Part 2Operational provisions

#  # Privacy (Tax File Number) Rule 2015 I, Timothy Pilgrim, Privacy Commissioner, make this Rule under section 17 of the Privacy Act 1988. Dated: 20 February 2015 Timothy Pilgrim Privacy Commissioner ## Privacy (Tax File Number) Rule 2015 # Part 1 - Preliminary ## 1. Name of Rule (1) The Rule is the Privacy (Tax File Number) Rule 2015. (2) The Rule may also be cited as the TFN Rule. ## 2. Commencement This Rule commences the day it is registered on the Federal Register of Legislative Instruments (FRLI). ## 3. Authority This Rule is issued by the Privacy Commissioner under section 17 of the Privacy Act 1988 (Privacy Act). ## 4. Repeal The Tax File Number Guidelines 2011 registered on the FRLI (the Federal Register of Legislative Instruments No. F2011L02748) is repealed when this TFN Rule commences. ## 5. Overview (1) The TFN Rule replaces the previous Tax File Number Guidelines 2011. The TFN Rule, which is legally binding, regulates the collection, storage, use, disclosure, security and disposal of individuals’ tax file number (TFN) information. (2) The TFN Rule only applies to the TFN information of individuals and does not apply to TFN information about other legal persons including corporations, partnerships, superannuation funds and trusts. (3) A breach of the TFN Rule is an interference with privacy under the Privacy Act. Individuals who consider that their TFN information has been mishandled may make a complaint to the Information Commissioner. As well as constituting a breach of the TFN Rule, unauthorised use or disclosure of TFNs can be an offence under the Taxation Administration Act 1953 (TAA) and attract penalties including imprisonment and monetary fines. (4) Sections 8WA and 8WB of the TAA create offences for unauthorised requirements or requests that a person’s TFN be quoted; and the unauthorised recording, maintaining a record of, use or disclosure of an individual’s TFN respectively, unless an exception applies. However, unlike the TFN Rule, the TAA protects all TFNs and not just those of individuals. (5) Provisions regulating TFNs are also contained in the Income Tax Assessment Act 1936. In addition, the Data-matching Program (Assistance and Tax) Act 1990 provides for, and regulates, the matching of records between the Australian Taxation Office and assistance agencies using the TFN in part of the matching process. (6) In the context of superannuation, Part 25A of the Superannuation Industry (Supervision) Act 1993 (SIS Act) also contains rules and restrictions on the quotation, use and transfer of TFNs. Furthermore, under the SIS Act, the Australian Prudential Regulation Authority can make legislative instruments which approve the manner of quoting TFNs. ## 6. Meaning of terms (1) Unless the contrary intention appears, any term used in the TFN Rule which is defined in the Privacy Act has the same meaning as in that Act. (2) In this TFN Rule: Approved recipient means a TFN recipient that: (a) is engaged by an authorised recipient to provide services where it is reasonably necessary to have access to TFN information; or (b) has obtained an individual’s consent to access their TFN, to help manage that individual's taxation, superannuation or personal assistance affairs. APRA means the Australian Prudential Regulation Authority. Assistance agency means: (a) the Department of Human Services (which administers the Centrelink, Child Support Agency and Medicare Programs) (b) the Department of Social Services (c) the Department of Education, Employment and Workplace Relations (d) the Department of Veterans' Affairs, or (e) any successor agency to an agency referred to in (a) to (d) above, or any other successor agency or agencies which may have responsibilities under an Administrative Arrangements Order for administration of provisions of a personal assistance law. Authorised recipient means a TFN recipient (other than the Commissioner of Taxation or an assistance agency) that is authorised by taxation law, personal assistance law or superannuation law to receive TFNs. Individual means a natural person. Personal assistance law means: (a) an Act or part of an Act referred to in the definition of ‘personal assistance’ in the Data-matching Program (Assistance and Tax) Act 1990 (b) sections of the following Acts that deal with handling TFNs: (i) the A New Tax System (Family Assistance) Act 1999 (ii) the A New Tax System (Family Assistance) (Administration) Act 1999 (iii) the Child Care Act 1972 (iv) the Child Support (Assessment) Act 1989 (v) the Child Support (Registration and Collection) Act 1988 (c) the Paid Parental Leave Act 2010 (i) the Social Security Act 1991 (ii) the Social Security (Administration) Act 1999 (iii) the Student Assistance Act 1973 (iv) the Veterans' Entitlements Act 1986 (d) the Data-matching Program (Assistance and Tax) Act 1990, or (e) relevant legislative instruments made under any Act (including such a part of an Act) referred to in (a) to (c) above. Privacy Act means the Privacy Act 1988. SIS Act means the Superannuation Industry (Supervision) Act 1993. Superannuation law means: (a) the SIS Act (b) the First Home Saver Accounts Act 2008 (c) a law within the meaning of ‘Superannuation Acts’ under the SIS Act and the First Home Saver Accounts Act 2008 (d) the Retirement Savings Accounts Act 1997 (e) an Act or part of an Act for which APRA has the general administration that deals with the handling of TFNs, and which is not a taxation law, or (f) relevant legislative instruments made under any Act (including such a part of an Act) referred to in (a) to (e) above. Taxation law means: (a) an Act or part of an Act for which the Commissioner of Taxation has the general administration (b) the Tax Agent Services Act 2009 (c) the Higher Education Support Act 2003 (d) an Act or part of an Act under which the Commissioner of Taxation has powers and functions related to the use of TFNs, or (e) legislative instruments made under any Act (including such a part of an Act) referred to in (a) to (d) above. TAA means the Taxation Administration Act 1953. TFN has the same meaning as ‘tax file number’ in the Privacy Act. TFN Rule means this Privacy (Tax File Number) Rule 2014 issued under the Privacy Act which regulate the collection, storage, use, disclosure, security and disposal of individuals’ TFN information. TFN information has the same meaning as ‘tax file number information’ in the Privacy Act. TFN recipient has the same meaning as ‘file number recipient’ in the Privacy Act, and includes: (a) the Commissioner of Taxation (b) an assistance agency (c) an approved recipient (d) an authorised recipient (e) the trustee of a superannuation fund. Trustee for the purposes of the TFN Rule, has the same meaning as ‘trustee’ in the SIS Act. # Part 2 – Operational provisions ## 7. General (1) The TFN must not be used as part of a national identification system. (2) Section (1) does not prevent the Commissioner of Taxation from using the TFN as an identifier in accordance with taxation law, superannuation law or personal assistance law. (3) An individual is not legally obliged to quote their TFN, however there may be financial consequences for an individual who chooses not to quote their TFN. ## 8. Collection of TFN information (1) TFN recipients must only request or collect TFN information from individuals and other TFN recipients for a purpose authorised by taxation law, personal assistance law or superannuation law. (2) When requesting an individual’s TFN, TFN recipients must take reasonable steps to ensure that: (a) individuals are informed: (i) of the taxation law, personal assistance law or superannuation law which authorises the TFN recipient to request or collect the TFN (ii) of the purpose(s) for which the TFN is requested or collected (iii) that declining to quote a TFN is not an offence (iv) about the consequences of declining to quote a TFN (b) the manner of collection does not unreasonably intrude on the individual’s affairs, and (c) the TFN recipient only requests or collects information that is necessary and relevant to the purpose of collection under applicable taxation law, personal assistance law or superannuation law. ## 9. TFNs provided incidentally If an individual provides information to a TFN recipient which includes a TFN, for a purpose not connected with the operation of a taxation law, personal assistance law or superannuation law: (a) the individual providing the information may remove the TFN, and (b) if the individual does not remove the TFN, the TFN recipient must not use or disclose the TFN or record the TFN in a way that is inconsistent with the TAA or the TFN Rule. ## 10. Use or disclosure of TFN information TFN information must only be used or disclosed (including for matching personal information about individuals) by TFN recipients: (a) for a purpose authorised by taxation law, personal assistance law or superannuation law, or (b) for the purpose of giving an individual any TFN information that the TFN recipient holds about that individual. ## 11. Storage, security and destruction of TFN information (1) TFN recipients must take reasonable steps to: (a) protect TFN information from misuse and loss, and from unauthorised access, use, modification or disclosure (b) ensure that access to records containing TFN information is restricted to individuals who need to handle that information for taxation law, personal assistance law or superannuation law purposes. (2) A TFN recipient must take reasonable steps to securely destroy or permanently de-identify TFN information where it is no longer: (a) required by law to be retained, or (b) necessary for a purpose under taxation law, personal assistance law or superannuation law (including the administration of such law). ## 12. Staff training TFN recipients must take reasonable steps to ensure that: (a) all staff are aware of the need to protect individuals’ privacy when handling TFN information, and (b) all staff who collect or access TFN information are aware of: (i) the circumstances where TFN information may be collected (ii) the prohibitions on the use and disclosure of TFN information (iii) the need to protect individuals’ privacy when handling TFN information, including under the TFN Rule and under the Privacy Act (iv) the penalties or other sanctions that apply for breaching the TFN Rule or applicable laws relating to the handling of TFNs. ## 13. Obligations of the Commissioner of Taxation and APRA to publish (1) The Commissioner of Taxation and APRA must make information publicly available which identifies: (a) in APRA’s case: the classes of TFN recipients, who are authorised by or under taxation law or superannuation law to request TFNs (b) in the Commissioner of Taxation’s case: the classes of TFN recipients who are authorised by or under taxation law to request TFNs (c) the specific purposes for which these TFN recipients may request TFNs (d) the prohibitions on the collection, recording, use and disclosure of TFN information (e) the penalties that apply to unauthorised acts and practices relating to TFNs and TFN information (f) where to find further detail about the matters in (a) – (e) above. (2) The Commissioner of Taxation and APRA must publish information in accordance with the requirements of Guideline 8.1 about any amendments to taxation law and superannuation law that allow TFNs to be requested. Where practicable, this information should be published before the amendments commence. (3) Where the Commissioner of Taxation or APRA prescribes or approves practices involving the collection of TFN information, the Commissioner of Taxation or APRA must ensure those practices include informing the individual: (a) about the legal basis for collecting the individual’s TFN information (b) that declining to quote a TFN is not an offence (c) about the consequences of declining to quote a TFN. (4) The Commissioner of Taxation and APRA must comply with all other relevant obligations in the TFN Rule, including as a TFN recipient. ## 14. Assistance agency obligations to publish (1) Assistance agencies that may request a TFN under personal assistance law, or under taxation law, must make information publicly available which identifies: (a) the specific purposes for which the agency may request TFNs (b) the prohibitions on the collection, recording, use and disclosure of TFN information (c) the penalties that apply to unauthorised acts and practices relating to TFNs and TFN information (d) where to find further detail about the matters in (a) – (c) above. (2) Assistance agencies must publish information (in accordance with the requirements of Section (1) about any amendments to personal assistance law that allow TFNs to be requested. Where practicable, this information should be published before the amendments commence. (3) Assistance agencies must comply with all other relevant obligations in the TFN Rule, including as a TFN recipient.