Tax Practitioners Board exposure draft practice note

The Tax Practitioners Board (TPB) has released this draft practice note to provide practical guidance and assistance to registered tax practitioners in relation to using and disclosing a client’s tax file number (TFN) and TFN information in email communications.

Comments invited

The TPB invites comments and submissions in relation to this draft practice note. The closing date for submissions is 30 September 2020. The TPB will then consider any submissions before settling its position, undertaking any further consultation required and finalising the practice note.

Written submissions can be made via email at tpbsubmissions@tpb.gov.au or by mail to:

Tax Practitioners Board
GPO Box 1620
SYDNEY NSW 2001

Disclaimer

This document is in draft form, and when finalised, will be intended as information only. While it seeks to provide practical assistance and explanation, it does not exhaust, prescribe or limit the scope of the TPB’s powers in the Tax Agent Services Act 2009 (TASA) or the Tax Agent Services Regulations 2009 (TASR).

In addition, please note that the principles and examples in this draft TPB(PN) do not constitute legal advice and do not create additional rights or legal obligations beyond those that are contained in the TASA or which may exist at law. They are also at a preliminary stage only. The TPB’s conclusions and views may change as a result of the comments the TPB receives or as other circumstances change.

Document history

This exposure draft practice note was issued on 1 September 2020 and based on the TASA as at 15 March 2017.

Issued: 1 September 2020

Introduction

1. This practice note has been prepared by the Tax Practitioners Board (TPB) to provide practical guidance and assistance to registered tax agents, BAS agents and tax (financial) advisers (collectively referred to as registered tax practitioners) to understand the TPB’s position in relation to the use and disclosure of tax file numbers (TFNs) and TFN information by registered tax practitioners in email communications. For the purposes of this practice note, any reference to tax agent services includes BAS services or tax (financial) advice services, unless otherwise stipulated.

2. In this practice note, registered tax practitioners will find the following information:

   • protection of TFNs and TFN information (paragraphs 3 to 14)

   • obligations of registered tax practitioners when using or disclosing a client’s TFN and TFN information in email communications (paragraphs 15 to 21)

   • suggested steps to consider when using or disclosing a client’s TFN and TFN information in email communications (paragraphs 22 and 26)

   • consequences under the Code of Professional Conduct (the Code) (paragraphs 27 to 28)

   • further information (paragraph 29 to 30).

Protection of TFNs and TFN information

3. TFNs^[1] and TFN information^[2] are protected by the following non-exhaustive list of legislative frameworks:

   • obligations under the Privacy (Tax File Number) Rule 2015 (TFN Rule)

   • obligations under the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs), including:

     • the Notifiable Data Breaches scheme (NDB scheme)

     • APP 11 which requires entities to take reasonable steps to protect the personal information (which includes TFN information) that they hold

   • specific offence provisions under the Taxation Administration Act 1953 (Cth) (TAA 1953).^[3]

4. The TPB is not responsible for the administration of any specific legislation relating to the use and disclosure of TFNs. The Australian Information Commissioner and Commissioner of Taxation are primarily responsible for the administration of the laws relating to the use and disclosure of TFNs and TFN information.

5. The Australian Information Commissioner’s responsibilities in relation to an individual’s TFN information and personal information are set out under the Privacy Act.^[4]

6. The TFN Rule issued under the Privacy Act regulates the collection, storage, use, disclosure, security and disposal of individuals’ TFN information by TFN recipients (such as registered tax practitioners).^[5] It requires that TFN information must only be used or disclosed (including for matching personal information about individuals) by TFN recipients for the following purposes:

   • for a purpose authorised by taxation law, personal assistance law or superannuation law; or

   • for the purpose of giving an individual any TFN information that the TFN recipient holds about that individual.^[6]

7. The TFN Rule further requires that TFN recipients must take reasonable steps to protect TFN information from, amongst other things, unauthorised access, use, modification or disclosure.^[7] TFN Recipients are also required to take reasonable steps to:

   • ensure that access to records containing TFN information is restricted to individuals who need to handle that information for taxation law, personal assistance law or superannuation law purposes^[8]

   • securely destroy or permanently de-identify TFN information where it is no longer required by law to be retained, or necessary for a purpose under taxation law, personal assistance law, or superannuation law (including the administration of such law)^[9]

   • ensure that all staff are aware of the need to protect individuals’ privacy when handling TFN information.^[10]

8. The NDB scheme under the Privacy Act effectively mandates a reporting and notification process for eligible data breaches which are likely to result in serious harm to individuals whose personal information is involved. TFN recipients are also covered by the NDB scheme, in so far as any eligible data breach involves TFN information.^[11]

9. As the TFN information of an individual is also personal information (as defined in the Privacy Act),^[12] any registered tax practitioner who is subject to the APPs under the Privacy Act must also generally comply with the requirements under APP 11.1 to take reasonable steps to protect this information from:

   • misuse, interference and loss; and

   • unauthorised access, modification or disclosure.^[13]

10. According to the Office of the Australian Information Commissioner (OAIC), an ‘interference’ includes an attack on a computer system that leads to exposure of personal information and an ‘unauthorised access’ includes any access by someone who is not permitted to do so. ‘Unauthorised disclosure’ occurs when an entity makes personal information accessible or visible to others outside the entity, and releases that information from its effective control – for example, sending an email containing TFN information to the wrong recipient would likely constitute an unauthorised disclosure.^[14]

11. APP 11.2 provides that those subject to the APPs, who hold personal information of an individual, must also take reasonable steps to destroy or de-identify the personal information they hold once it is no longer needed for any purpose for which it may be used or disclosed under the APPs.^[15]

12. The OAIC has also published guidance in ‘The Privacy (Tax File Number) Rule 2015 and the protection of tax file number information’ and ‘Guide to securing personal information’ on what action entities subject to the Privacy Act and TFN recipients (including registered tax practitioners) should consider taking to comply with the obligations under the APPs and the TFN Rule to protect personal information they hold. This guidance also covers recommended steps to safeguard TFN information from unauthorised loss, use or disclosure, whether this information is recorded in physical or electronic form (such as in an email).^[16]

13. These steps include appropriate information and communication technology (ICT) and other security measures, and particularly suggested procedures to manage email communications of TFNs and improve the security of TFN information contained in emails, as email is, in itself, not considered to be a secure form of communication.^[17] This is noting that, generally, due to technological systems and protocols, an email may be vulnerable to unauthorised access during transmission from sender to recipient, including when passing through networks and when stored on intermediate email servers.

14. In addition to the above, the TAA 1953 (which is administered by the Commissioner of Taxation) includes specific offence provisions in relation to the unauthorised recording, maintaining a record of, use or disclosure of a person’s TFN, subject to certain exceptions.^[18] The TAA 1953 provisions protect the TFNs of all entities, including individuals and other entities such as corporations, partnerships, superannuation funds and trusts.

Obligations of registered tax practitioners when using or disclosing a client’s TFN and TFN information

15. The TPB expects all registered tax practitioners to consider the relevant legislation and guidance, and in particular the TFN Rule, when including TFNs or TFN information of clients in email communications and whether such record or disclosure is appropriate and secure in the circumstances.^[19]

16. Steps taken by a registered tax practitioner to comply with the relevant legislation may also assist to ensure ongoing compliance with their obligation under subsection 30-10(6) of the Code in the Tax Agent Services Act 2009 (TASA) to maintain client confidentiality. Code Item 6 requires that a registered tax practitioner must not disclose any information relating to a client’s affairs to a third party unless:

    • the registered tax practitioner has the client’s permission; or

    • there is a legal duty to do so.^[20]

17. To further minimise any risk of a breach of Code Item 6, in circumstances involving a disclosure of a client’s TFN information by email without the client’s permission, the TPB strongly recommends that registered tax practitioners seek prior specific written authority for any proposed disclosure, including the entity that will receive the information and the use of email to disclose the information. This may include under a signed letter of engagement or consent from the client. However, it is noted that obtaining the client’s permission does not override the broader privacy and security obligations of registered tax practitioners under the TFN Rule and APP 11, that is, registered tax practitioners must still take reasonable steps to protect TFN information sent via email, regardless of whether the client’s permission has been obtained.

18. In relation to all TFNs generally (including of individuals and other entities) and whether a disclosure by a practitioner of a TFN in an unsecured email would amount to an offence under the TAA 1953; this would be determined by the surrounding circumstances and would include consideration of the steps taken by the registered tax practitioner. As a matter of best practice and to minimise the risk of any unauthorised access or disclosure of a client’s TFN (whether an individual or other entity client), the TPB strongly recommends that registered tax practitioners have regard to the requirements under the TFN Rule, in addition to the TAA 1953, when recording and disclosing all client TFNs in email communications.

19. Whether a communication of a client’s TFN in an email breaches the relevant legislation will depend on the facts and circumstances of the disclosure, including whether the registered tax practitioner had taken reasonable steps to have ICT controls in place to protect the security of the TFN. According to the OAIC’s guidance, what steps are reasonable in a given case ultimately depends on the circumstances of the registered tax practitioner, which include:

    • the nature of the registered tax practitioner entity

    • the amount and sensitivity of the personal information held by the registered tax practitioner (for example, if a registered tax practitioner holds TFN information relating to a significant number of clients, they should adopt more rigorous and reliable security measures to safeguard electronically secured and communicated information)

    • the possible adverse consequences for an individual in the case of a breach (in relation to any resulting loss or misuse of TFN information, these consequences include the risk of identity theft)

    • the practical implications (such as time and cost) involved in implementing the security measure

    • whether the security measure itself is privacy invasive.^[21]

20. As such, the inclusion of a client’s TFN in an email by a registered tax practitioner does not, on its own and without further information, necessarily give rise to a breach of a law regulating the use and disclosure of TFNs. However, if such communication occurs in circumstances where the registered tax practitioner has not taken reasonable steps and strategies to safeguard this information (which can include ICT measures to increase the security of information stored on emails and recorded in email communications), the registered tax practitioner may breach obligations under the Privacy Act and TFN Rule.

21. The TPB recommends that all registered tax practitioners review their practices, procedures and systems in relation to the use and disclosure of TFNs and TFN information in email communications to ensure they comply with their obligations under the relevant legislation.

Suggested steps to consider when using and disclosing a client’s TFN and TFN information in email communications

22. Consistent with guidance published on the OAIC website, the TPB considers the following non-exhaustive list are reasonable steps for registered tax practitioners to adopt to protect the security of electronically held TFNs and TFN information of clients, and to ensure compliance with the relevant legislation, particularly the Privacy Act and TFN Rule:

    • implementing security measures to restrict access to records containing this information to only those staff who need to handle this information under taxation, personal assistance or superannuation law

    • having governance, culture and training frameworks in place to foster staff awareness of privacy and security (for example, maintaining authority and accountability for decisions relating to personal information security, and providing staff training on physical and ICT security and information handling)

    • taking ICT security measures to protect practice hardware and software from loss or unauthorised access, use or disclosure – for example:

      • regular software and application tests

      • maintaining current versions of software and applications and effective security software across all network components

      • maintaining network intrusion prevention and detection systems

      • procedures to manage email communications of TFN information

• encryption of systems, devices and communications that record TFN information

• having policies, procedures and resources in place to determine whether TFN information held by the registered tax practitioner needs to be destroyed or de-identified.

23. The TPB further suggests that registered tax practitioners should consider the following non-exhaustive list of ICT security measures and procedures to protect the security of TFNs and TFN information in email communications:

    • using more secured methods than email to communicate this information – for example, a secure website or online mailbox or secure messaging (where appropriate and available)

    • validating the email address with a recipient before sending any unencrypted email to them, to minimise the risk of unauthorised disclosure to a person who is not the intended recipient

    • only sending this information by email as an encrypted or password protected attachment

    • maintaining records of emails sent and received.

24. The TPB also recommends that registered tax practitioners have the following non-exhaustive list of ICT controls in place to protect the security and confidentiality of client records (which may include TFNs) and minimise the risk of a cyber attack:

    • installing and maintaining anti-virus software on workplace computers

    • deploying firewalls on workplace computers and/or workplace networks

    • ensuring that computer operating systems and programs always have the latest security patches

    • protecting client records or files, using encryption where possible

    • regularly changing passwords

    • using, wherever possible, a second form of authentication to protect online accounts (for example, email).

25. The above lists are not intended to be prescriptive or exhaustive. Registered tax practitioners may wish to seek independent professional advice from an ICT security provider about what controls are appropriate for their business and risk circumstances.

26. The TPB also encourages registered tax practitioners to contact the Australian Taxation Office (ATO) and/or the OAIC, or refer to the information published on their websites for any further guidance on obligations under the Privacy Act and TAA 1953 regarding the use and disclosure of TFNs and TFN information in email communications.

Consequences under the Code

27. If a registered tax practitioner fails to protect the TFNs or TFN information of clients, there may be implications in relation to the TASA, in particular, Code Item 6 (client confidentiality). Such a failure may be considered by the TPB in determining whether the registered tax practitioner has breached the TASA, including the Code.

28. If a registered tax practitioner breaches the Code, the TPB may impose one or more administrative sanctions, including issuing a written caution, order, suspension, or termination of a registered tax practitioner’s registration with the TPB. Ultimately, determining whether a registered tax practitioner has complied with their obligations under the TASA (including the Code) will be a question of fact. This means that each situation will need to be considered on a case-by-case basis having regard to the particular facts and circumstances of that case.

Further information

29. Further guidance about obligations under the Privacy Act (including the NDB Scheme and APPs) and the TFN Rule are provided by the OAIC and accessible from their website at www.oaic.gov.au.

30. Outlined below is a listing of reference material that may provide further guidance in relation to issues to consider when using and disclosing a client’s TFN and TFN information in email communications: