Data-matching program with AFSA

The Australian Securities and Investments Commission (ASIC) matches data from a public database called the National Personal Insolvency Index (NPII), which is managed by the Australian Financial Security Authority (AFSA), with data from ASIC’s public database called the Companies Register.

The objectives of the data-matching program are to:

identify persons who are recorded on the Companies Register as being current officeholders of companies but are automatically disqualified from managing corporations under section 206B(3) and (4) of the Corporations Act, and
update ASIC’s registers where appropriate and ensure that publicly available information is accurate and up to date.

Version 2.0. Last updated June 2024

1.1 The Office of the Australian Information Commissioner’s Guidelines on data matching in Australian Government administration, 18 June 2014 (the Guidelines) specify that a data-matching program protocol is prepared by agencies undertaking data-matching programs as an administrative tool. The Guidelines are voluntary and are not legally binding but help to ensure good privacy practice and compliance with the Australian Privacy Principles (APPs) and the Privacy Act 1988 (Cth) (the Privacy Act). The Australian Securities and Investments Commission (ASIC) has prepared this protocol to comply with the Guidelines.

1.2 ASIC’s privacy policy provides information about how ASIC handles personal information, rights to seek access to or correct personal information, and to complain about breaches of privacy. ASIC maintains Australia’s publicly searchable register of companies (including details of their officeholders such as directors and secretaries) (Companies Register): see section 1274(1) of the Corporations Act 2001 (Corporations Act). As at 31 January 2024, the Companies Register contained information on over 3.3 million Australian companies and their officeholders. More recent statistics are available on the Company registration statistics page on our website.

1.3 The Australian Financial Security Authority (AFSA) is an executive agency in the Commonwealth Attorney-General’s portfolio and is responsible for the administration and regulation of the personal insolvency system in Australia. AFSA supports a number of statutory entities, relevantly the Inspector-General in Bankruptcy (the IGB), the Official Trustee and the Official Receiver (the OR).

1.4 AFSA also maintains the publicly accessible register of all bankruptcies and personal insolvencies in Australia known as the National Personal Insolvency Index (NPII): see the Bankruptcy Act 1966 (Bankruptcy Act) and the Bankruptcy Regulations 2021. The IGB has statutory responsibility for the NPII and the OR maintains the NPII on behalf of the IGB.

1.5 ASIC and AFSA entered into a memorandum of understanding (MoU) on 16 November 2023, renewing an arrangement which has been in place since April 2002. The MoU was entered into in recognition that cooperation between the agencies is desirable bearing in mind ASIC’s responsibilities for regulating corporate insolvencies and AFSA’s role as regulator of personal insolvencies.

1.6 Under section 206B of the Corporations Act, certain categories of personal insolvencies automatically disqualify a person from managing corporations and the person ceases to be a director, alternative director or secretary of a company unless leave is given by the court to manage corporations (section 206G of the Corporations Act) or written permission is given by ASIC (section 206GAB of the Corporations Act). It is an offence for a person who is disqualified from managing corporations to continue to manage corporations without leave of the court or written permission from ASIC (section 206A).

Data elements

4.1 Approximately 90,000 NPII records are being matched with approximately 8 million current officeholder records on the Companies Register (as at January 2024).

4.2 AFSA contributes data relating to the following categories of debtors:

undischarged bankrupts, and
persons who, on or after 1 December 2004, have executed a personal insolvency agreement under Part X of the Bankruptcy Act (Part X) where the terms of the agreement have not been fully complied with.

4.3 The NPII data includes:

the debtor’s name (including any known former names or aliases)
the debtor’s date of birth and, if applicable and known, the date of death
the debtor’s address
in the case of bankruptcy, the date the person became bankrupt and, if applicable, the date the bankruptcy was discharged, and
in the case of a personal insolvency agreement under Part X or a deed of arrangement or composition under Part X, the date on which all of the relevant obligations, if any, were met.

4.4 ASIC data derived from the Companies Register includes the following information about current officeholders of active companies:

the company officeholder’s name
the company officeholder’s date of birth, and
the company officeholder’s address.

Data quality and integrity

4.5 AFSA’s NPII is the system of record for personal insolvencies in Australia and ASIC’s Companies Register is the system of record for company officeholders. Both contain high-quality data subject to validation checks at points of entry and ASIC performs validation checks of the matched data before proceeding with administrative action to ensure data is accurate, up to date, complete and relevant.

4.6 The quality of the Companies Register data is regulated by law. A company is obliged to notify ASIC within 28 days of a person ceasing to hold office as a director or secretary of a company under section 205B(5) of the Corporations Act. This includes cessation because a person has become automatically disqualified from managing corporations under section 206B(3) and (4) of the Corporations Act. A person can also directly notify ASIC that they have ceased to hold office as a director or secretary of a company. Failure to comply is an offence of strict liability: section 205B(7) of the Corporations Act. Accordingly, the information in the Companies Register is not (and is not required by law to be) updated in real time, and may, depending on whether notification obligations are complied with, not accurately record each occasion of a ceased director or secretary.

4.7 ASIC aims to maintain a high level of data quality and integrity. ASIC’s matching systems have been designed to ensure that incomplete records will not be accepted, and to identify and correct records with inadequate or corrupt data: see Appendix A and paragraph 5 below for further details. Before data matching, the NPII data is screened to ensure that individual NPII records contain reliable, accurate and timely information. This involves applying business rules that specify the minimum data requirements the NPII records must satisfy to pass as a valid record for matching against the Companies Register data. The business rules are set out in Appendix A. NPII records that do not match the specified minimum data requirements are deleted and not used in the data-matching process.

4.8 Matching reports are then generated using the screened NPII records to identify persons who are recorded on the Companies Register as being current officeholders and whose name(s) and date of birth data match with NPII data. All matching reports are manually verified for data quality assurance. This includes comparing the address recorded on the Companies Register with the NPII address information for each person identified in the matching reports. A person is deemed to be a ‘match’ for possible administrative action by ASIC where the Companies Register and NPII data match on name(s), date of birth and address. Where any of these data elements are missing, incomplete or inconsistent no further action is taken.

Data security

4.9 ASIC staff are subject to the confidentiality provisions of the Australian Securities and Investments Commission Act 2001 (ASIC Act), the ASIC Code of Conduct, the ASIC Security Policy and the Australian Protective Security Framework. Access to the Companies Register data is strictly controlled and entry must be properly authorised. Features include logon identification codes, passwords and security groupings to ensure that access to information is on a ‘need to know’ basis only. Security arrangements in ASIC automatically log user access to data files and user access is periodically audited.

4.10 Each cycle in the matching program produces statistics on the number of records matched and unmatched. When each matching report is reviewed, ASIC maintains a record of the logon identification code of the reviewing officer, the decision that was taken for each record of the matched report and when the decision was taken.

5.1 NPII data is retrieved by ASIC on demand through AFSA’s secure API feed known as the Personal Insolvency Reporting Service. The feed includes the details of:

new bankrupt persons
those who have executed a personal insolvency agreement under Part X where the terms of the agreement have not been fully complied with, and
updates relating to existing bankruptcies and personal insolvency agreements under Part X.

5.2 The NPII data is first loaded into ASIC’s Enterprise Data Platform, reconciled to ensure completeness, and validated to assure quality. The NPII data is then loaded into ASIC’s internal database on a weekly basis and screened before a bulk matching report is generated each week. This involves applying business rules that specify the minimum data requirements that an individual NPII record must satisfy to pass as a valid record for matching against the Companies Register data: see the business rules set out in Appendix A. NPII records that do not match the specified minimum data requirements are set aside and no administrative action is taken.

5.3 The matching reports identify those persons who are recorded on the Companies Register as being current officeholders and whose data matches the following NPII data:

surname
first given name
other given names (if any), and
date of birth.

5.4 An ASIC operator then reviews the matching report and reviews the person’s address in each data set. The person will only be deemed to be a ‘match’ for possible administrative action by ASIC where the addresses for that person in both data sets refer to the same location.

5.5 Where it is not possible to confirm an address match, the record relating to the person concerned is rejected. No further action will be taken against the person in this data-matching cycle.

5.6 Before taking administrative action, ASIC undertakes further verification of records deemed to be a ‘match’ to see if the relevant data has been updated since the matching report was generated. An additional report from the Companies Register extracts all the current company roles held by each matched person and the most recently notified address. Any inconsistent address information is manually verified before proceeding with administrative action.

6.1 As part of each data-matching cycle, ASIC undertakes a 10-step process to ensure the data in ASIC’s registers are maintained and procedural fairness is afforded. The steps are as follows:

Table 1: Ten-step process

Step	Action
1	ASIC sends an initial notice to each matched person selected for administrative action. It is sent to their last notified address held by ASIC as recorded on the Companies Register. Under section 205B(4) of the Corporations Act a company must notify ASIC within 28 days of any changes to the personal details of its officeholders, including their address. This initial notice advises the person of the match and that they may be disqualified from managing a corporation. Form 296 Notice of disqualification from managing corporation – bankruptcy or personal insolvency agreement (Form 296) is included with the notice. The notice provides the person concerned with an opportunity to notify ASIC within 28 days of their current status by either: lodging confirmation of the disqualification using the enclosed Form 296, or providing written information to satisfy ASIC that the person is not automatically disqualified from managing corporations under section 206B of the Corporations Act. The person concerned, therefore, has an opportunity to respond to the information about the match before any action is taken by ASIC.
2	Where a person completes Form 296 and lodges it with ASIC within the 28-day period specified, ASIC updates the Companies Register to reflect the information provided.
3	Where written correspondence is received from the person refuting that they are automatically disqualified from managing corporations, ASIC may investigate the matter further. Documentary evidence may be requested from the person during this process. What, if any, further action may be taken as a result of ASIC’s investigation depends, in turn, on the facts of each matter.
4	Where the person concerned does not respond to the notice within 28 days or the notice is ‘returned to sender’, a second notice is sent to the registered office of each company of which the person is recorded on the Companies Register as being a current officeholder. Under section 142 of the Corporations Act a company must notify ASIC within 28 days of a change of address of its registered office, and under section 205B must similarly notify ASIC within 28 days of any changes to its officeholders. Failure to notify ASIC in either circumstance is a strict liability offence. This second notice informs each company of the match and that the person recorded may be disqualified from managing a corporation. The notice provides the company with an opportunity to notify ASIC within 21 days of the current status of the person concerned by either: notifying changes to company details and confirming the cessation of the officeholder online (see the Changes to your company page on our website), or providing written information to satisfy ASIC that the person is not disqualified. The company, therefore, has an opportunity to respond to the information about the match before any action is taken by ASIC.
5	Where the company notifies ASIC of the cessation of the officeholder within the 21-day period mentioned in Step 4 above, ASIC updates the Companies Register to reflect the information provided.
6	Where written correspondence is received from the company or person concerned refuting that the person is disqualified, ASIC may investigate the matter further. Documentary evidence may be requested from the company or person during this process. What, if any, further action may be taken as a result of ASIC’s investigation depends, in turn, on the facts of each matter.
7	Where the company does not respond to the second notice within 21 days or the notice is ‘returned to sender’, a third notice will be sent to the principal place of business of each company of which the person is recorded on the Companies Register as being a current officeholder. Under section 146 of the Corporations Act a company must notify ASIC of a change of address of its principal place of business within 28 days. Failure to do so is a strict liability offence. This third notice advises the company that as no response has been received ASIC intends to update the Companies Register within 14 days to show that the person concerned has ceased to be an officeholder of the company. The company, therefore, has another opportunity to respond to the information about the match before any action is taken by ASIC.
8	Where the company notifies ASIC of the cessation of the officeholder within the 14-day period specified, ASIC updates the Companies Register to reflect the information provided.
9	Where written correspondence is received from the company or person concerned refuting that the person is disqualified, ASIC may investigate the matter further. Documentary evidence may be requested from the company or person during this process. What, if any, further action may be taken as a result of ASIC’s investigation depends, in turn, on the facts of each matter.
10	Where the company does not respond to the third notice within 14 days or the notice is ‘returned to sender’, ASIC updates the Companies Register to show that the person concerned ceased to be an officeholder of the company. A final notice is then sent to each company of which the person was an officeholder to advise that ASIC has taken this action.

10.1 AFSA discloses NPII data to ASIC in accordance with APP 6.2(e). APP 6.2(e) operates as an exclusion from the prohibition in APP 6.1 on (relevantly) the disclosure of personal information collected for a particular purpose being used for another purpose. NPII data is collected for the primary purpose of administering the Bankruptcy Act and is disclosed to ASIC for a secondary purpose – that is, assisting ASIC to ensure the Companies Register (required by the Corporations Act to be maintained by ASIC) contains accurate information about company directors. APP 6.2(e) enables AFSA to disclose the NPII data for a secondary purpose if it reasonably believes the disclosure is reasonably necessary for one or more enforcement related activities conducted by or on behalf of an enforcement body. ASIC is an enforcement body: section 6 of the Privacy Act. ‘Enforcement related activity’ includes conducting surveillance activities, intelligence-gathering activities or monitoring activities: section 6 of the Privacy Act.

10.2 ASIC’s use of the NPII data accords with APP 6. Specifically, the NPII data is collected from AFSA for (relevantly for this data-matching protocol) the primary purpose mentioned in paragraph 10.1 above, and is used for that purpose. Alternatively, ASIC’s use accords with APP 6.2(e) for the reasons specified in paragraph 10.1.

10.3 ASIC does not propose to disclose the NPII data received from AFSA other than for the purpose identified in paragraph 10.4 below, or if required to do so under a requirement of law (e.g. a subpoena). If a request for NPII data is received by ASIC from a third party, ASIC will only disclose the NPII data if authorised to do so by section 127 of the ASIC Act (authorised disclosure of information received in confidence).

10.4 ASIC is obliged to afford procedural fairness before taking any administrative action that affects a person’s rights. ASIC will disclose the matched data about individuals for the purposes of affording procedural fairness to those individuals. The procedural fairness process is outlined in Part 6 of this protocol.

These business rules specify the minimum data requirements an NPII record must satisfy to pass as a valid record for the purposes of the data-matching program:

NPII data item	Field value
Surname	Must be populated
First given name	Must be populated
Other given name/s	May be blank
Date of birth	Must be populated
Address	Must be populated
Date started	Must be populated. Must be less than 2 years and 10 months from data-matching cycle date
Date ended	Must be blank
Date deceased	Must be blank
Date statement of affairs filed	If populated, must be less than 2 years and 10 months old from the download date

Commonwealth of Australia Gazette notice:

NOTICE OF DATA-MATCHING PROGRAM

The Australian Securities and Investments Commission (ASIC) commenced a data-matching program on 2 March 2004. The program is being upgraded to use a new data acquisition mechanism, commencing 23 June 2024.

The program matches data from a public database called the National Personal Insolvency Index (NPII), which is managed by the Australian Financial Security Authority (AFSA), with data from ASIC’s public database called the Companies Register which contains information on over 3.3 million Australian companies.

AFSA supports a number of statutory entities, relevantly the Inspector-General in Bankruptcy (the IGB), the Official Trustee and the Official Receiver (the OR). The IGB has statutory responsibility for the NPII and the OR maintains the NPII on behalf of the IGB.

The objectives of the data-matching program are to:

identify persons who are recorded on the Companies Register as being current officeholders of companies but are automatically disqualified from managing corporations under section 206B(3) and (4) of the Corporations Act; and
update ASIC’s registers where appropriate and ensure that publicly available information is accurate and up to date.

ASIC is the matching agency and the primary user agency. ASIC will receive NPII data from AFSA and then match it to ASIC’s own data.

ASIC data derived from the Companies Register includes the following information about current officeholders of active companies:

the company officeholder’s name;
the company officeholder’s date of birth; and
the company officeholder’s address.

AFSA NPII data, against which ASIC data will be matched, includes:

the debtor’s name (including any known former names or aliases);
the debtor’s date of birth and, if applicable and known, date of death;
the debtor’s address;
in the case of bankruptcy, the date the person became bankrupt and, if applicable, the date the bankruptcy was discharged; and
in the case of a personal insolvency agreement under Part X or a deed of arrangement or composition under Part X, the date on which all of the relevant obligations, if any, were met.

Approximately 90,000 NPII records are being matched with approximately 8 million current officeholder records on the Companies Register (as at January 2024).

A protocol describing the data-matching program has been developed in consultation with the Office of the Australian Information Commissioner. Copies of the protocol will be available from our website at asic.gov.au. Information about how ASIC handles personal information may be found in our Privacy Policy which is also available on our website.

Both ASIC and AFSA will adhere to the Information Commissioner’s Guidelines on data matching in Australian Government administration that includes standards for data matching to protect the privacy of individuals.

BPN123021

Previous versions

1 Overview

The Guidelines for Data-matching in Commonwealth Administration, issued by the Office of the Federal Privacy Commissioner, specify that a program protocol be prepared by agencies undertaking certain data-matching programs. These guidelines are voluntary and are not legally binding. The Australian Securities and Investments Commission ("ASIC") has agreed to comply with the guidelines.

ASIC is an independent Commonwealth government body established by the Australian Securities and Investments Commission Act 1989 and continued in existence by the Australian Securities and Investments Commission Act 2001 ("the ASIC Act"). ASIC enforces company and financial services laws to protect consumers, investors and creditors. In performing its functions and exercising its powers ASIC is enjoined to strive, among other things, to:

maintain, facilitate and improve the performance of the financial system and the entities within that system in the interests of commercial certainty, reducing business costs, and the efficiency and development of the economy;
promote the confident and informed participation of investors and consumers in the financial system;
ensure that information is available as soon as practicable for access by the public; and
take whatever action it can take, and is necessary, in order to enforce and give effect to the laws of the Commonwealth that confer functions and powers on it. (See subsection 1(2) of the ASIC Act.)

ASIC maintains Australia's public database called "ASCOT" that contains information on over 1.3 million Australian companies (see sections 1274, 1274AA and 1274A of the Corporations Act 2001 and the Corporations Regulations 2001 (the Regulations)). ASCOT contains the details of company officeholders, including directors and secretaries.

The Australian Financial Services Authority ("AFSA") is an Executive Agency in the Commonwealth Attorney-General's portfolio and is responsible for the administration and regulation of the personal insolvency system in Australia. AFSA also maintains the public records on personal insolvency on a publicly accessible register of all bankruptcies and personal insolvencies in Australia known as the National Personal Insolvency Index ("NPII") (see the Bankruptcy Act 1966 and the Bankruptcy Regulations 1996).

A person;

who is an undischarged bankrupt; or
who, prior to 1 December 2004, has executed a deed of arrangement under Part X of the Bankruptcy Act 1966 ("Part X") where the terms have not been fully complied with; or
whose creditors, prior to 1 December 2004, have accepted a composition under Part X where final payment has not been made under the composition; or
has, on or after 1 December 2004, executed a personal insolvency agreement under Part X of the Bankruptcy Act 1966 or a similar law of an external Territory or a foreign country and the terms of the agreement have not been fully complied with;

is automatically disqualified from managing corporations by operation of subsections 206B(3) and (4) of the Corporations Act. Such a person ceases to be a director, alternate director or a secretary of a company unless they are given leave by the Court to manage corporations in accordance with section 206G of the Corporations Act. Such persons who continue to manage corporations without the leave of the Court are guilty of an offence under the Corporations Act (section 206A of the Corporations Act).

In accordance with subsection 205B(5) of the Corporations Act if a person ceases being a director, alternate director or secretary of the company, the company has an obligation to lodge with ASIC a notice of the fact within 28 days. It is an offence to fail to notify ASIC.

ASIC and AFSA entered into a Memorandum of Understanding on 22 April 2002. The Memorandum of Understanding was entered into in recognition that cooperation between them is desirable bearing in mind ASIC's responsibilities for the regulation of corporate insolvencies and AFSA's role as regulator of personal bankruptcies.

2 Objectives

The results of this data-matching program between the ASIC public database ASCOT and the AFSA public database NPII will be used by ASIC:

to identify persons who are recorded on ASCOT as being current officeholders of companies but who are:

an undischarged bankrupt; or
who, prior to 1 December 2004, has executed a deed of arrangement under Part X where the terms have not been fully complied with; or
whose creditors, prior to 1 December 2004, have accepted a composition under Part X where final payment has not been made under the composition; or
has, on or after 1 December 2004, executed a personal insolvency agreement under Part X or a similar law of an external Territory or a foreign country and the terms of the agreement have not been fully complied with;

to update ASCOT where appropriate; and
to investigate possible breaches of the law.

AFSA will not have access to the results of the data-matching program.

3 Agencies involved

ASIC is the matching agency. The data-matching program will be run on ASIC computer facilities. Approximately 4.1 million current officeholder records on the ASCOT public database will be matched with approximately 300,000 NPII public records.

AFSA will contribute data relating to:

undischarged bankrupts;
persons who, prior to 1 December 2004, have executed a deed of arrangement under Part X where the terms have not been fully complied with;
persons whose creditors, prior to 1 December 2004, have accepted a composition under Part X and where final payment has not been made under the composition; and
persons who, on or after 1 December 2004, have executed a personal insolvency agreement under Part X or a similar law of an external Territory or a foreign country where the terms of the agreement have not been fully complied with.

ASIC and AFSA will be the source agencies. ASIC data derived from ASCOT includes:

ASIC person number (which is used internally to enable accurate cross-referencing of information);
company officeholder's name;
company officeholder's date of birth; and
company officeholder's address.

AFSA data derived from the NPII includes:

name of person who:
- is an undischarged bankrupt; or
- prior to 1 December 2004, has executed a deed of arrangement under Part X where the terms have not been fully complied with; or
- whose creditors, prior to 1 December 2004, has accepted a composition under Part X and final payment has not been made under the composition; or
- who, on or after 1 December 2004, has executed a personal insolvency agreement under Part X or a similar law of an external Territory or a foreign country where the terms of the agreement have not been fully complied with;
person's date of birth;
person's address;
in the case of bankruptcy, date of commencement and, if applicable, discharge; and
in the case of a personal insolvency agreement under Part X or a similar law of an external Territory or a foreign country or a deed of arrangement or composition under Part X, date upon which all of the relevant obligations have been met, if any.

4 Data issues

Data quality: Under subsection 205B(5) of the Corporations Act a company must, within 28 days of a person ceasing to hold office as a director or secretary of the company, notify ASIC. This includes cessation because a person has become automatically disqualified from managing a corporation due to:

bankruptcy; or
prior to 1 December 2004, executing a deed of arrangement under Part X where the terms have not been fully complied with; or
prior to 1 December 2004, the person's creditors accepting a composition under Part X and final payment has not been made; or
on or after 1 December 2004, executing a personal insolvency agreement under Part X or a similar law of an external Territory or a foreign country where the terms of the agreement have not been fully complied with.

A person can also directly notify ASIC that they have ceased to hold office as a director or secretary of a company.

Data integrity: Measures taken to maintain integrity levels include designing systems that will not accept incomplete records, and identifying and correcting records with inadequate or corrupt data. Prior to data-matching the NPII records will be screened to ensure that they contain reliable, accurate and timely information. This will involve applying business rules that specify the minimum data requirements an NPII record must satisfy to pass as a valid record for matching against ASCOT data. The business rules are set out in Appendix A. NPII records that do not match the specified minimum data requirements will be deleted and not used in the data-matching process.

Matching reports will then be generated using the screened NPII records to identify persons who are recorded on ASCOT as being current officeholders and whose name and date of birth data have an exact match with NPII data. All matching reports will be manually verified for data quality assurance. This includes comparing ASCOT and NPII address information for each person identified in the matching reports. A person will be deemed to be a "match" for possible administrative action by ASIC where the ASCOT and NPII data match on name(s), date of birth and address. Where any of these data elements are missing, incomplete or inconsistent it is deemed that these persons cannot be matched and no further action will be taken.

Data Security: ASIC staff are subject to the confidentiality provisions of the ASIC Act, the ASIC Code of Conduct and ASIC information management policies. Access to ASCOT data is currently strictly controlled and entry properly authorised. Features include logon identification codes, passwords and security groupings to ensure that access to information is on a "need to know" basis only. Existing security arrangements in ASIC automatically log user access to data files.

Each cycle in the matching program will produce statistics on the number of records matched and unmatched. When each matching report is actioned, ASIC will maintain a record of the logon identification code of the actioning officer, the action that was taken in respect of the matched report and when the action was taken.

Where ASIC receives information from AFSA in accordance with this program protocol, it will take all reasonable steps to ensure that such information is only used for the purpose for which it was obtained.

5 The matching process

On a weekly basis ASIC will download from AFSA an NPII update file using a secure web interface that is password protected at each level. The file includes the details of:

new bankrupt persons;
those who, prior to 1 December 2004,
- executed a deed of arrangement under Part X where the terms have not been fully complied with; or
- who have accepted a composition under Part X where final payment has not been made under the composition;
those who, on or after 1 December 2004, have executed a personal insolvency agreement under Part X or a similar law of an external Territory or a foreign country where the terms of the agreement have not been fully complied with; and
updates with respect to existing bankruptcies, personal insolvency agreements and deeds of arrangement or compositions under Part X.

Downloaded NPII records will then be screened prior to an automated matching report being generated each week. This will involve applying business rules that specify the minimum data requirements an NPII record must satisfy to pass as a valid record for matching against ASCOT data. (See the business rules set out in Appendix A.) NPII records that do not match the specified minimum data requirements will be rejected.

The matching reports will identify those persons who are recorded on ASCOT as being current officeholders and whose ASCOT data matches the NPII data with respect to:

surname;
first given name;
other given names (if any); and
date of birth.

All matching reports will be manually verified for data quality assurance. This includes staff comparing ASCOT and NPII address information for each person identified in the matching reports. Where an address match between ASCOT and ITSA data is confirmed in respect of a particular person, that person will be deemed to be a "match" for possible administrative action by ASIC.

Where it is not possible to confirm an address match the record relating to the person concerned will be rejected and the information destroyed as soon as practicable after the relevant matching process has been completed. This will occur no later than 90 days after the matching report was generated. No further action will be taken against the person concerned.

Further verification will take place with regard to the persons deemed to be a "match" for possible administrative action by ASIC. This is to see if any of the relevant data has been updated since the generation of the relevant matching report. An additional report will be generated from existing ASIC data to identify the last notified address held by ASIC in respect of each matched person, and all current company roles held by them, as recorded on ASCOT. Any inconsistent address information will be manually verified prior to any administrative action being taken. Any administrative action by ASIC will be taken no later than 90 days after the matching process has been completed.

6 Action resulting from the program

(1) All matched persons selected for possible administrative action by ASIC will be sent an initial notice. This first notice is set out in Appendix B. It will be sent to their last notified address held by ASIC as recorded on ASCOT. It will advise the person of the match and that they may be disqualified from managing a corporation. A Form 296 Notification of disqualification from managing a corporation (Form 296) will be included with the notice. The Form 296 is set out in Appendix C.

The notice shall provide the person concerned with an opportunity to notify ASIC within 28 days of their current status by either:

lodging confirmation of the disqualification using the enclosed Form 296; or
providing written information to satisfy ASIC that the person is not bankrupt or otherwise disqualified.

The person concerned, therefore, has an opportunity to respond to the information about the match before any action is taken by ASIC.

(2) Where a person completes the Form 296 and lodges it with ASIC within the 28 day period specified, ASIC will update ASCOT to reflect the information provided therein.

(3) Where written correspondence is received from the person refuting that they are bankrupt or otherwise disqualified, ASIC may investigate the matter further. Documentary evidence may be requested from the person during this process. What, if any, further action may be taken as a result of ASIC's investigation will in turn depend on the facts of each matter.

(4) Where the person concerned does not respond to the notice within 28 days or the notice is "returned to sender", a second notice will be sent to the registered office of each company of which the person is recorded on ASCOT as being a current officeholder. This second notice is set out in Appendix D. It will inform each company of the match and that the person so recorded may be disqualified from managing a corporation.

The notice shall provide the company with an opportunity to notify ASIC within 21 days of the current status of the person concerned by either:

lodging confirmation of the cessation of the officeholder using a Form 484 Change to company details (Form 484); or
providing written information to satisfy ASIC that the person is not disqualified.

The company, therefore, has an opportunity to respond to the information about the match before any action is taken by ASIC.

(5) Where the company completes a Form 484 and lodges it with ASIC within the 21 day period specified, ASIC will update ASCOT to reflect the information provided therein.

(6) Where written correspondence is received from the company or person concerned refuting that the person is disqualified, ASIC may investigate the matter further. Documentary evidence may be requested from the company or person during this process. What, if any, further action may be taken as a result of ASIC's investigation will in turn depend on the facts of each matter.

(7) Where the company does not respond to the second notice within 21 days or the notice is "returned to sender" a third notice will be sent to the principal place of business of each company of which the person is recorded on ASCOT as being a current officeholder. This third notice is set out in Appendix E. It shall advise the company that as no response has been received ASIC intends to update ASCOT within 14 days to show that the person concerned has ceased to be an officeholder of the company. The company, therefore, has another opportunity to respond to the information about the match before any action is taken by ASIC.

(8) Where the company completes a Form 484 and lodges it with ASIC within the 14 day period specified, ASIC will update ASCOT to reflect the information provided therein.

(9) Where written correspondence is received from the company or person concerned refuting that the person is disqualified, ASIC may investigate the matter further. Documentary evidence may be requested from the company or person during this process. What, if any, further action may be taken as a result of ASIC's investigation will in turn depend on the facts of each matter.

(10) Where the company does not respond to the third notice within 14 days or the notice is "returned to sender", ASIC will update ASCOT to show that the person concerned ceased to be an officeholder of the company. A final notice will then be sent to each company of which the person was an officeholder to advise that ASIC has taken such action. This final notice is set out in Appendix F.

7 Time limits applying to the conduct of the program

Data will be destroyed in accordance with the Office of the Federal Privacy Commissioner's guidelines on The Use of Data-matching in Commonwealth Administration.

Each week a matching report will be generated from the NPII download. NPII data deemed unsuitable for data-matching will be not used in the matching process and will be destroyed as soon as practicable after the relevant matching process has been completed. This will occur no later than 90 days after the matching report was generated. Matched NPII data stored and used as part of the matching process will also be manually destroyed within 90 days of being generated.

8 Public notice of the program

A notice announcing the commencement of the matching program was published in the Commonwealth of Australia Government Gazette No. B 8A on 24 February 2004.

9 Relationship with the agencies’ lawful functions and activities
The program is directly related to ASIC's statutory obligations with respect to the maintenance of public registers and to ensure the integrity of the information on those registers (see Part 9.1 of the Corporations Act, the Regulations and subsection 1(2) of the ASIC Act).

Further, the Royal Commission into the Building and Construction Industry ("the Cole Royal Commission") considered the issue of, and made a number of recommendations with respect to, bankrupt persons acting as directors of companies in the building and construction industry. The program is consistent with the recommendations made by the Cole Royal Commission in this regard.

10 Legal authority

As noted above, ASIC is enjoined to enforce and give effect to the laws of the Commonwealth that confer functions and powers on it (subsection 1(2) of the ASIC Act).

ASIC, through the program, aims to ensure compliance with the legal requirement that a company notify ASIC of the cessation of its officeholders (see subsection 205B(5) of the Corporations Act). Further, as noted above, a person;

who is an undischarged bankrupt; or
who, prior to 1 December 2004, has executed a deed of arrangement under Part X where the terms have not been fully complied with; or
whose creditors, prior to 1 December 2004, have accepted a composition under Part X where final payment has not been made under the composition; or
has, on or after 1 December 2004, executed a personal insolvency agreement under Part X or a similar law of an external Territory or a foreign country and the terms of the agreement have not been fully complied with;

is automatically disqualified from managing corporations by operation of subsections 206B(3) and (4) of the Corporations Act. Such persons cease to be a director, alternate director or a secretary of a company unless they are given leave by the Court to manage corporations in accordance with section 206G of the Corporations Act. Such persons who continue to manage corporations without the leave of the Court are guilty of an offence under the Corporations Act (see section 206A of the Corporations Act).

ASIC also aims to ensure compliance with such laws by reminding the purported officeholders and companies concerned that it is an offence for persons who are bankrupt or otherwise disqualified to manage a corporation. ASIC may also take further action where appropriate.

ASIC has a further objective of updating ASCOT information on company officeholders where appropriate. ASCOT is a register that ASIC maintains in accordance with section 1274 of the Corporations Act. ASIC is enjoined to ensure that information is available as soon as practicable for access by the public (subsection 1(2) of the ASIC Act).

The use and disclosure of information in these circumstances are authorised by law and may be reasonably necessary for the enforcement of the criminal law or a law imposing a pecuniary penalty. Information Privacy Principles 10(c) and 11(d) in section 14 of the Privacy Act 1988 clearly apply. To the extent law enforcement is involved, Information Privacy Principles 10(d) and 11(e) may also apply.

11 Alternative method

There is no alternative single source of information available in relation to the connection between persons who are recorded on ASCOT as being current officeholders and those persons who are bankrupt or otherwise disqualified from managing corporations.

12 Costs and benefits

A project has been established to develop and implement this program for ASIC.

The establishment costs are largely comprised of staff costs associated with the development of systems and processes to manage the program. The total cost of the project is low with staff opportunity costs estimated to be less than $50,000. No cash expenditure is required on goods and services.

Costs associated with conducting weekly runs of the program and with following up data matches are expected to be minimal as the potential number of matches is estimated to be approximately 8-10 per week.

It is expected that there will be an improvement in voluntary compliance by companies with statutory obligations to notify ASIC of changes in circumstances of officeholders. This will be due to the increased likelihood that ASIC will be able to detect whether a person recorded on ASCOT as being a current officeholder has been automatically disqualified from managing a corporation.

It is also expected that the maintenance of the ASIC public registers will be improved, as the information they contain about officeholders will become more up-to-date through improved notification of changes and the verification of such information through the data-matching process. Better data quality and integrity for the public may enhance the confident and informed participation of investors and consumers in the financial system. Improvements in ASIC's administration and control of the processing of bankruptcy and Part X notifications is also expected.

ASIC plans to conduct a review of the program once implemented to assess the effectiveness and efficiency of the program as well quantify the expected benefits and costs.

Appendix A: Business rules

These business rules specify the minimum data requirements an NPII record must satisfy to pass as a valid record for the purposes of the data-matching program:

NPII Data Item	Field Value
Surname	Must be populated
First given name	Must be populated
Other given name/s	May be blank
Date of birth	Must be populated
Address	Must be populated. Minimum of Town and State
Date started	Must be populated. Must be less than 2 years and 10 months from download date
Date ended	Must be blank
Date deceased	Must be blank
Date Statement of affairs filed	If populated must be less than 2 years and 10 months old from the download date
Bankrupt type	Must be either Sequestration, Composition, Arrangement, Debtor's Petition or Personal Insolvency Agreement
Petitioning Creditor result	Must be either 'Null', 'Composition', 'Arrangement' or 'Personal Insolvency Agreement'

Appendix B: First notice

Dear Sir/Madam

Possible disqualification from managing corporations

The Australian Securities and Investments Commission (ASIC) has received publicly available information from the Australian Financial Security Authority indicating that you may be a person who:

is an undischarged bankrupt under the Bankruptcy Act 1966; or
a person who has entered into a personal insolvency agreement under Part X of the Bankruptcy Act 1966 or a similar law of an external Territory or a foreign country and the terms of the agreement have not been fully complied with.

Such persons are automatically disqualified from managing corporations under subsection 206B(3) or (4) of the Corporations Act 2001. This includes company officeholders.

To determine if your current status on ASIC's corporate register is correctly recorded, ASIC requires you to respond within 28 days of the date of this letter, in one of the following ways:

by providing evidence establishing that you are not a person who is automatically disqualified from managing corporations, or
if you are automatically disqualified, by completing and returning the enclosed Form 296 (Notice of disqualification from managing corporations – Bankruptcy or Part X arrangement).

If you need assistance or require more information, please visit our website at www.asic.gov.au, contact ASIC's infoline on 1300 300 630 or make an enquiry at www.asic.gov.au/question.

Yours faithfully

Margaret Boothman
Senior Manager Registry Services
Registry Services & Licensing

Appendix C: Form 296

Appendix D: Second notice

Dear Sir/Madam

Possible disqualification from managing corporations

Company Name
ACN

RE: «First_Given_Name» «Surname»

The Australian Securities and Investments Commission (ASIC) has received publicly available information from the Australian Financial Security Authority indicating that the above-named person may be a person who:

is an undischarged bankrupt under the Bankruptcy Act 1966; or
a person who has entered into a personal insolvency agreement under Part X of the Bankruptcy Act 1966 or a similar law of an external Territory or a foreign country and the terms of the agreement have not been fully complied with.

Such persons are automatically disqualified from managing corporations under subsection 206B(3) or (4) of the Corporations Act 2001. This includes company officeholders.

To determine if their current status on ASIC's corporate register is correctly recorded, ASIC wrote to the person on «First_Letter_Date» giving that person an opportunity to respond but has received no response.

ASIC now requires your company to respond within 21 days of the date of this letter, in one of the following ways:

by providing evidence establishing that the person is not a person who is automatically disqualified from managing corporations, or
if the person is automatically disqualified, by completing and returning a Form 484 (Change to company details) advising, in accordance with subsection 205B(5) of the Corporations Act 2001, that the person ceased to be an officeholder of your company. In the case of a single officeholder company, the person will need to complete and return Form 296 (Notice of disqualification from managing corporations – Bankruptcy or Part X arrangement).

If you need assistance or require more information, please visit our website at www.asic.gov.au, contact ASIC's infoline on 1300 300 630 or make an enquiry - see Contact us .

Yours faithfully

Margaret Boothman
Senior Manager Registry Services
Registry Services & Licensing

Appendix E:Third notice

Dear Sir/Madam

Possible disqualification from managing corporations

«Company_Name»
ACN «ACN»

RE: «First_Given_Name» «Surname»

On «Second_Letter_Date» the Australian Securities and Investments Commission (ASIC) wrote to your company at the Registered Office. This letter advised that ASIC has received publicly available information from the Australian Financial Security Authority indicating the above-named person may be a person who:

is an undischarged bankrupt under the Bankruptcy Act 1966; or
a person who has entered into a personal insolvency agreement under Part X of the Bankruptcy Act 1966 or a similar law of an external Territory or a foreign country and the terms of the agreement have not been fully complied with.

Such persons are automatically disqualified from managing corporations under subsection 206B(3) or (4) of the Corporations Act 2001. This includes company officeholders.

To determine if their current status on ASIC's corporate register is correctly recorded, ASIC further advised that it had written to the person on «First_Letter_Date» giving that person an opportunity to respond to this matter, but had not received a response.

Your company was then asked to respond in one of the following ways:

by providing evidence establishing that the above-named person is not a person who is automatically disqualified from managing corporations, or
if the person is automatically disqualified, by completing and returning a Form 484 (Change to company details) advising, in accordance with subsection 205B(5) of the Corporations Act 2001, that the person ceased to be an officeholder of your company. In the case of a single officeholder company, the person will need to complete and return a Form 296 (Notice of disqualification from managing corporations – Bankruptcy or Part X arrangement).

ASIC has not yet received a response from your company. If no response is received within 14 days of the date of this letter, ASIC will proceed on the basis that the above-named person is disqualified from managing corporations and will update its corporate register to show that the person has, in accordance with subsection 206A(2) of the Corporations Act 2001, ceased to be an officeholder of your company.

If you need assistance or require more information, please visit our website at www.asic.gov.au, contact ASIC's infoline on 1300 300 630 or make an enquiry - see Contact us .

Yours faithfully

Margaret Boothman
Senior Manager Registry Services
Registry Services & Licensing

Appendix F: Final notice

Dear Sir/Madam

Disqualified person ceased to be an officeholder of your company

«Company_Name»
ACN «ACN»

RE: «First_Given_Name» «Surname»

On «date_we_first_wrote_to_company_about_dis» the Australian Securities and Investments Commission (ASIC) wrote to your company at its Registered Office. This letter advised that ASIC had received publicly available information from the Australian Financial Security Authority indicating that the above-named person, who was at the time recorded on ASIC's corporate register as being a current officeholder of your company, may be a person who is automatically disqualified from managing corporations under subsection 206B(3) or (4) of the Corporations Act 2001.

ASIC further advised that it had written to the person on «First_Letter_Date» giving that person an opportunity to respond to this matter but had received no response.

Your company was then given an opportunity to respond. As no response was received, ASIC sent a reminder on «date_of_second_letter_to_company_about_d» to your principal place of business. ASIC indicated in this letter, that if it received no response within 14 days it would proceed on the basis that the above-named person is disqualified from managing corporations and would update its corporate register.

As ASIC has received no response from your company, it has updated its corporate register to show that the above-named person has, in accordance with subsection 206A(2) of the Corporations Act 2001, ceased to be an officeholder of your company.

If you need assistance or require more information, please visit our website at www.asic.gov.au, contact ASIC's infoline on 1300 300 630 or make an enquiry - see Contact us.

Yours faithfully

Margaret Boothman
Senior Manager Registry Services
Registry Services & Licensing

Commonwealth of Australia Gazette notice:

VICTORIA

NOTICE OF PROPOSED DATA-MATCHING PROGRAM

The Australian Securities and Investments Commission (ASIC) shall commence a data-matching program on 2 March 2004.

The program will match data from a public database called the National Personal Insolvency Index (NPII), which is managed by the Insolvency and Trustee Service Australia (ITSA), with data from ASIC’s public database containing information on over 1.3 million Australian companies called ASCOT.

The objectives of the data-matching program will be to enable ASIC:

to identify persons who are recorded on ASCOT as being current officeholders of companies but who are:
1. an undischarged bankrupt; or
2. a person who has executed a deed of arrangement under a Part X of the Bankruptcy Act 1966 (Part X) where the terms have not been fully compiled [sic] with; or
3. a person whose creditors have accepted a composition under Part X where final payment has not been made under the composition, and therefore automatically disqualified from managing corporations by operation of subsections 206B(3) and (4) of the Corporations Act;
to use the results of the data-matching program to update ASCOT where appropriate; and
to investigate possible breaches of the law.

ASIC will be the matching agency. Matching will be undertaken on ASIC computer facilities each week. ITSA will contribute data from NPII relating to persons described in paragraph 1 above. Officeholder records held on ASCOT will be matched against this NPII data. ASIC data involved in the data-matching program includes:

ASIC person number (that is used internally to enable accurate cross-referencing of information);
company officeholder’s name;
company officeholder’s date of birth; and
company officeholder’s address.

ITSA data, against which ASIC data will be matched, includes:

name of person who is bankrupt or who has executed a deed of arrangement under Part X where the terms have not been fully compiled [sic] with or whose creditors have accepted a composition under Part X where final payment has not been made under the composition;
person’s date of birth,
person’s address;
in the case of bankruptcy, date of commencement and, if applicable, discharge, and
in the case of a deed of arrangement or composition under Part X, date upon which all of the relevant obligations have been met, if any.

A protocol describing the data-matching program has been developed in consultation with the Office of the Privacy Commissioner. Copies of the protocol will be available from:

Manager Policy and Technical Services
Public Information Program
ASIC

Both ASIC and ITSA will adhere to the Privacy Commissioner’s Guidelines on Data-Matching in Commonwealth Administration that includes standards for data-matching to protect the privacy of individuals.

BPN024842

Data-matching program with AFSA

1. Overview

2. Objectives

3. Agencies involved

4. The data

Data elements

Data quality and integrity

Data security

5. The matching process

6. Action resulting from the program

Table 1: Ten-step process

7. Time limits

8. Public notice of the program

9. Relationship to lawful functions

10. Legal authority to use and disclose personal information

11. Alternative methods

12. Costs and benefits

Appendix A: Business rules

Appendix B: Public notice of the program

Previous versions

Version 1.0. Last updated October 2014

1 Overview

2 Objectives

3 Agencies involved

4 Data issues

5 The matching process

6 Action resulting from the program

7 Time limits applying to the conduct of the program

8 Public notice of the program

10 Legal authority

11 Alternative method

12 Costs and benefits

Appendix A: Business rules

Appendix B: First notice

Appendix C: Form 296

Appendix D: Second notice

Appendix E:Third notice

Appendix F: Final notice

Public notice of the program (24 February 2004)