Tim Wilson's 'retirement tax' website doesn't have a privacy policy. So how is he using the data?

A growing debate over Labor’s policy to end cash rebates for excess franking credits has led to calls for the chair of parliament’s economics committee, Liberal MP Tim Wilson, to resign.

Labor has accused Wilson of using a parliamentary inquiry into the policy to spearhead a partisan campaign against it.

Part of the controversy revolves around a website Wilson is promoting – stoptheretirementtax.com – that initially required people who wanted to register to attend public hearings for the inquiry to agree to put their name to a petition against the policy. Wilson described this as a “mistake” that has since been fixed.

But there’s another issue with the website that’s worth taking a look at: if it complies with privacy law.

Political parties are exempt from the usual privacy rules, so we need to know if stoptheretirementtax.com is a Liberal party website or government website. The answer has implications for whether privacy law may have been breached, and if the data collected can be used for political campaigning in the upcoming federal election.

Read more: Australia should strengthen its privacy laws and remove exemptions for politicians

A party or parliamentary website?

Stoptheretirementtax.com was registered anonymously on October 31. While it’s a requirement of website registration for owners to be publicly listed, in this case a domain privacy service was used to hide those details.

By mid-November the site was being shared by a financial services company with their clients, who said that Wilson had sent the website details to them. In several tweets promoting the inquiry in November, Wilson didn’t mention the site.

The site was promoted publicly in January, when Wilson tweeted six times that people should use it to register for hearings in Queensland and New South Wales.

In these tweets, Wilson identified himself as both the Liberal MP for Goldstein and the Chair of the Economics Committee.

By contrast, stoptheretirementtax.com doesn’t mention Wilson’s electorate or political party. The bottom of the site has the Australian coat of arms with the words “Chair of the House Economics Committee”. Wilson’s parliamentary contact details appear alongside a statement that reads:

Authorised by Tim Wilson MP, Chair of the Standing Committee on Economics.

The confusion around whether stoptheretirementtax.com is an official government website begins with the website’s domain name. It’s based on a slogan coined by Wilson Asset Management, a financial services company that is actively campaigning against Labor’s policy on franking credits. The site also uses a photograph the company has used in their campaign, and Wilson has said Wilson Asset Management were consulted in the site’s development.

Then there is the text, which reads:

At the next election your financial security will be on the ballot … Labor are attacking your full tax refund. After the election they want to scrap refundable franking credits. That will hit your security in retirement and risk pushing many vulnerable retirees below the poverty line.

Read more: The Australian public cares about privacy: do politicians?

What data is being collected?

Stoptheretirementtax.com is collecting personal information. Visitors who wish to send a submission to the inquiry or register to attend public hearings are required to provide their name, email address, mailing address and phone number.

Visitors who want to send a submission to the standing committee on economics are offered a box with pre-filled text. A small note reads: “feel free to edit, or write your own”. A second box invites visitors to share their story.

Design features such as the colouring of the text could be seen to discourage editing of the first box while directing people to the second, meaning many people who submit a response will likely end up including the pre-filled text in their submission.

When registering for the public hearings, users are offered two check boxes (pre-checked), which state:

I want to be registered for the petition against the retirement tax

I want to be contacted on future activities to stop the retirement tax.

Until Sunday, it was impossible to register for a hearing without also signing the petition. Tim Wilson has said this was an “error”. The required check box for hearings and the design of the submission boxes may in fact be a dark pattern – a use of design feature to manipulate users into making the decision the site owner wants.

The site contains no privacy policy or indication of who the data is shared with or how it will be used.

On Monday, a page for the inquiry was added to the Australian Parliament’s website describing itself as the “the official page of the committee”. It states that submissions to the inquiry can be made via the Parliament’s submission system or by email. It also explains that “pre-registration is not required to participate” in the hearings.

A matter of privacy

Australian privacy is largely regulated by the Privacy Act and the Australian Privacy Principles it contains. Registered political parties are exempt, but stoptheretirementtax.com does not appear to come from a registered political party.

To assert it is campaign material from a registered political party at this stage would raise electoral law issues. The Commonwealth Electoral Act requires that registered political parties identify themselves in the authorisation statement on their political materials. Stoptheretirementtax.com has no such authorisation.

The Privacy Act does apply to government agencies, including ministers, departments and people:

holding or performing the duties of an appointment… made… by a Minister.

The Chair of a Standing Committee is “appointed by the prime minister”, making them an agency subject to the Australian Privacy Principles.

The Australian Privacy Principles requirements for government agencies include:

• being open and transparent about how personal information is managed, including having a privacy policy
• explaining why they are collecting, holding, using or disclosing personal information
• only collecting personal information if it is reasonably necessary or directly related to one of their function or activities
• only collect personal information by lawful and fair means
• disclosing who else the personal information would usually be shared with

A failure to comply with the Australian Privacy Principles may put personal information at risk and can attract the attention of the Information Commissioner, who regulates privacy.

What about parliamentary privilege?

The Australian Law Reform Commission noted in 2008 that:

Ministers engaging in their official capacity are bound by the Privacy Act, while MPs engaging in political acts and practices are not.

A Committee Chair would likely be similarly bound only while acting in that capacity.

Some of the time, while acting in their capacity, they may be effectively exempt from the Privacy Act due to parliamentary privilege.

Section 16(2) of the Parliamentary Privileges Act reasserts a right of immunity going back to the Bill of Rights of 1688. It covers:

all words spoken and acts done in the course of, or for purposes of or incidental to, the transacting of the business of a House or of a committee.

That doesn’t mean the principles don’t apply, just that enforcing corrective action may be beyond the reach of the courts. Parliament has its own processes that could still be used to address concerns.

The usual rules, enforceable by the courts, may still apply in circumstances where a committee chair is acting in that capacity, but outside the business of the committee.

Advocacy activities, like running a petition or soliciting contact details for political action may not be something “for the purpose” or “incidental” to the business of a committee. In fact, publishing an overtly political website may itself step outside the protection – as it is the committee and its parliamentary work, not the activities of the chair per se, that attract the privilege.

Read more: Australians' trust in politicians and democracy hits an all-time low: new research

Reaching a resolution

The best resolution would be for Tim Wilson to take down the site (particularly in light of the new official site), pass to the Committee Secretariat any information they require (such as submissions), then delete all personal information he has collected through the stoptheretirementtax.com website.

A full disclosure of who data may have been shared with, where it was held and how it was secured would also help. If data has been disclosed to anyone other than the Parliamentary Committee, those who have been impacted should be informed. The Information Commissioner should be consulted for guidance and assistance.

The broader lesson is that privacy must be taken seriously. The Australian Privacy Principles are designed to ensure transparency and accountability. The lack of a privacy policy on the website should have served as a warning.