There will be strict new requirements for government agencies wanting to undertake data-matching schemes similar to that in the Centrelink robo-debt notice debacle, and the Department of Human Services faces an audit by the Office of the Australian Information Commissioner.

Government departments could face fines of up to $1.8 million for failing to conduct and publish privacy impact assessments on data matching using Australians’ private information under new guidelines being developed by Information Commissioner Timothy Pilgrim’s office in co-operation with the Department of Prime Minister and Cabinet.

Pilgrim announced the changes to the privacy code, and the planned audit of the Department of Human Services’ (DHS) use of Australian Tax Office (ATO) tax data, at the Senate committee’s hearing into the automated debt notice system in Canberra this morning. All government agencies that wish to undertake data matching using Australians’ personal information would need to undertake a privacy impact assessment, and would be required to publish that, Pilgrim said.

 “I think that would provide a greater deal of transparency,” he said.

After the completion of the Commonwealth Ombudsman’s review into the automated debt notices system, Pilgrim said his office would now assess how DHS was matching ATO pay-as-you-go data with Centrelink welfare recipient data.

“The assessment will focus on the quality and the accuracy of personal information handling practices of the program,” Pilgrim said.

The audit will not commence until the first quarter of the next financial year, giving time for DHS to implement recommended changes to the program as a result of the Commonwealth Ombudsman’s separate review into the data-matching program, Pilgrim said. He would also examine the department’s plan to expand the use of the automated data matching scheme.

DHS had also provided information to Pilgrim’s initial inquiries into Minister Alan Tudge’s release of blogger Andie Fox’s personal information. This comes in response to an article she had written about her experiences with Centrelink. The Australian Federal Police decided not to investigate the matter, and Pilgrim said his office would likely make a decision in a matter of weeks on whether to launch a formal investigation over whether Fox’s privacy was breached.

In last week’s budget, the government announced plans to require welfare recipients to provide their tax file number when receiving welfare for data matching purposes.

While the Commonwealth Ombudsman had received hundreds of complaints about the debt notices, Pilgrim estimated his own office had received less than 10.