Taxation Administration Regulation 2004

Permitted disclosure. This is the core concept: the Act prohibits disclosure of taxpayer information except as expressly authorised. The Regulation creates additional authorisations. Each prescribed person may receive information only for the purpose stated in the regulation, not for any wider use. The term "permitted disclosure" does not create a positive duty to share information; it provides a legal immunity for the Commissioner if disclosure occurs. The Commissioner retains discretion whether to disclose in any given case.

Prescribed person. Under section 97(1)(e)(xix), the regulation "prescribes" persons. The concept of prescription is standard in delegated legislation: it means the regulation nominates a specific office‑holder or category. Six such categories currently exist. Notably, some are described by office (under treasurer, chief planner, chief officers) and others by function (a person appointed by the Commissioner to conduct an audit). The head of the asbestos response taskforce is defined by reference to a government taskforce established in June 2014, which is a fixed historical date and not an ongoing statutory body.

Tax law. The parent Act defines "tax law" broadly to include various ACT revenue laws. The Regulation does not define it further. The disclosure for audit purposes relates to "the exercise of the commissioner’s functions under a tax law", so the scope of information accessible is tied to the Commissioner’s performance under those laws.

Information. The Regulation does not limit the type of information that can be disclosed. The disclosure clauses refer to "information relating to ownership of property" for the asbestos and fire‑service categories, and "information about rates" for the chief planner. The other categories (under treasurer, audit, gaming) are not expressly limited to property or rates, so they could encompass a wider range of taxpayer data including income, business activities, and other financial details. The absence of express limitation in those provisions is a notable feature.

Penalty unit. The republication endnote states that at the date of republication the value of a penalty unit is $160 for an individual and $810 for a corporation (under the Legislation Act 2001, section 133). This is not part of the Regulation itself but provides the financial context for any offences under the parent Act for unauthorised disclosure. The Regulation itself contains no penalty provisions.

Endnotes and republication. The Regulation includes extensive endnotes covering legislation history, amendment history, and earlier republications. These are not part of the legal text but assist in understanding the instrument’s evolution. The concept of "authorised republication" under the Legislation Act 2001 ensures the version on the ACT legislation register is the official text.

The Regulation directly affects the Commissioner for ACT Revenue, who is empowered (but not compelled) to share taxpayer information with the prescribed persons. It also affects the officials who are prescribed: the under treasurer (a senior treasury official), the appointed auditor, the head of the asbestos response taskforce, the chief officers of fire and rescue services, the chief planner, and gaming regulators (the Gambling and Racing Commission, gaming officers, and the relevant director‑general). Each of these officials gains a potential entitlement to access tax data that would otherwise be confidential. However, the Regulation does not impose a corresponding obligation on the Commissioner to disclose; it merely removes the legal barrier to disclosure. In practice, whether disclosure occurs depends on the Commissioner’s internal processes and the operational needs of the prescribed agency.

Taxpayers are indirectly affected: any person or entity that pays ACT tax (payroll tax, land tax, rates, duties, etc.) is a potential subject of a permitted disclosure. The Regulation does not require taxpayer consent or notification when information is disclosed. The effect is that a taxpayer may not know that their financial data has been shared with, for example, the chief planner for calculating a noncompliance fee or with the gaming regulator for administering gaming machine laws. Property owners with loose-fill asbestos insulation or properties in areas subject to flammable material removal directions are particularly exposed, as disclosure of ownership information is specifically authorised for those purposes.

The asbestos response taskforce disclosure affects owners of properties that either contain loose-fill asbestos insulation or are "eligible impacted properties" as defined in the Civil Law (Sale of Residential Property) Act 2003. The fire service disclosure affects owners of premises that may be subject to a direction to remove flammable material. The planning disclosure affects anyone subject to a noncompliance fee under the Planning (General) Regulation 2023, as the chief planner needs rates information to work out the fee. The gaming disclosure affects licensees and operators of gaming machines regulated under Part 2A of the Gaming Machine Act 2004.

The Regulation also affects the broader community by reducing the privacy protections ordinarily associated with tax information. Each new prescribed category expands the network of state officials with access to taxpayer data. This has implications for data security, the risk of misuse, and the potential for function creep if prescribed persons use the information beyond the stated purposes (though other laws may apply to limit such use). The compliance burden falls on the Commissioner’s office to ensure that disclosures are properly authorised and recorded. The cost of this system is borne by taxpayers through general revenue; it is not directly charged to those whose information is disclosed.

The Regulation imposes no direct duties on taxpayers and creates no private rights of action. Its legal effect is to modify the Commissioner’s duty of confidentiality under the parent Act. The key duty therefore rests with the Commissioner: when disclosing information, the Commissioner must ensure that the recipient is a prescribed person and that the disclosure is for a permitted purpose. If the Commissioner discloses to a person not prescribed, or for a purpose not specified, the disclosure would be unauthorised and could attract penalties under the parent Act. The Commissioner also retains a general duty to protect taxpayer information from unauthorised access; the Regulation does not override that duty beyond the specific gateways.

The prescribed persons have a right to receive the information, but only in their official capacity and for the stated purpose. The Regulation does not explicitly prohibit them from using the information for other purposes, but other laws (such as the parent Act’s secrecy provisions or the Privacy Act 1988 (Cth)) may impose restrictions. The head of the asbestos response taskforce, for example, may receive information relating to property ownership for the purpose of addressing loose-fill asbestos. Using that information for unrelated enforcement action could raise legal questions. The Regulation does not specify whether the recipients may further disclose the information to other agencies or to the public. This is a significant gap: once information passes from the Commissioner to, say, the chief fire officer, the Regulation offers no express constraint on onward sharing. The parent Act’s secrecy provisions apply to the original discloser (the Commissioner) but may not extend to the recipient unless the recipient is also covered by a secrecy provision in another Act.

Taxpayers have a right to expect that their information will not be disclosed outside the authorised gateways. If a taxpayer suspects unauthorised disclosure, they may have remedies under the parent Act or under general law (such as an action for breach of confidence or a complaint to the privacy regulator). However, the Regulation itself does not grant any specific right of access, correction, or notification. The taxpayer has no right to veto a disclosure that falls within the prescribed categories. The Regulation also does not require the Commissioner to notify the taxpayer that disclosure has occurred, so a taxpayer may never know that their data has been shared with the under treasurer for economic analysis.

For the appointed auditor (subsection (2)), the duty is to carry out the audit of the Commissioner’s functions under a tax law. The auditor is prescribed for the purpose of carrying out that audit. The Regulation does not specify the auditor’s powers, duties, or reporting obligations; those would be found in the appointment instrument or in other provisions of the parent Act. The auditor must use the information only for the audit, not for any other purpose.

The Regulation itself contains no penalty provisions. It does not create any offences. Enforcement for unauthorised disclosure of taxpayer information is governed by the parent Taxation Administration Act 1999 and by the general criminal law. The parent Act likely provides that a person who discloses protected information otherwise than as permitted commits an offence. The penalty unit values noted in the republication ($160 for an individual, $810 for a corporation) would apply to such offences if they are defined in the parent Act and carry a maximum penalty in penalty units. Since the Regulation only permits disclosure, it does not directly trigger any penalty; it is a defence or authorisation that prevents the disclosure from being unlawful.

The primary enforcement risk is for the Commissioner or an employee who discloses information outside the prescribed purposes. If the Commissioner discloses information to the under treasurer for a purpose other than economic analysis or revenue forecasting, that disclosure would be unauthorised and could attract penalties. Similarly, if a prescribed person uses the information for a purpose not covered by the regulation, that person may be liable under other laws (such as the privacy laws or the parent Act’s secrecy provisions, if they extend to recipients). The Regulation does not provide any enforcement mechanism for misuse by prescribed persons; that would rely on other legal frameworks.

The amendment history shows that the Regulation has been amended to add or modify prescribed categories. Each amendment expands the scope of permitted disclosure, which reduces the enforcement risk for the Commissioner when sharing information with those new categories. The trend over time is toward greater disclosure, not less. This is consistent with a policy preference for information sharing across government agencies to improve administrative efficiency and enforcement. However, it also increases the number of people with access to sensitive data, raising the aggregate enforcement burden on the Commissioner to ensure that all disclosures are within the authorisations.

The lack of monetary penalties or offence provisions in the Regulation itself means that compliance relies on the parent Act’s general enforcement machinery. This may include investigation, prosecution, and civil penalties. The Commissioner also has internal compliance mechanisms such as audit trails and data access controls. The prescribed auditors mentioned in subsection (2) are specifically tasked with auditing the Commissioner’s functions, which could include reviewing whether disclosure practices comply with the law. That creates a feedback loop: the auditor, who has access to information for the audit, can assess whether the Commissioner is complying with the disclosure regime. However, the auditor’s findings are not public unless published.

The Regulation operates solely by reference to the Taxation Administration Act 1999, specifically section 97(1)(e)(xix). That section is the enabling provision that allows the regulation to prescribe additional persons. The Regulation does not amend or override any other law; it simply adds to the list of authorised disclosures under the parent Act. Consequently, the parent Act’s general secrecy provisions continue to apply to all disclosures not covered by the Regulation.

The Regulation also interacts with several specific ACT laws by referencing them directly. Subsection (4) refers to the Emergencies Act 2004, subsection (5) refers to the Rates Act 2004 and the Planning (General) Regulation 2023, and subsection (6) refers to the Gaming Machine Act 2004 and the Gambling and Racing Control Act 1999. These references mean that the prescribed purposes are aligned with the objectives of those Acts. For example, the chief officer of the fire and rescue service is prescribed for issuing a direction under section 106 of the Emergencies Act 2004; the information obtained under the Regulation can be used only for that statutory purpose. The Regulation thereby creates a bridge between the tax administration system and those other regulatory regimes, allowing the Commissioner to support their functions without breaching tax secrecy.

The definition of "eligible impacted property" in subsection (7) is cross-referenced to the Civil Law (Sale of Residential Property) Act 2003, section 9A(1). That Act governs disclosure obligations in residential property sales. The cross-reference ensures consistency: the same definition applies for both the property sale context and the tax disclosure context. The asbestos response taskforce disclosure is also linked to that definition, so the scope of information accessible matches the scope of properties that are subject to special sale disclosure rules.

The Planning (General) Regulation 2023 reference in subsection (5) demonstrates a later amendment that updated the Regulation to reflect changes in planning law. The original reference may have been to an earlier planning instrument. This shows that the Regulation is tied to the evolving legislative framework: when the Planning Act 2023 replaced earlier planning legislation, the Taxation Administration Regulation was amended via the Planning (Consequential Amendments) Act 2023 to update the cross-reference. A similar updating occurred with the Emergencies Act 2016 amendment.

The interaction with the Legislation Act 2001 is also important. The Regulation is made under the authority of the Taxation Administration Act 1999, but the Legislation Act governs how subordinate laws are made, amended, and republished. The endnotes refer to section 133 of the Legislation Act for penalty unit values. The republication process described at the beginning of the document relies on the Legislation Act’s provisions for authorised republications and editorial changes.

The Regulation does not interact with Commonwealth laws directly, but the information it permits to be disclosed may be subject to the Privacy Act 1988 (Cth) if the recipient agency is a Commonwealth agency or if the information is handled outside the ACT context. The Regulation does not purport to override Commonwealth privacy laws. Similarly, the Regulation does not interact with tax secrecy laws of other states or territories; its operation is confined to ACT tax information.

The Regulation was originally made as SL2004‑62 and notified on 23 December 2004, with the substantive provisions commencing on 24 December 2004. Since then it has been amended nine times, each amendment reflecting a policy decision to expand or adjust the categories of prescribed persons and the purposes of disclosure.

The first amendment was the Taxation Administration Amendment Regulation 2009 (No 1) (SL2009‑44), which commenced on 15 September 2009. The amendment changed section 4, though the source does not specify the precise content of that change. It was followed by the Administrative (One ACT Public Service Miscellaneous Amendments) Act 2011 (A2011‑22), which amended the Regulation as part of a broader machinery change to standardise references to public service positions. That amendment commenced on 1 July 2011.

In 2014, the Taxation Administration Amendment Regulation 2014 (No 1) (SL2014‑15) amended section 4, effective 10 July 2014. This was followed by the Building (Loose-fill Asbestos Eradication) Legislation Amendment Act 2015 (A2015‑42), part 13, which inserted the reference to the head of the asbestos response taskforce. That amendment commenced on 13 November 2015. This is a significant expansion: it tied the tax disclosure regime to the ACT government’s response to the loose-fill asbestos problem, allowing the Commissioner to share property ownership information with the taskforce.

The Taxation Administration Amendment Regulation 2016 (No 1) (SL2016‑8) amended section 4, effective 22 April 2016. Later that year, the Emergencies Amendment Act 2016 (A2016‑33), schedule 1 part 1.20, amended the Regulation to insert the reference to the chief officers for fire and rescue services under the Emergencies Act 2004. That amendment commenced on 21 June 2016.

In 2018, the Taxation Administration Amendment Regulation 2018 (No 1) (SL2018‑17) amended section 4, effective 18 September 2018. The Revenue Legislation Amendment Act 2021 (A2021‑10), schedule 1 part 1.8, amended the heading of section 4 and made other changes, effective 20 May 2021. The Planning (Consequential Amendments) Act 2023 (A2023‑36), schedule 1 part 1.62, updated the reference in subsection (5) from the earlier planning regulation to the Planning (General) Regulation 2023, effective 27 November 2023.

The most recent amendment is the Taxation Administration Amendment Regulation 2024 (No 1) (SL2024‑32), notified 12 September 2024 and effective 13 September 2024. It amended section 4 further, with sections 4 and 5 inserted and sections renumbered. This amendment likely updated the chief planner reference or made other adjustments. The amendment history also records the omission of section 2 (Commencement) by the Legislation Act, section 89(4), which is a standard editorial change. The Regulation has also been the subject of renumbering exercises under the Legislation Act.

The overall trajectory of amendments is one of steady expansion: from the original 2004 version (which likely prescribed only a few categories) to the current six categories covering treasury, audit, asbestos, fire safety, planning, and gaming. No prescribed category has ever been removed; the only changes are additions and textual updates.

The source text (the republication of the Regulation) contains no references to any litigation history. The Regulation itself does not mention any court cases, and the endnotes do not include any annotations about judicial decisions. This is consistent with the Regulation’s narrow and obscure nature: it is a subordinate instrument that merely prescribes persons, and it is unlikely to be directly litigated in isolation. Most challenges would likely be directed at the parent Act or at specific disclosure decisions made by the Commissioner, rather than at the Regulation itself.

However, it is possible that the Regulation has been considered tangentially in proceedings concerning the disclosure of taxpayer information. For example, if a taxpayer challenged a particular disclosure as unauthorised, a court might examine whether the recipient fell within a prescribed category and whether the purpose aligned with the regulation. No such cases are recorded in the source. Similarly, any judicial consideration of the asbestos disclosure provisions or the gaming disclosure provisions would likely be noted in the amendment history or in the parent Act’s litigation history, but none appears here.

The absence of litigation history does not mean that no disputes have arisen; it may simply mean that disputes have been resolved administratively or have not been publicly reported. The Regulation’s provisions are relatively clear and limited in scope, reducing the likelihood of interpretive litigation. The major legal risk is not in the wording of the Regulation but in the Commissioner’s application of it: an error in determining whether a disclosure is permitted could lead to a breach of the parent Act’s secrecy provisions. Such a breach could be the subject of legal proceedings, but the Regulation itself would be the defence, not the cause of action.

The litigation history for the parent Taxation Administration Act 1999 would be more substantial, but that is outside the scope of this deep dive. The Regulation’s role is purely facilitative; it is unlikely to be the primary subject of litigation. This is a typical feature of procedural subordinate legislation: it is rarely challenged directly, though its consequences may be felt in enforcement actions.

No express limitation on onward disclosure. The Regulation specifies to whom the Commissioner may disclose information and for what purpose, but it does not impose any obligation on the recipient to keep the information confidential or to use it only for that purpose. A prescribed person who receives taxpayer information could theoretically share it with other officials or use it for unrelated purposes, subject only to other laws (such as the Privacy Act or any secrecy provisions in the recipient’s own enabling legislation). This creates a significant gap in protection. Taxpayers have no recourse under the Regulation if their information is misused by a recipient.

Purpose limitation is implied but not explicit. Each subsection states that the person is prescribed "for the purpose of" a specific activity (e.g., economic analysis, audit, issuing a direction). This phrasing implies that the information may be used only for that purpose, but it does not explicitly prohibit other uses. The legal effect is that the Commissioner’s disclosure is authorised only for that purpose; if the Commissioner knows the information will be used for another purpose, the disclosure might be beyond the authorisation. However, once the information is in the hands of the recipient, the Regulation does not control their actions. A cautious compliance approach would require the Commissioner to include a confidentiality condition in any disclosure, but the Regulation does not mandate that.

The under treasurer provision is very broad. The under treasurer is prescribed for "economic analysis or revenue forecasting". These terms are not defined and could encompass a wide range of activities, including analysing the behaviour of specific taxpayers or classes of taxpayers. There is no requirement that the analysis be anonymised or aggregated. This is a potentially sweeping gateway that could allow the executive arm of government access to individual taxpayer data for broad policy purposes.

No taxpayer notification or consent. The Regulation does not require the Commissioner to inform a taxpayer that their information has been disclosed to the under treasurer, the chief planner, or any other prescribed person. Taxpayers may never know that their data is being shared across government agencies. This lack of transparency undermines accountability and makes it difficult for taxpayers to police misuse.

Definitional dependency. The term "eligible impacted property" is defined by reference to the Civil Law (Sale of Residential Property) Act 2003, and "commission" and "gaming officer" are defined by reference to the Gambling and Racing Control Act 1999. These definitions are not reproduced in the Regulation, so a reader must consult those other Acts to understand the full scope of the disclosure authority. This is standard drafting practice but can be a trap for those who rely only on the Regulation.

The audit provision applies only to the Commissioner’s functions. The audit under subsection (2) is limited to auditing "the exercise of the commissioner’s functions under a tax law". It does not cover audits of the prescribed persons’ use of the information. So the Commissioner’s internal auditors can review whether the Commissioner is complying with the disclosure regime, but there is no equivalent audit power over recipients.

Penalty units apply to the parent Act, not this Regulation. The endnote stating penalty unit values ($160 individual, $810 corporation) is informative but not part of the Regulation. A practitioner might mistakenly think the Regulation itself creates penalties. It does not. The penalties are in the parent Act for unauthorised disclosure.

No expiry or review clause. The Regulation has no sunset provision or mandatory review date. It persists indefinitely unless amended or repealed. This means that once a disclosure gateway is added, it remains in force unless a future government actively removes it. The expansion over time suggests the government prefers to add gateways rather than prune them.

Limited judicial oversight. The Regulation does not provide any mechanism for a taxpayer to challenge a disclosure before it occurs. Post-disclosure remedies (such as complaints to the privacy commissioner or court actions for breach of confidence) are available, but they are costly and uncertain. The Regulation effectively leaves taxpayers without a quick, low-cost remedy.

Compliance with the Regulation is primarily the responsibility of the Commissioner for ACT Revenue. The Commissioner must maintain systems and processes to ensure that any disclosure of taxpayer information under section 97(1)(e)(xix) is made only to a person who is currently prescribed by the Regulation and only for the purpose stated in the corresponding subsection. This requires:

1. Maintaining an up-to-date register of prescribed persons and their purposes. The register should be amended whenever the Regulation is amended. The amendment history shows that changes occur periodically (approximately every one to three years), so the Commissioner needs to monitor the ACT legislation register for new notifications.

2. Verifying the identity and authority of the recipient before disclosing. For example, if the under treasurer requests information for economic analysis, the Commissioner should confirm that the request comes from the correct office-holder and that the stated purpose falls within "economic analysis or revenue forecasting". A memorandum of understanding between the Commissioner and the recipient agency could be used to document the purpose limitation and to impose confidentiality requirements.

3. Limiting the information disclosed to what is necessary for the stated purpose. The Regulation does not say "only as much as is necessary", but a proportionate approach reduces the risk that a disclosure could be challenged as excessive. For instance, for the fire service disclosure, only ownership information (title, owners’ names and addresses, etc.) should be disclosed, not income or business details.

4. Keeping records of each disclosure: who received what information, when, and for which purpose. This is important for audit and accountability. The audit provision (subsection (2)) specifically contemplates audits of the Commissioner’s functions, so robust record-keeping will facilitate those audits.

5. Training staff on the scope of the Regulation and the limits of their authority. All employees who handle taxpayer information must understand that disclosure is only permitted under the Regulation and that non-compliance could lead to penalties under the parent Act.

6. Implementing data security measures to ensure that information is transmitted securely to recipients and that recipients are required to protect it. Although the Regulation does not mandate this, good practice and other legal obligations (such as privacy laws) suggest that the Commissioner should impose contractual or statutory conditions on recipients to maintain confidentiality.

For the prescribed persons themselves, compliance means:

• Using the information only for the purpose for which it was disclosed. Even though the Regulation does not explicitly prohibit other uses, other laws (such as the secrecy provisions in their own Acts or the Privacy Act) likely do. For example, the chief planner should not use rates information obtained for noncompliance fee calculation to pursue other enforcement actions unrelated to that fee.

• Ensuring that the information is not further disclosed without authority. The Regulation provides no onward disclosure gateway, so any further disclosure by the recipient would need to be authorised under some other law. If no such authorisation exists, onward disclosure could be unlawful.

• Destroying or returning the information once the purpose is fulfilled, if required by their own agency’s policies. The Regulation does not set a retention period, but data minimisation principles suggest it should not be kept longer than necessary.

For taxpayers, compliance is passive: they do not need to take any action under this Regulation. However, they should be aware that their information may be shared with the under treasurer, auditors, asbestos taskforce, fire services, chief planner, and gaming regulators. If a taxpayer becomes aware of a disclosure that appears outside the prescribed purposes, they can complain to the Commissioner, the ACT Ombudsman, or the Office of the Australian Information Commissioner (for privacy breaches). They cannot rely on the Regulation itself as a source of rights, but the parent Act’s secrecy provisions may give them a cause of action if the disclosure was unauthorised.

The Commissioner should also consider annual or periodic reviews of the Regulation’s operation to ensure that the prescribed categories remain appropriate and that no gaps or overlaps have emerged. Given the trend of expansion, proactive review could identify whether any existing categories are no longer needed (for example, if the asbestos response taskforce has completed its work) and could be removed. The Regulation currently has no removal mechanism in its text, but the executive can amend it at any time.