behind persistent merged datasets.

11. Cross‑instrument dependence (sections 5, 15, 17 and 19). The Rules frequently cross‑reference sections of the Data‑matching Act and import investigatory powers from the Privacy Act (section 19(2)). Gotcha: compliance cannot be judged against the Rules alone; agencies need to interpret them in the context of the Data‑matching Act and Privacy Act obligations and powers. Advice will need to encompass all three instruments.

12. No express monetary penalties in the Rules. The enforcement path is investigatory and administrative rather than punitive within the instrument (sections 13(3) and 19(2)). Gotcha: the absence of express penalties may create an incentive to treat breaches as lower risk unless the Information Commissioner or Parliament exerts pressure; however, enforcement via Privacy Act powers and parliamentary reporting can be consequential.

13. Retention of written records made under section 11(5A) of the Data‑matching Act (section 15(5)). The Rules require written records made in accordance with that provision to be retained on or linked to the individual’s file. Gotcha: the Data‑matching Act’s section 11(5A) is not reproduced in the Rules; agencies must consult the Data‑matching Act for the substantive content and ensure linkage to individual files is implemented.

14. Notification to individuals should not interfere with appeal rights (section 15(3)). Gotcha: agencies must be careful when timing administrative steps and notifications so as not to inadvertently curtail statutory appeal or review periods. Documentation of legal basis for any action that may affect appeal or review rights is essential.

Operationally, these “gotchas” translate to concrete investments: system design for rapid deletion, clear legal memoranda on reliance exceptions, precise recordkeeping for metrics, clear coordination with law enforcement bodies, and robust governance to avoid creating permanent registers. Agencies should treat each of these textually‑rooted traps as a project requirement rather than a policy negotiation point.

This section converts the Rules’ prescriptive elements into a practical compliance checklist and suggested implementation actions. Each item references the relevant section of the Rules.

Design and documentation

• Prepare the program protocol before operating a program (section 7(1)-(2)). The matching agency must develop the protocol in consultation with source agencies (section 7(2)). The protocol must include all items listed in section 7(3) and the justification and options analysis in section 7(4). Action: establish a cross‑agency working group, create a written project plan for the protocol, and maintain consultation records demonstrating source agency input.

• Prepare the technical standards report prior to commencement (section 11(1)). The report must document data quality (11(2)(a)), matching algorithms and operating procedures (11(2)(b)), validation procedures and integrity techniques (11(2)(c)), data standardisation measures (11(2)(d)), and security controls (11(2)(e)). Action: retain technical specialists (data scientists, security architects), produce algorithm specifications, test matching rules and produce a documented Data Quality Plan.

Publication, filing and approval

• File protocol and technical standards report with the Information Commissioner (sections 7(1) and 11(3)). The protocol must normally be published and a Gazette notice issued unless the Commissioner decides otherwise (section 8(1)-(2)). Action: provide draft documents to the Commissioner early to identify sensitive items that may require nonpublication and secure approval for any amendments.

• Obtain Information Commissioner approval for amendments to program protocol (section 10(1)). Action: adopt configuration management and version control for the protocol and technical standards, and submit any changes to the Commissioner with an explanatory note for approval and public filing.

Operational procedures and systems

• Implement compliance with the program protocol and technical standards (sections 9 and 12(1)). Action: map each operational process to protocol and technical standard clauses, appoint a program owner responsible for compliance, and institute a governance committee.

• Ensure validation procedures are in place (section 14). Agencies must have reasonable procedures to confirm validity before administrative action, except where reasonable grounds exist to believe accuracy. Action: create stepwise validation checklists, automated source data reconciliation where feasible, and record decisions when relying on the “reasonable grounds” exception.

• Notifications to individuals. If a source agency will confirm a match by checking with the individual instead of checking source data, deliver written notice containing the match, initial conclusions, techniques used, proposed administrative action, notice that no source data check occurred, at least 28 days to respond, and advice about Privacy Act complaint rights (section 15(1)). Action: develop template letters (the Rules require including template letters in the protocol, section 7(3)(8)); implement a tracking system for notices and response periods.

Data destruction and retention controls

• Implement deletion processes aligned with Step 5 destruction timelines (section 16). Non‑discrepant personal information must be destroyed as soon as practicable after commencing Step 5 and no later than 24 hours after completion of Step 5, except for specified disruptions (section 16(1)-(2)). Action: design matching systems that do not generate persistent intermediate stores, or that automatically purge temporary stores within the required window; document exceptions such as malfunctions.

• Implement discrepant data handling (section 17). Matching results must be supplied to source agencies within seven days (17(1)). If no further action is taken, destroy within 14 days where reasonably practicable (17(3)). If action is taken, ensure destruction on final completion per the multi‑scenario definition (17(5)-(6)). Action: establish case management systems that tag each discrepant record with its disposition, responsible agency, and an automated retention expiry aligned with the applicable final completion rule.

• Avoid creating new permanent registers (section 18). Ensure architecture does not create persistent merged datasets that amount to a new separate register. Action: perform a data architecture audit, ensure any persistent indices are minimal and limited to exclusion registers where permitted, and implement deletion triggers tied to action completion.

Security, integrity and algorithmic governance

• Implement security features and regular review (section 11(2)(e)). Action: apply least‑privilege access, encryption at rest and in transit, logging, and periodic security audits. Document access controls and review cycles in the technical standards report.

• Algorithm specification and transparency. Section 11(2)(b) requires specification of the matching algorithms and rules for recognising matches. Action: document matching thresholds, matching variables, fuzzy matching rules, and error‑rate assumptions. Maintain test datasets showing type I and type II error rates and rationale for chosen thresholds.

Recordkeeping and metrics

• Implement data capture for statutory metrics (sections 20 and 21). Action: instrument case management and data pipelines to capture matches produced, proportion resulting in discrepancies, notices given, actions taken, overpayments identified, recoveries, and instances where action proceeded despite a dispute. Ensure metrics distinguish matches, discrepancies and actions using the “matches undertaken” definition (section 5).

• Retain written records where required by the Data‑matching Act (section 15(5)). Action: link any written records made under the Data‑matching Act’s section 11(5A) to the individual’s file in a searchable, auditable format.

Reporting and audit readiness

• Establish periodic reporting schedule with the Information Commissioner (section 20). Action: agree on cadence and format of reports with the Commissioner, and build automated reporting extracts from operational systems.

• Prepare material for Parliament reports (section 21). Action: assemble summary reports addressing the enumerated matters; ensure internal audit and evaluation results are summarised and included.

Governance and approvals

• Document consultation and decision‑making. The protocol must be developed in consultation with source agencies (section 7(2)) and must justify the program and alternatives (section 7(4)). Action: maintain minutes, legal advice, cost‑benefit analyses and alternatives considered to demonstrate compliance and reasoned decision‑making.

• Train staff and maintain complaint handling. The Rules require notice to individuals of rights to complain under the Privacy Act (section 15(1)(c) and (2)). Action: ensure staff conducting validations and notices are trained on the Privacy Act complaint process and escalation pathways for disputes.

Contingency and resilience

• Plan for malfunctions and industrial action exceptions (section 16(2)). Action: document contingency procedures that qualify as permissible reasons for exceeding the 24‑hour destruction window, and record timestamps and cause analysis when exceptions apply.

• Coordinate with law enforcement and DPP. For matters carried by AFP or DPP, the retention timeline depends on progress and finalisation (section 17(6)(1)-(2)). Action: establish Memoranda of Understanding or formal points of contact to obtain notifications required to conclude “final completion of the action.”

Legal review and ongoing compliance

• Maintain compliance with the Privacy Act and APA. The Rules do not displace other legal obligations (section 22(1) and 15(3)). Action: obtain legal advice on statutory appeal or review rights implicated by any administrative action, and reconcile program processes with administrative law requirements.

• Prepare for Information Commissioner audits. Given the Commissioner may use investigatory powers under the Privacy Act (section 19(2)), maintain documentation, logs, and the ability to demonstrate that procedures were followed and data was deleted in accordance with the Rules.

In short, compliance requires a multidisciplinary program combining legal, technical, records management, privacy and program governance workstreams. Agencies should treat the Rules as mandating both documentary evidence (protocol and technical standards) and operational controls (automated deletion, validation procedures, reporting and security) as core deliverables prior to and during any matching program.