Privacy (Tax File Number) Rule 2015

Administered by Attorney-General's Department

Legislation au F2015L00249 Rules In force Legislative Instrument

Legislation content

Explanatory Statement

Issued by the authority of the Privacy Commissioner

Privacy (Tax File Number) Rule 2015

This explanatory statement relates to the Privacy (Tax File Number) Rule 2015 (TFN Rule) made under section 17 of the Privacy Act 1988 (Privacy Act). The TFN Rule replaces the previous Tax File Number Guidelines 2011 (TFN Guidelines).

 

This explanatory statement fulfils the Privacy Commissioner’s obligations under s 26(1) of the Legislative Instruments Act 2003 in relation to the lodgement for registration on the Federal Register of Legislative Instruments of the TFN Rule.

Authority for making the Rule

The authority to issue the TFN Rule is contained in section 17 of the Privacy Act.

Section 17 of the Privacy Act states:

The Commissioner must, by legislative instrument, issue rules concerning the collection, storage, use and security of tax file number information.

Section 12 of the Australian Information Commissioner Act 2010 (AIC Act) provides that the Privacy Commissioner has the ‘privacy functions’ (which are defined in section 9(1) of the AIC Act). However, section 12(4)(d)(i) of the AIC Act relevantly provides that the Australian Privacy Commissioner may only undertake the issuing, variation or revocation of rules for the purposes of section 17 of the Privacy Act with the approval of the Australian Information Commissioner.

The Privacy Commissioner has issued the TFN Rule. For the purposes of section 12(4)(d)(i) of the AIC Act, the Australian Information Commissioner has approved the Privacy Commissioner issuing the TFN Rule.

Purpose and operation of the TFN Rule

The primary purpose of the TFN Rule is to regulate the collection, storage, use, disclosure, security and disposal of individuals’ Tax File Number (TFN) information. A breach of the TFN Rule is an interference with privacy under the Privacy Act.  Individuals who consider that their TFN information has been mishandled may make a complaint to the Privacy Commissioner.

The TFN Rule replaces the previous TFN Guidelines and contains two differences.

 

 

First, the title of the instrument uses the word ‘rule’ rather than ‘guideline’. On 12 March 2014, the Privacy Amendment (Enhancing Privacy Protection) Act 2012 introduced significant amendments to the Privacy Act. These amendments included an amendment to section 17, which now refers to the Commissioner issuing rules relating to tax file number information, whereas previously it referred to the Commissioner issuing guidelines relating to tax file number information. The title of the instrument has therefore been updated to reflect this change.

Second, the TFN Rule explicitly authorises the use and disclosure of TFN information by a TFN recipient for the purpose of giving an individual any TFN information that the TFN recipient holds about an individual. This ensures that the TFN Rule does not prevent an individual being given access to their information under Australian Privacy Principle 12 of the Privacy Act, or another Act that provides for access by persons to documents. It was not the intention that the TFN Guidelines would prevent this.  

Consultation

The Office of the Australian Information Commissioner (OAIC) conducted extensive consultation with industry stakeholders, peak industry bodies, advocacy groups and Australian Government agencies during the development of the TFN Guidelines.

The changes introduced by the TFN Rule are minor and do not substantially alter existing arrangements. Therefore, in accordance with s 18 of the Legislative Instruments Act 2003, the Australian Privacy Commissioner considered that consultation was unnecessary.

Some minor consultation has been conducted with the Department of Human Services who notified the OAIC that the TFN Guidelines may prevent TFN recipients from releasing TFN information to an individual upon their request.

 


Statement of compatibility with human rights

Prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011

TFN Rule

The Privacy (Tax File Number) Rule 2015 (TFN Rule) is compatible with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.

Operation

The TFN Rule is a legally binding rule which regulates the collection, storage, use and security of individuals’ Tax File Number (TFN) information and is issued under s 17 of the Privacy Act 1988 (Privacy Act). The TFN Rule replaces the previous Tax File Number Guidelines 2011 (TFN Guidelines).

Human rights implications

The TFN Rule engages Article 17 of the International Covenant on Civil and Political Rights (ICCPR). Article 17 provides that no one shall be subjected to arbitrary or unlawful interference with his or her privacy, family, home or correspondence, nor to unlawful attacks on his or her honour and reputation, and that everyone has the right to the protection of the law against such interference or attacks. 

The TFN Rule protects against the arbitrary interference with privacy, and advances an individual’s right to that protection by:

  • regulating the collection, storage, use and security of individuals’ TFN information
  • including a privacy enhancing provision that ensures individuals are not prevented from being given access to their TFN information. 

Conclusion

The TFN Rule advances the protection of human rights.    

 

Overview

The Privacy (Tax File Number) Rule 2015 was enacted to address the need for a comprehensive regulatory framework concerning the collection, storage, use, disclosure, security and disposal of individuals' Tax File Number (TFN) information. This rule was introduced under section 17 of the Privacy Act 1988 and replaces the previous Tax File Number Guidelines 2011. The Privacy Commissioner issued the rule with the approval of the Australian Information Commissioner, fulfilling the obligations set forth in the Australian Information Commissioner Act 2010. The rule aims to ensure that the handling of TFN information adheres to privacy standards, thereby protecting individuals from arbitrary interference with their privacy and providing them with access to their own information. The Privacy (Tax File Number) Rule 2015 is compatible with the human rights and freedoms recognised in international instruments, particularly engaging Article 17 of the International Covenant on Civil and Political Rights, which protects against unlawful interference with privacy.

Scope and Application

The Privacy (Tax File Number) Rule 2015 applies to all entities that collect, store, use, disclose, secure, or dispose of an individual’s Tax File Number (TFN) information. This encompasses a wide range of entities, including government agencies, private sector businesses, and non-profit organisations, across various industries that require TFN information for compliance with Australian tax laws and regulations. The Rule’s jurisdiction extends nationally, as it is issued under the Commonwealth's Privacy Act 1988. Although the Rule primarily governs entities handling TFN information, it does not explicitly state exclusions or thresholds; however, it does specify certain authorised uses and disclosures of TFN information. The application and interpretation of the Rule can be further detailed through subordinate instruments, which may provide additional guidelines or clarifications on specific operational aspects.

Key Provisions

The Privacy (Tax File Number) Rule 2015 (TFN Rule) is a legally binding instrument under the Privacy Act 1988, specifically section 17, which mandates the regulation of the collection, storage, use, disclosure, security, and disposal of individuals’ Tax File Number (TFN) information. This rule replaces the previous Tax File Number Guidelines 2011 (TFN Guidelines) and introduces two main changes: the title has been updated to "rule" from "guideline" to reflect legislative changes, and it explicitly authorises the use and disclosure of TFN information by a TFN recipient for the purpose of providing an individual with any TFN information held about them. This ensures compliance with Australian Privacy Principle 12 of the Privacy Act and other related legislation. The TFN Rule imposes specific obligations on entities and individuals who handle TFN information. These include ensuring that TFN information is collected only for legitimate purposes, stored securely, used only in accordance with the purposes for which it was collected, and disclosed only to authorised parties. Additionally, the rule mandates that TFN information be disposed of securely once it is no longer needed. Compliance with these provisions is essential to prevent privacy breaches and maintain the integrity of TFN information. Breaches of the TFN Rule are considered interferences with privacy under the Privacy Act, and individuals who believe their TFN information has been mishandled can lodge a complaint with the Privacy Commissioner. While the rule itself does not specify criminal or civil penalties, breaches of the Privacy Act can lead to significant consequences. Under section 13G of the Privacy Act, individuals can seek compensation for loss or damage resulting from a breach. Additionally, the Australian Information Commissioner may take action, including issuing infringement notices with fines of up to $6,600 for individuals and $33,000 for organisations. In more severe cases, the Commissioner can seek court orders for redress and publish the details of the breach.

Legal classification tags

Area of Law
Privacy Law
Instrument
Regulation
Concepts
Definitions & Interpretation
Regulatory Standards
Reporting & Disclosure Obligations

Interactions

Authorises

All Versions

Sourced from the Federal Register of Legislation at 26 August 2026. For the latest information on Australian Government law please go to https://www.legislation.gov.au.