Privacy notice

About RAM and this privacy notice

RAM is an authorisation service administered by the Australian Taxation Office (ATO) that allows you to be authorised to access government online services on behalf of a business.

RAM is accredited under the Digital ID Act 2024 (Digital ID Act) as an ‘attribute service provider’, and is a participating entity in the Australia Government Digital ID System (AGDIS).

RAM can be used to:

• link your business to a single Digital ID
• manage your business authorisations in one place
• grant others authority to act on behalf of your business, when interacting with government online services.

By using RAM, you agree and provide your express consent that we may collect, hold, use and disclose your personal information, as set out in this privacy notice. Separate privacy notices apply to other government departments or agencies participating in the Digital ID system.

The ATO is subject to the Privacy Act 1988 (Privacy Act), incorporating the Australian Privacy Principles (APPs), the Australian Government Agencies Privacy Code 2017External Link (APP agency code registered under the Privacy Act). The RAM system is accredited under section 15 of the Digital ID Act External Linkwhich governs the ATO’s management of the system, in respect of personal information it collects, uses and discloses about you when you use the RAM service.

Collection of personal information

We are authorised by the Digital ID Act and Privacy Act to collect personal information about you for the purpose of operating the RAM service. The types of personal information collected by RAM include your:

• full legal name (pre-filled from your Digital ID details)
• email address
• date of birth (pre-filled from your Digital ID details)
• address
• relationship to the business
• associate authorisation provided for employee access.

Personal information may also include:

• information about services you have accessed or attempted to access
• information on the method of access
• your internet protocol number (IP address)
• the date and time your identity was verified.

This personal information must be collected before you can use RAM to link your Digital ID to your business. Your business must have an active Australian Business Number (ABN) on the Australia Business Register (ABR) to successfully complete a link in RAM.

RAM will create and store a record of the business, or businesses, that are successfully linked to your Digital ID.

We will only collect your personal information, where you have given your express consent. Collection of your personal information is required to enable you to use RAM.

If you do not provide your express consent, we will not be able to confirm your identity. This means you will not be able to:

• link your business
• authorise anyone to represent your business
• accept an authorisation to represent a business.

Use and disclosure of personal information

Personal information held in RAM may be used by the ATO and disclosed to other Digital ID System participants, such as:

• the Australian Competition and Consumer Commission (ACCC) in its role as the Digital ID Regulator for AGDIS
• the Office of the Australian Information Commissioner (OAIC) in its role as the Privacy Regulator for the AGDIS
• Services Australia in its capacity as the System Administrator of the AGDIS
• Treasury in its capacity as the Data Standards Body for the AGDIS

This is for the purpose of verifying, creating and maintaining the relationship between your Digital ID and business, as well as the authorisations linked to the business to access government online services on behalf of the business.

Your personal information may be used to:

• compile statistics and reports to enhance the RAM system and services
• assist to identify and respond to issues that indicate authentication integrity risks
• analyse, prevent, detect, manage and investigate fraudulent activity and suspected system misuse of RAM, which may lead to criminal prosecution.

We won’t use or disclose your personal information for any other purpose unless you have provided your express consent or we are required or authorised to do so under an Australian law or a court or tribunal order, including to an enforcement body for an enforcement related activity.

We won’t disclose personal information collected through RAM to overseas recipients. Your personal information will be stored securely in Australia.

We won’t use or disclose personal information for the purpose of direct marketing.

You can remove your authorisation and withdraw your express consent in RAM at any time; however, some personal information may be retained in accordance with the Digital ID Act and the Archives Act 1983. By withdrawing your express consent, you will no longer be able to use RAM. It may also affect your ability to enable authorised users and to represent your business or businesses with any government agencies and services.

How we hold personal information

We take reasonable steps to protect your personal information against:

• loss
• interference
• misuse, or
• unauthorised access, unauthorised modification or unauthorised disclosure.

We use physical and technological controls to ensure only staff needing access to your personal information can access it.

To protect the personal information we hold, we apply industry-best security methods, including:

• information technology and physical security audits
• penetration testing
• industry best practice risk management
• system security technologies.

Personal information used to create, verify and manage your relationships and authorisations in RAM is stored separately from other records the ATO holds. This is done to protect the confidentiality of your personal information and in compliance with the Digital ID Act.

Further information

The RAM Privacy policy contains further information about how we handle your personal information, including information about:

• how you can access and seek correction of your personal information held by us
• how to make a complaint if you think we have breached the Australian Privacy Principles or APP agency code, and
• how we will deal with complaints.

For more information about RAM and your privacyExternal Link, or if you believe your privacy has been breached, you can:

• phone 1300 661 542 and ask for the Privacy Hotline
• phone the ATO Complaints and Feedback Line on 1800 199 010
• write to:

ATO COMPLAINTS
PO BOX 1271
ALBURY  NSW  2640