Skip to main content
Skip to secondary navigation
Menu
Australian Government - Office of the Australian Information Commissioner - Home

Exposure Draft –Using Tax File Numbers as an identifier and to facilitate account consolidation

Submission to the Treasury (February 2011)


 

Contents

 

Key recommendations

The Office of the Australian Information Commissioner (OAIC) welcomes the opportunity to make a submission to the Treasury[1] on the Exposure Draft of the Tax Laws Amendment (2011 Measures No. 2) Bill 2011: Use of TFNs for superannuation purposes (the draft Bill) and explanatory material. The draft Bill is of interest to the OAIC in its capacity as the national privacy regulator with responsibilities relating to the handling of Tax File Numbers (TFNs).

In summary, the OAIC makes the following comments and recommendations:

  1. The OAIC welcomes the fact that the extended use of the TFN will be subject to appropriate privacy safeguards, including:
    • the extension of TFN usage for limited purposes to be implemented via legislation
    • Treasury to undertake a Privacy Impact Assessment (PIA) to identify and assess the privacy impacts of the extended use of the TFN
    • provision for trustees (to be included in regulations) to notify individuals and receive their consent regarding the consolidation of superannuation accounts that have matching identifying details.
  2. The OAIC makes the following suggestions to enhance the draft Bill from a privacy perspective and draws attention to the following issues:
    • adding notes to the draft Bill which refer to the binding Tax File Number Guidelines
    • amending the explanatory memorandum by: including references to the TFN Guidelines; and clarifying the consent and notice issues to be covered by the regulations
    • ensure the draft Bill’s consistency with the National Privacy Principles and the TFN Guidelines.

 

Office of the Australian Information Commissioner

  1. The OAIC is an independent statutory agency established by the Australian Information Commissioner Act 2010 (AIC Act).The OAIC commenced operation on 1 November 2010 and is headed by the Australian Information Commissioner (AIC), supported by two other statutory office holders, the Freedom of Information Commissioner and the Privacy Commissioner. Staff of the former Office of the Privacy Commissioner are now part of the OAIC.
  2. Together the Commissioners of the OAIC exercise three broad functions:
    1. the freedom of information (FOI) functions set out in s 8 of the AIC Act
    2. the privacy functions set out in s 9 of the AIC Act
    3. the Information Commissioner functions set out in s 7 of the AIC Act.
  3. As the national privacy regulator, including in relation to the handling of TFNs, the OAIC can provide general advice on privacy issues and the application of the Privacy Act 1988 (the Privacy Act).

 

Purpose of the draft Bill

  1. The OAIC understands that the primary purpose of the draft Bill is to amend the Retirement Savings Account Act 1997 and Superannuation Industry (Supervision) Act 1993 to allow superannuation fund trustees to use TFNs as the primary identifier of member accounts.[2] The draft legislation will also facilitate the consolidation of multiple member accounts, whether in the same super fund or across multiple super funds.
  2. The Government’s intention is for the draft Bill to come into effect on 1 July 2011.

 

Background

  1. The measures outlined in the draft Bill give effect to the Australian Government’s commitment to implement reforms which stem from the recommendations of the Government’s review of the governance, efficiency, structure and operation of Australia’s superannuation system (known as the Cooper Review).[3]
  2. Of particular relevance are the recommendations from the Cooper Review’s ‘SuperStream’ initiative, which include improving the administration and efficiency of the superannuation system through the expanded use of the TFN. It is understood that the use of TFNs as a primary identifier of fund members’ superannuation accounts will assist individuals and trustees to locate and consolidate lost accounts, and to verify that accounts relate to the same individual.[4]
  3. The Office (then as the Office of the Privacy Commissioner) made a submission to the Cooper Review[5]in which it noted that the handling of TFNs in the superannuation context is already allowed under the binding Tax File Number Guidelines (TFN Guidelines).[6]The Office noted that the extended use of TFNs by superannuation funds for identification and account consolidation purposes would amount to an extension of the TFN’s current use, rather than a completely new application.
  4. The Office also indicated that it is not opposed to the extended use of the TFNs as a means of promoting efficiency in the superannuation system provided the use is measured; accompanied by strict privacy safeguards to protect personal information and choice; and be based on the likelihood of significant benefits for individual. This approach would also appear to reflect the Government’s intention regarding the use and protection of unique identifiers generally.[7]

 

Specific comments on the draft bill

  1. The OAIC welcomes the Government’s adoption of recommendations from the Cooper Review concerning certain privacy safeguards. For example:
    1. the extension of TFN usage for limited purposes to be implemented via legislation (i.e. the draft Bill)[8]
    2. Treasury to undertake a Privacy Impact Assessment (PIA) to identify and assess the privacy impacts of the SuperStream proposals[9]
    3. provision (in regulations) for trustees to notify individuals in advance of any consolidation of superannuation accounts that have matching identifying details, with the right to opt-out of such usage.[10]
  2. The OAIC notes that such protections should be commensurate with levels of risk and community sensitivity concerning TFNs and related information in the superannuation system.
  3. In addition to welcoming this series of measures, this submission also makes several suggestions below that the OAIC believes would further improve the privacy protections within the draft Bill, and notes some other issues for the Treasury’s consideration.

 

Additional notes

  1. The OAIC supports the inclusion of notes in the draft Bill which state that sections 8WA and 8WB of the Taxation Administration Act 1953 (TA Act) contain offences for unauthorised use, etc., of TFNs.
  2. The OAIC suggests that draft Bill could include two additional notes to make clear that the binding TFN Guidelines complement the TA Act in regulating the handling of TFNs (one note following proposed s 137A, and the other after s 299LA). Both notes could state that the binding TFN Guidelines, issued under s 17 of the Privacy Act, protect the privacy of natural persons by regulating the collection, storage, use, disclosure, security and disposal of TFN information. These notes would assist the reader to be aware of protections surrounding the handling of TFNs.

 

Explanatory memorandum

  1. The explanatory memorandum to the draft Bill does not mention the TFN Guidelines, which are, as noted above, a key component of the existing TFN handling framework.
  2. TFN Guideline 1.2 states that ‘the rights of individuals under taxation, assistance agency or superannuation law to choose not to quote a tax file number shall be respected’. Furthermore, the Commissioner’s Notes (which accompany the Guidelines and are not legally binding) state that TFN Guideline 1.2 forms the basis of what is known as the ‘voluntary quotation principle’. The principle recognises that neither taxation nor assistance agency nor superannuation laws make the quotation of a TFN a requirement, although it should be noted that the financial consequences of not quoting can be severe.
  3. On the understanding that the draft Bill will maintain an individual’s right to choose not to quote their TFN, the OAIC suggests that the explanatory memorandum could usefully refer to the TFN Guidelines, perhaps where quotation of TFNs is already discussed.[11]

 

Consent and notice

  1. In addition to the draft Bill, regulations will also be included to specify additional details and outline any conditions for TFN usage.[12]The explanatory memorandum could contain more information on what details may be included in the regulations, such as:
    1. the stage and manner in which individuals may provide consent before account consolidation will occur
    2. proposed requirements for trustees to notify individuals in advance of any consolidation of superannuation accounts. For example, whether members will be informed of the legal basis for the TFN usage for consolidation purposes; that declining to participate is not an offence; and the consequences (financial or otherwise) for not participating in TFN matching (see for example the notice requirements outlined in National Privacy Principle 1.3 and 1.5).[13]
  2. The OAIC understands that the precise mechanics of the notice and consent measures are currently being developed, and that these issues may be canvassed in Treasury’s Privacy Impact Assessment on the draft Bill.
  3. Subject to these issues being examined, the explanatory memorandum could clarify the choices/options that individuals will be given regarding the account consolidation process. The ability for individuals to choose whether they wish for their TFN to be used in the consolidation process would reflect the intent of the TFN Guidelines that individuals’ rights under taxation, assistance agency and superannuation law ‘to choose not to quote a tax file number shall be respected’.[14]
  4. Clarification of consent and notice issues in the explanatory memorandum as discussed above,may be helpful in addressing potential for community sensitivities which could arise from the proposed use of the TFN as a primary identifier of superannuation accounts.
  5. Appropriate consultation with interested stakeholders, including privacy and consumer groups, would help to ensure that consent and notice issues are given proper consideration in the draft Bill and the regulations.

 

Consistency with the NPPs and TFN Guidelines

  1. The OAIC has considered the draft Bill in light of Privacy Act requirements including National Privacy Principle (NPP) 7 (which regulates organisations’ handling of Australian Government-issued identifiers), and the TFN Guidelines issued under s 17 of the Privacy Act (along with the advisory Commissioner’s Notes that accompany the TFN Guidelines).The following outline may be relevant to Treasury in considering the interaction between these Privacy Act requirements and the draft Bill. This outline is not exhaustive but provides a summary of certain important requirements.

National Privacy Principle 7

  1. The expanded use of the TFN for identifying and consolidating super accounts could lead to an organisation ‘adopting’ the TFN as its own identifier in a way that would trigger the need to comply with NPP 7.[15] For the reasons outlined below, it is important to ensure that super funds will be able to comply with NPP 7 if they adopt the practices set out in the draft Bill. This may require the making of regulations under NPP 7.
  2. NPP 7.1 provides that a private sector organisation must not adopt as its own identifier of an individual, an identifier assigned to the individual by a Commonwealth agency (such as the TFN). However, this does not apply to its adoption by a ‘prescribed organisation’ in ‘prescribed circumstances’ (NPP 7.1A).Before these matters can be prescribed,certain prerequisites must be satisfied under subsection 100(2) of the Privacy Act:
    1. that the assigning agency (in this case the ATO) or its principal executive agrees the adoption of the identifier is appropriate;
    2. that the agency has consulted the Information Commissioner; and
    3. that the adoption (or prescribed use or disclosure – see below) is‘only for the benefit of the individual concerned.’
  3. Furthermore, under NPP 7.2(b) an organisation must not use or disclose an identifier assigned to an individual by an Australian Government agency, unless (among other things):
    1. the use or disclosure is authorised under NPP 2.1(e) to (h) – including NPP 2.1(g), which permits the use and disclosure of personal information if it is required or authorised by or under law (we understand the intent of the draft Bill would be to authorise such practices in limited circumstances); or
    2. the use or disclosure is ‘prescribed’ along similar lines to the ‘adoption’ of identifiers above.
    If the proposed expansion of the use of TFNs in the superannuation industry constitutes an adoption under NPP 7, the Treasury should consider whether there is a need to prescribe (in regulations) the adoption, use or disclosure of the TFN by organisations in the superannuation sector for relevant circumstances – to ensure the proposal meets the requirements of NPP 7.

TFN Guideline 1

  1. TFN Guideline 1.1 states that the TFN ‘is not to be used as a national identification system by whatever means’. The policy intent of this Guideline is to prevent the proliferation of TFN usage for a wide range of unrelated purposes across Australian society, and associated negative privacy impacts, by limiting TFN usage to certain practices within certain closely-regulated industries – for taxation, superannuation and assistance agency purposes.
  2. The associated Commissioner’s note clarifies that TFN Guideline 1.1 does not preclude the use of the TFN as an identifier for taxation law purposes by the Commissioner of Taxation. While the note does not specifically refer to superannuation, the existing TFN Guidelines do allow for the use of TFNs for certain superannuation purposes. Furthermore, we understand that:
    • use of TFNs by superannuation funds for the purposes outlined in the draft Bill would amount to a limited extension of the TFN’s current use, rather than a completely new application
    • the draft Bill amends laws that are “superannuation laws” under the TFN Guidelines, to authorise additional handling of TFNs
    • this extended use will also be accompanied by appropriate privacy safeguards (e.g. subject to a Privacy Impact Assessment, providing adequate notice to, and obtaining consent from the fund member)
    • the draft Bill will not alter an individual’s right to choose not to quote their TFN and, according to the Explanatory Memorandum (para 1.18),“there will not be additional consequences for not quoting a TFN.”
  3. Accordingly the OAIC suggests the explanatory memorandum could explain:
    • that the draft Bill is intended to comply with the Privacy Act/NPPs and the existing TFN Guidelines
    • the basis of this compliance (for example, authorisation under ‘superannuation law’, adequate choice to be provided to individuals on TFN use would be consistent with the TFN Guidelines)
    • the consultation process to be adopted to determine the optimum approach to TFN usage for the benefit of individual fund members, in line with the intent of NPP 7 and TFN Guideline 1 outlined above.

Such explanations may help address whether appropriate safeguards have been considered in the draft Bill.



Footnote

[1] This refers to the Australian Government Department of the Treasury.

[2] The draft Bill can be accessed at: strongersuper.treasury.gov.au.

[3]'Stronger Super' — Government Response to Super System Review– The Government’s response to the recommendations in the Final Report was released on 16 December 2010.

[4] Cooper Review Final Report is available at -  www.supersystemreview.gov.au/content/content.aspx?doc=html/final_report.htm, Ch. 9 SuperStream, pp. 292, 294

[5] The Office’s submission is available at:  www.privacy.gov.au/materials/types/download/9467/7034.

[6] The TFN Guidelines can be accessed via the following link:  http://gov.au/law/act/tfn

[7] See the Government’s first stage response to the Australian Law Reform Commission (ALRC) Report 108 (2008), For Your Information: Australian Privacy Law and Practice (ALRC Report 108), available at  www.austlii.edu.au/au/other/alrc/publications/reports/108/., response to recommendation 30-2“...there are circumstances where the use and disclosure of a government identifier by an organisation will allow them to provide a strong benefit to an individual...that there should be a mechanism which provides the flexibility to allow prescribed identifiers to be adopted, used or disclosed by organisations in prescribed circumstances”.

[8] Cooper Review Final Report, recommendation 9.11

[9] Cooper Review Final Report, recommendation 9.10; explanatory memorandum to the Tax Laws Amendment (2011 Measures No.2) Bill 2011: Use of TFNs for superannuation purposes, para 1.23

[10]Explanatory memorandum, paras 1.17 (examples 1.1 and 1.2), 1.21, and 1.24

[11] Explanatory memorandum, para 1.18

[12] Explanatory memorandum, para 1.21

[13] The ten National Privacy Principles (NPPs), set out in Schedule 3 of the Privacy Act, apply to large businesses, all health service providers and some small businesses and non-government organisations. See:  www.privacy.gov.au/law/act/npp.

[14] TFN Guideline 1.2

[15] See Guidelines to the National Privacy Principles, specifically discussion of NPP 7.1 on p. 55 – the Guidelines can be accessed via the following link: www.privacy.gov.au/materials/types/guidelines/view/6582