Disclaimer

This is a Tax Practitioners Board (TPB) Information sheet (TPB(I)). It is intended to be for information only. It provides information regarding the TPB’s position on the application of subsection 30-10(6) of the Tax Agent Services Act 2009 (TASA), containing one of the obligations of registered agents under the Code of Professional Conduct (Code).

While it seeks to provide practical assistance and explanation, it does not exhaust, prescribe or limit the scope of the TPB’s powers in the TASA.

In addition, please note that the principles, explanations and examples in this TPB(I) do not constitute legal advice and do not create additional rights or legal obligations beyond those that are contained in the TASA or which may exist at law. Please refer to the TASA for the precise content of the legislative requirements.

Document History

Introduction

1. The Tax Practitioners Board (TPB) has prepared this Information sheet (TPB(I)) to assist registered tax agents and BAS agents (collectively referred to as ‘tax practitioners’) to understand their obligations under subsection 30-10(6) of the Tax Agent Services Act 2009 (TASA) – Code of Professional Conduct (Code) item 6. 
2. Code item 6 states that:
   'Unless you have a legal duty to do so, you must not disclose any information relating to a client’s affairs to a third party without your client’s permission.’
3. In this TPB(I), you will find the following information:
   • what is Code item 6 (paragraphs 5 to 6)
   • how to comply with Code item 6 (paragraphs 7 to 29)
   • other considerations including privacy and tax whistleblowing (paragraphs 30 to 46)
   • consequences for failing to comply with Code item 6 (paragraphs 47 to 52)
   • comparison with the Corporations Act 2001 (Corporations Act) for tax agents with a tax (financial) advice services condition (paragraph 53)
   • practical examples involving Code item 6 (paragraph 54).
4. The TPB has previously published an explanatory paper that sets out its view on the application of the Code, including Code item 6.^[1]

What is Code item 6?

5. As per paragraph 2 above, Code item 6 provides that, unless there is a legal duty to do so, tax practitioners must not disclose any information relating to a client’s affairs to a third party without the client’s permission.
6. Therefore, any disclosure of information relating to a client’s affairs to a third party without the client’s permission will be a breach of Code item 6, unless there is a legal duty on the tax practitioner to disclose the information.

How to comply with Code item 6

What is ‘information’?

7. Information refers to the acquiring or deriving of knowledge and includes, but is not limited to, capturing information known about a client. This information could be acquired directly or indirectly from the client or other sources.

What is ‘information relating to a client’s affairs’?

8. It is only necessary that the information relates to the affairs of a client. The information does not have to belong to the client, or have been directly provided by the client to a tax practitioner.

What is a ‘third party’?

9. For the purposes of Code item 6 and the TASA, a third party means any entity other than the client and the tax practitioner.
10. In relation to a tax practitioner that outsources a component of the tax agent services to another entity (for example, another tax practitioner, a legal practitioner, a contractor or an overseas or offshore entity), the third party would include that other entity.
11. Disclosure to a third party would also include disclosure of information relating to one entity within a service trust structure to another entity within the same service trust structure, unless the client is defined, for example in the engagement letter, as the whole structure.^[2]
12. Further, a third party may also include entities that maintain offsite data storage systems (including ‘cloud storage’).
13. In the case of a tax agent with a tax (financial) advice services condition that is an authorised representative of an Australian financial services (AFS) licensee, a third party includes the AFS licensee, and vice versa. However, the following is also recognised:
    • In the context of an AFS licensee/authorised representative relationship, it is understood that authorised representatives (who are registered practitioners) often use ‘fact finds’ or other documents to obtain consent from clients and therefore facilitate the flow of client information to the AFS licensee from the authorised representative (see also paragraph 17 below).
    • A provider of personal advice who is an authorised representative of an AFS licensee is required to provide information to the AFS licensee pursuant to s912G of the Corporations Act, as inserted by Australian Securities and Investments Commission (ASIC) Class Order [CO 14/923] Record-keeping obligations for Australian financial services licensees when giving personal advice. Under this section, an authorised representative of an AFS licensee is required to give records to the AFS licensee if requested by the AFS licensee, provided the request is made:
      • in connection with the obligations imposed on the AFS licensee under Chapter 7 of the Corporations Act, and
      • within seven years after the day on which the personal advice was provided to the client (see also paragraph 26 below).
14. Subject to the the relevant contractual arrangements, a third party may also include other AFS licensees, authorised representatives, para-planners, product providers and advisers, insurance brokers, and technical teams and advisers.  

In what circumstances can a tax practitioner disclose information relating to a client’s affairs (or a former client’s affairs) to a third party?

15. A tax practitioner may only disclose information relating to a client’s affairs (or a former client’s affairs) to a third party if:
    • the tax practitioner has the client’s (or former client’s) permission, or
    • there is a legal duty to do so.
16. The TPB recognises that there are obligations associated with being a member of an ASIC approved external dispute resolution (EDR) scheme^[3] and also where financial services are covered by the Superannuation Complaints Tribunal (SCT).^[4] Further, it is recognised that an AFS licensee may need to obtain legal advice in respect of dealing with a complaint and defending a claim.

(i) Client’s permission

17. Where information relating to a client’s affairs is to be disclosed by a tax practitioner to a third party, the tax practitioner should, prior to any disclosure, clearly inform the client that there will be such disclosure and obtain the client’s permission. This permission may be by way of a signed letter of engagement, signed consent or other communication with the client.^[5] In all cases, the relevant communication should outline the disclosures to be provided, as well as information about the entity/entities that will have access to the client information.
18. A letter of engagement will typically outline services to be provided by the tax practitioner to their client, as well as information about entities that will provide those services. For further information on engagement letters, refer to TPB Practice Note TPB(PN) 3/2019 Letters of engagement.
19. A tax practitioner must ensure that they inform their clients about any client information^[6] that may be disclosed. In this regard, it is recommended that a tax practitioner include information in relation to whom and where the disclosure will be made. A general authority consenting to disclosure to third parties may also be acceptable.
20. However, even in the context of a general disclosure, a tax practitioner should require a positive step from their client to authorise the requisite disclosure. This may include an appropriate ‘opt-in’ type approach,^[7] including in conjunction with reviewing an engagement letter. Further, a tax practitioner is not excused from taking steps to protect information just because it would be inconvenient, time-consuming or costly to do so.^[8]
21. While there is no set formula or methodology used to obtain client permission, the TPB suggests that tax practitioners be clear in explaining to their client where information may be disclosed (including, among other things, where a component of work or add-on activity will be completed). For example, to avoid any likelihood of your practices being seen as misleading, we suggest that you do not imply or state that all your work is completed in Australia, if that is not the case.
22. In relation to outsourcing arrangements and cloud storage arrangements, the TASA does not specifically prohibit these activities. However, tax practitioners must consider their obligations under Code item 6 in relation to these arrangements to ensure confidentiality of client information, including appropriate disclosure in regard to where data is being sent and stored.^[9]
23. While not binding on all registered tax agents, further useful guidance on what steps an agent may take when providing or utilising outsourced services may be found in specific Accounting Professional and Ethical Standards Board (APESB) guidance.^[10] It is also noted that TPB accredited recognised professional associations may be able to assist in providing practical guidance, while recognising that there is not a default one-size-fits-all template and that arrangements will need to be mindful of the particular circumstances.^[11]
24. Ultimately, the onus is on the tax practitioner to exercise appropriate due diligence when outsourcing work, including ensuring appropriate disclosure. Outsourcing may also give rise to other obligations under the TASA, including ensuring that tax agent services are provided to a competent standard, and that there are adequate supervision and control arrangements.

(ii) Legal duty to do so

25. A tax practitioner may disclose information relating to a client’s affairs to a third party without the client’s permission if the tax practitioner has a legal duty to disclose the information.
26. Examples of circumstances where a tax practitioner may have a legal duty to disclose client information to a third party include:
    • providing information requested by the TPB in undertaking enquiries about your conduct, including information requested under a notice issued pursuant to section 60-100 of the TASA
    • providing information to a court or tribunal pursuant to a direction, order, or other court process to provide that information
    • providing information to AUSTRAC in accordance with reporting obligations under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (AML/CTF Act)^[12]
    • providing information or documents to the Australian Taxation Office (ATO) under a notice pursuant to section 353-10 in Schedule 1 to the Taxation Administration Act 1953 concerning taxation laws
    • providing information to an AFS licensee pursuant to s912G of the Corporations Act, as inserted by ASIC Class Order [CO 14/923] Record-keeping obligations for Australian financial services licensees when giving personal advice, which requires an authorised representative of an AFS licensee to give records to the AFS licensee if requested by the AFS licensee, provided the request is made:
      • in connection with the obligations imposed on the AFS licensee under Chapter 7 of the Corporations Act; and
      • within seven years after the day on which the personal advice was provided to the client.
27. The TASA, including Code item 6, does not affect the law relating to legal professional privilege (LPP).^[13] LPP protects confidential communications between a lawyer and their client from compulsory production. At times, a tax practitioner may be in possession of client documents or information that may be subject to LPP, such as legal advice about a client’s tax affairs which has been provided on a confidential basis. Before disclosing client documents or information to a third party, a tax practitioner should consider whether any of the documents may be subject to LPP. Where a tax practitioner considers that LPP may apply, they should seek legal advice as to the application of LPP. Accordingly, in the practical examples given in paragraph 54 below, a tax practitioner would need to consider any additional LPP obligations.
28. If a tax practitioner is concerned as to whether there is a legal duty to disclose client information to a third party, the tax practitioner should consider seeking independent legal advice.

Inadvertent disclosure

29. Tax practitioners also need to ensure that they have appropriate arrangements^[14] to prevent inadvertent disclosure. In this regard, the following are some examples of where tax practitioners need to be particularly mindful of their obligations:
    • the use of mobile temporary booths in shopping centres, ensuring there are appropriate controls to prevent third parties from viewing client information
    • the use of recycled paper which includes personal details concerning other clients
    • leaving client information in unsecured locations which may be accessed by third parties
    • disposing (such as trading in or selling to a second-hand market) of IT equipment that contains / stores data that may be accessible by third parties
    • the use of shredding and data disposal services
    • the use of external service providers which may include, for example, IT consultants and cleaners
    • disclosing a client’s TFN in correspondence to a financial institution (e.g. an ATO income tax assessment notice provided in support of a loan application)
    • the use of virtual meetings to discuss client information when third parties may be in attendance
    • the use of public Wi-Fi when providing services for a client.^[15]

Other considerations

Privacy

30. In addition to a tax practitioner’s obligations under Code item 6, the Privacy Act 1988 (Cth) sets out a number of Privacy Principles which govern the use of, storage and disclosure of personal information and other conduct by organisations.^[16] Some of these privacy principles may have a direct impact on the requirement to obtain consent (express or implied) from clients.
31. Tax practitioners should seek their own advice about whether the provisions of the Privacy Act 1988 apply to them. Information about obligations under the Privacy Act 1988 is accessible from the Office of the Australian Information Commissioner’s website at oaic.gov.au.^[17]

Tax whistleblowing

32. Whistleblower laws^[18] legally protect people who ‘blow the whistle’ about an entity that is not complying with the TASA or the tax laws. 

Qualifying for tax whistleblower protection

33. To qualify for tax whistleblower protection, a disclosure of information about a client's affairs must meet certain conditions which are outlined below.
    • A disclosure of information by an individual qualifies for protection if the:
      • discloser is an ‘eligible whistleblower’ in relation to an entity (within the meaning of the Income Tax Assessment Act 1997),
      • disclosure is made to the Commissioner of Taxation
      • discloser considers that the information may assist the Commissioner to perform their functions or duties under a taxation law in relation to the entity or an associate of the entity.^[19] 
    • A disclosure of information by an individual qualifies for protection if the:
      • discloser is an ‘eligible whistleblower’ in relation to an entity (within the meaning of the Income Tax Assessment Act 1997),
      • disclosure is made to the TPB or Commissioner of Taxation
      • discloser considers that the information may assist the TPB to perform their functions or duties under the TASA in relation to the entity or an associate of the entity.^[20]
34. Prior to making a disclosure of information, a tax practitioner may wish to consider seeking independent legal advice to confirm whether they meet the definition of an eligible whistleblower and can qualify for whistleblower protection.

Eligible whistleblowers

35. To be eligible for whistleblower protection, the whistleblowing individual must be, or have been, in a relationship with the entity it is reporting about.^[21] This includes:
    • an officer of the entity
    • an employee of the entity
    • an individual who supplies services or goods to the entity (such as a registered tax agent or BAS agent)
    • an employee of a person that supplies services or goods to the entity
    • an associate^[22] of the entity
    • a spouse, child or dependent of an individual referred to above, or a dependent of an individual’s spouse
    • an individual prescribed by the regulations in relation to the entity.

Information that can be disclosed

36. If an individual is an eligible whistleblower, they can make a disclosure of information to:
    • the Commissioner of Taxation if the discloser considers that the information may assist the Commissioner to perform their functions or duties under a taxation law in relation to the entity or an associate of the entity^[23] 
    • the Commissioner of Taxation if the discloser considers that the information may assist the TPB to perform its functions or duties under the TASA in relation to the entity or an associate of the entity^[24] 
    • the TPB if the discloser considers that the information may assist the TPB to perform its functions or duties under the TASA in relation to the entity or an associate of the entity^[25]
    • an eligible recipient^[26] in relation to the entity (such as, a registered tax agent or BAS agent) if the discloser:
      • has reasonable grounds to suspect that the information indicates misconduct, or an improper state of affairs or circumstances, in relation to the tax affairs of the entity or an associate of the entity, and 
      • considers that the information may assist the eligible recipient to perform functions or duties in relation to the tax affairs of the entity or an associate of the entity.^[27] 
37. If an individual is not an eligible whistleblower, they may still qualify for protection if they make a disclosure to:
    • a legal practitioner (for the purpose of obtaining legal advice or legal representation in relation to the operation of the whistleblower laws)^[28]
    • a medical practitioner or psychologist (for the purpose of obtaining medical or psychiatric care, treatment or counselling, including psychological counselling)^[29]
    • an entity prescribed by the regulations.^[30]  
       

Whistleblower protections

Identity protection

38. It is illegal for someone to disclose the identity, or information that may lead to the identity, of a whistleblower who has made a disclosure under the whistleblower laws, unless the disclosure is:
    • made to an authorised body (such as the Commissioner of Taxation)
    • made with the whistleblower’s consent, or
    • not of the whistleblower’s identity and is reasonably necessary for the purposes of investigating misconduct, or an improper state of affairs or circumstances, to which the whistleblower disclosure relates and all reasonable steps have been taken to reduce the risk that the whistleblower’s identity will be identified as a result of the disclosure.^[31]

Civil, criminal and administrative liability protection

39. Whistleblowers are not subject to civil, criminal or administrative liability (including disciplinary action) for making a disclosure. For example, a whistleblower cannot be sued for a breach of a confidentiality clause in a contract, or have their contract terminated on the basis that the disclosure constitutes a breach of contract. For tax practitioners, this means that a tax practitioner who is an eligible whistleblower is immune from disciplinary action if they disclose information about a client pursuant to the whistleblower laws.^[32]
40. Further, if a disclosure is made to the TPB or Commissioner of Taxation, then the information would not be admissible in evidence against the eligible whistleblower in criminal proceedings or in proceedings for the imposition of a penalty, other than proceedings in respect of the falsity of the information. However, this does not prevent an eligible whistleblower being subject to any civil, criminal or administrative liability for their conduct that is revealed by the disclosure.^[33] 
41. Further information on making a disclosure to the TPB is available on our website and making a disclosure to the Commissioner of Taxation can be found on the ATO’s website.

Responding to non-compliance with laws and regulations (NoCLAR)

42. The Accounting Professional & Ethical Standards Board’s (APESB) APES 110: Code of Ethics for Professional Accountants include the Non-compliance with laws and regulations (NoCLAR) framework. This framework provides standards for APESB members on how best to act in the public interest when they become aware of NoCLAR.
43. This framework applies to all members of Chartered Accountants Australia & New Zealand, CPA Australia, and Institute of Public Accountants.
44. NoCLAR is any intentional or unintentional act of omission or commission, that is committed by a client or employer^[34] which is contrary to prevailing laws or regulations.
45. Under the NoCLAR framework, APESB members are expected to consider whether disclosure to an appropriate authority about NoCLAR or suspected NoCLAR is an appropriate course of action in the circumstances. However, a disclosure that is contrary to a law or regulation, such as Code item 6, is not required or permitted under the NoCLAR framework.
46. This means that, in complying with the NoCLAR framework, APESB members^[35] that are also tax practitioners must ensure that they continue to comply with the Code and the TASA, and in particular Code item 6 (noting the whistleblower protections that may be applicable – see paragraphs 32 to 41 above). 

Consequences for failing to comply with Code item 6

47. If a tax practitioner discloses information relating to a client’s affairs to a third party without the client’s permission or without a legal duty to do so, the TPB may find that the tax practitioner has breached the Code and may impose sanctions for that breach.
48. Ultimately, determining whether a tax practitioner has complied with their obligations under Code Item 6 will be a question of fact. This means that each situation will need to be considered on a case-by-case basis having regard to the particular facts and circumstances.
49. From 1 July 2024, registered tax practitioners will be required to notify: 
    • the TPB if they have reasonable grounds to believe that they have breached the Code and that breach is significant, and
    • the TPB and the relevant recognised professional association (if applicable) if they have reasonable grounds to believe that another registered tax practitioner has breached the Code and that breach is significant.^[36] 
50. In relation to the reporting of a significant breach relating to another registered tax practitioner’s conduct, particularly in the context of disclosing the details of another person’s or entity’s conflict of interest in undertaking the same or different activity for an Australian government agency, the TPB will assess the information provided and make further enquiries (as appropriate) to ensure the reporting of a significant breach is not frivolous, vexatious or malicious.
51. The TPB may take action against the notifying registered tax practitioner if the TPB considers that a breach report is frivolous, vexatious or malicious, for example, if the claim involves the making of a false or misleading statement. Such situations may raise issues about the notifying registered tax practitioner’s compliance with other requirements of the TASA, including:
    • the fit and proper person requirement, which registered tax practitioners must meet to maintain their registration, and
    • other Code items, including the requirement to act with honesty and integrity (Code item 1), which may lead to the imposition of administrative sanctions. 
52. If a tax practitioner breaches the Code, the TPB may impose one or more of the following sanctions:
    • a written caution
    • an order requiring the tax practitioner to do something specified in the order
    • suspension of the tax practitioner’s registration
    • termination of the tax practitioner’s registration.

Comparison with the Corporations Act for tax agents with a tax (financial) advice services condition

53. While no similar obligation exists in the Corporations Act, it is noted that Australian Privacy Principle (APP) 6.1 in the Privacy Act 1988 (Cth) requires that you do not use personal information about an individual that was collected for a particular purpose (primary purpose) for another purpose (secondary purpose) unless:
    •  the individual has consented to the use or disclosure of the information, or
    • one of the exceptions in APP 6.2 applies.^[37]

Practical examples involving Code item 6

54. The following are indicative examples which illustrate the general application of Code iem 6. In all cases, consideration will need to be given to the specific facts and circumstances.