Taxation Administration (Data Sharing—Relevant COVID-19 Business Support Program) Declaration 2021

The immediate affected parties are the Australian Taxation Office and the 29 named administering agencies. The ATO must check that any disclosure of protected information falls within the programs and agencies listed. The agencies in turn receive data they could not otherwise obtain without taxpayer consent or a separate information‑gathering power. Taxpayers who applied for or received one of the declared programs are indirectly affected because their tax data may be shared across government without their consent. This includes businesses in New South Wales that received the 2021 JobSaver payment, Victorian firms that received the Business Costs Assistance Program Round Two, Queensland businesses under the COVID‑19 Business Support Grants Scheme, South Australian recipients of the Business Hardship Grant, and ACT recipients of the Commercial Tenancy Relief scheme. The instrument also affects tax advisors and accountants, who need to be aware that client data provided to the ATO may be used by state agencies for grant verification and recovery, potentially leading to demands for repayment or fraud investigations. The absence of Western Australia, Tasmania and the Northern Territory means that businesses in those states that received comparable state grants are not covered by this Declaration. Those states may have other data‑sharing arrangements, but they are not authorised by this instrument. The instrument also affects the Office of the Australian Information Commissioner to the extent that data sharing under this Declaration is authorised by law, which provides a defence against privacy complaints. Ultimately, the instrument affects the accountability relationship between the ATO and state agencies: it allows the states to verify claims against ATO‑held data, reducing the risk of grant fraud but also increasing the reach of government surveillance over business affairs.

The Declaration imposes no direct duties on taxpayers and confers no new rights on them. The duties fall on the ATO and the administering agencies. The ATO has a duty under the TAA not to disclose protected information except as expressly authorised. This Declaration provides that authorisation, but the ATO still must ensure the disclosure is limited to the precise programs and agencies listed. Oversight obligations under the TAA’s secrecy regime continue to apply. Administering agencies receiving the data have a duty to use it only for the purposes of the relevant COVID‑19 business support program. If they misuse the information (for example, to pursue a separate debt or to share with another agency), they may breach the TAA’s offence provisions. For taxpayers, the main right is to seek review under the TAA or under privacy law if they believe disclosure was unauthorised or exceeded the scope of this Declaration. The Freedom of Information Act 1982 also provides a right to access records of data sharing. However, the Declaration does not create a private right of action against the ATO or agencies if data is used incorrectly; enforcement rests with the Australian Federal Police and the Information Commissioner. Taxpayers do not have a right to veto the sharing; the Declaration overrides any expectation of confidentiality for the listed programs. A subtle point: the definition section modifies the Legislation Act 2003 so that the enabling legislation for interpreting the Declaration is Schedule 1 to the TAA as in force from time to time. This means that if the TAA’s secrecy provisions change, the scope of authorised disclosure may change without amendment to this Declaration. Taxpayers and advisors should monitor amendments to the TAA itself.

The Declaration itself carries no penalty provisions. Penalties for unauthorised disclosure or misuse of protected information are found in Division 355 of Schedule 1 to the TAA. Under section 355‑25, a person commits a criminal offence if they disclose or use protected information other than as authorised, with a penalty of 120 penalty units or imprisonment for two years. That penalty applies to both ATO officers and officers of administering agencies who misuse the data obtained under this Declaration. In addition, the Privacy Act 1988 imposes penalties for serious or repeated interferences with privacy, although the Act provides a defence if the disclosure is authorised by law (which this Declaration supplies). The enforcement framework for grant fraud (such as making false statements to obtain a payment) operates under the relevant program legislation and the Criminal Code. The Declaration facilitates enforcement by giving agencies the data to detect discrepancies. AOTI (Administrative Appeals Tribunal) review may be available if a taxpayer challenges the ATO’s decision to disclose information. The Commissioner’s data‑matching programs are also subject to guidelines issued by the Office of the Australian Information Commissioner, but those are not directly referenced in this instrument. The sunset provision means that after 30 June 2026, the Declaration is automatically repealed; if the Commissioner continues to disclose data for these programs after that date without a new declaration, they risk penalty for unauthorised disclosure. Practitioners should note that the instrument does not provide a specific complaints mechanism; any complaint about misuse would be directed to the ATO, the relevant state agency, the Information Commissioner, or the AFP.

The Declaration operates as a specific modification of the TAA’s secrecy provisions in Part 5‑25 of Schedule 1. It does not repeal or amend those provisions; it merely creates a new authorised disclosure pathway. In relation to the Privacy Act 1988, disclosure under this Declaration is “authorised by law”, which provides an exception to the use and disclosure principles in Australian Privacy Principle 6. The instrument therefore prevents a claim of breach of privacy solely because the data sharing occurred. State legislation governing each grant program may also contain confidentiality clauses or penalties for misuse of information; those laws continue to apply alongside the TAA. There is a potential interaction with the Freedom of Information Act 1982: documents containing disclosed tax data may be requested from the administering agencies, but that Act contains exemptions for material whose disclosure would be an offence under another law (the TAA secrecy provisions). The Declaration does not override those exemptions. The instrument also interacts with the Legislation Act 2003: section 13(1)(b) is modified so that the Declaration uses the current definitions from Schedule 1 to the TAA, giving the instrument dynamic reference to the TAA rather than static definitions. The Acts Interpretation Act 1901 applies in the usual way. The Declaration does not interact with state data‑sharing laws directly, but if a state agency has its own secrecy provisions, they must also be satisfied; the Declaration only provides authorisation under Commonwealth law. The sunset provision means that after 30 June 2026, the Declaration is repealed and the data‑sharing exemption lapses. The ATO would then need to rely on another exception (such as taxpayer consent or a different legislative declaration) to continue sharing data. Advisors should also be aware that the table includes some programs that are partially declared: for example, “Export assistance grant (but only to the extent a grant relates to supporting an entity affected by COVID‑19)” - this limits the scope of the data sharing.

The instrument as provided appears to be the original version made in 2021. No amendments are recorded in the text itself. The table includes programs from 2021 and 2022 (such as the “2022 Small Business Support Program” and “COVID‑19 Tourism, Hospitality and Gym Grant,Additional Round,January 2022”), indicating that the Declaration may have been updated or re‑made to incorporate later programs. However, the source text does not show any formal amendment history. The instrument is a legislative instrument registered on the Federal Register of Legislation, and a compilation of the instrument (showing any amendments registered after the original) may exist separately. It is possible that this Declaration replaced an earlier 2020 declaration or that additional items were added by a later variation. The sunset date of 30 June 2026 suggests that the instrument was either made or remade with an extended non‑sunset period beyond the usual 10‑year default under the Legislation Act 2003, or that it was originally set to sunset earlier but was amended to extend it. The numbering of table items also shows gaps: items jump from 1‑1 to 2‑5, and from 2‑20 to 2‑25, etc. This may be because other items were deleted or because the Declaration only picks up a subset of programs from a larger table in the TAA. Without seeing earlier versions or the original enactment, we cannot confirm whether any amendments occurred. Practitioners should check the Federal Register of Legislation for the latest compilation to ensure they are working with the current version.

The instrument does not mention any litigation and is unlikely to have been directly challenged in court. The Declaration is a ministerial power exercised under the TAA and is legislative in character; challenges would typically be to the Commissioner’s decision to disclose information, not to the instrument itself. A taxpayer might argue that the Commissioner exceeded the scope of the declaration by disclosing information for a program not properly listed, or that the Commissioner misinterpreted the scope of “relevant COVID‑19 business support program”. However, no such cases are referenced in the source. There may be Administrative Appeals Tribunal decisions concerning the disclosure of tax data under this pathway, but they are not recorded in the instrument. Data‑sharing decisions may also be challenged under the Privacy Act, but again they would not involve the validity of the Declaration. The instrument is a simple ministerial declaration; its legal force depends on the Commissioner’s compliance with its terms. If the Commissioner were to disclose for a program that was not declared, that would be unauthorised under the TAA, but the remedy would lie in criminal or civil proceedings against the officer, not in challenging the Declaration itself. No litigation is noted, but the absence of cases does not mean none exist , it simply means the instrument does not cite any.

Several traps call for careful attention. First, the table only covers specific programs from specific rounds. For example, the COVID‑19 Consumer Travel Support Program only covers “Rounds 1 and 2”; later rounds, if any, are not declared. The Export assistance grant is only declared “to the extent a grant relates to supporting an entity affected by COVID‑19” , a potentially ambiguous scope. Second, the jurisdictions covered are limited: Western Australia, Tasmania, and the Northern Territory are completely absent. Businesses in those states that received comparable grants will not have their tax data shared under this instrument, but they may have data shared under separate arrangements that practitioners need to identify. Third, the item numbers in the table are not sequential and start at 1‑1, then 2‑5, 2‑10 etc., skipping many earlier items such as 2‑1 to 2‑4, 2‑6 to 2‑9, etc. This may reflect a separate, earlier declaration for those items, but this instrument does not supersede them. The patchwork nature means a practitioner must check the exact item number and program name. Fourth, the sunset date of 30 June 2026 looks generous, but because the instrument is automatically repealed on that date, there is no grace period. After that date, if the ATO inadvertently continues sharing data based on this Declaration, it would be unauthorised and potentially criminal. Fifth, the definition section modifies the Legislation Act 2003, meaning that the definitions in Schedule 1 to the TAA apply as in force from time to time. This is a dynamic reference: if the TAA changes the definition of “protected information”, the scope of the Declaration shifts automatically without any amendment. Sixth, the instrument does not provide for taxpayer notification when data is shared. Taxpayers may not know their data has been disclosed until a state agency contacts them. Seventh, the instrument does not require the ATO to enter into a data‑sharing agreement with the administering agency; it merely provides the statutory authority. Agencies may still need to enter into a memorandum of understanding or comply with the ATO’s privacy guidelines, but that is not mandated here. Eighth, the instrument lists some programs with multiple administering agencies, such as the COVID‑19 Consumer Travel Support Program (Services Australia and the Australian Trade and Investment Commission). Taxpayer data may be shared between these two agencies, raising further privacy considerations.

Compliance obligations fall primarily on the ATO and the named agencies. For the ATO, the key steps are: (a) maintain a register of disclosures made under this Declaration; (b) verify that each request for data matches a program and agency in the table; (c) only disclose information that is relevant to the program in question; (d) cease disclosure immediately if a program is removed or the instrument is repealed; and (e) ensure officers are trained on the scope of the Declaration to avoid unauthorised disclosure. For administering agencies, the steps are: (a) only request data for the specific program and only use that data for program administration; (b) treat the data as protected information under the TAA and do not further disclose it without separate authorisation; (c) have data handling protocols in place to prevent unauthorised access; (d) if the agency receives data for one program (e.g., JobSaver), do not use that data to enforce a different program (e.g., the Small Business Recovery Grant) unless a separate authorisation exists; and (e) after the sunset date (30 June 2026), ensure all data received under this Declaration is destroyed or handled in accordance with the TAA’s provisions, as the authorisation ends. For taxpayers and advisors, compliance means: (a) verifying whether a client’s grant program is listed in the table; (b) if so, informing the client that the ATO may share their tax data with the named agency; (c) ensuring that grant applications are accurate, because the agency can cross‑check with ATO records; (d) if a client receives a notice from a state agency relying on ATO data, they should request the specific legal basis for the disclosure (this Declaration is the likely basis); (e) monitoring the Federal Register of Legislation for any amendments that add or remove programs; and (f) noting the sunset date - after 30 June 2026 any unauthorised reliance on this Declaration would be invalid, so new arrangements would be needed. Advisors should also keep records of which programs their clients applied for, to assist in any later challenge to data sharing.