Highlights

  • ATO central audit logs recorded eight alleged occasions of access, or attempted access, to five people's tax records.
  • Justice Hill refused an extension of time and a stay on 15 October 2026 but allowed an amended application.
  • Tax secrecy rules make recording or disclosing protected taxpayer information an offence, carrying up to two years' imprisonment.
  • The ATO app sends real-time alerts about account changes and lets users lock their account.

Before this case, most Australians had little reason to wonder who inside the ATO might be looking at their file. After it, the question feels less abstract. A Federal Court decision published this month reveals that the agency's central audit logs recorded eight alleged occasions on which a former employee accessed, or tried to access, the tax records of five people. The detection led to an internal investigation, a dismissal and a court application, and arrives as self-lodgers face a 2 November deadline.

What the court was told, and what it decided

The matter is Onyema v Commonwealth [2026] FCA 1530, decided by Justice Hill on 15 October 2026. Former ATO employee Kenneth Onyema was dismissed in October 2025 for breaching the Australian Public Service (APS) Code of Conduct. Material before the court included audit log records of eight alleged instances of unauthorised access, or attempted access, covering five individuals' records.

The ruling was procedural. The court refused his applications for an extension of time and for a stay but allowed him to amend his application. It made no criminal finding about the alleged access and was not a ruling on the allegations. He faces separate charges in Victoria, which are unproven, proceed separately and have no reported outcome.

How the ATO watches its own staff

ATO systems keep a record of when staff open taxpayer information, letting investigators reconstruct who viewed which record, and when. Staff are also bound by the APS Code of Conduct under the Public Service Act 1999, which requires compliance with Australian laws and no improper use of information gained through work. Sanctions range up to termination.

Tax secrecy rules add another layer. Under Division 355 in Schedule 1 to the Taxation Administration Act 1953, it is an offence for a taxation officer to record or disclose protected taxpayer information beyond what the law permits, with a maximum penalty of two years' imprisonment. As far as has been reported, no court has decided whether any of these apply to the conduct alleged here.

A worked example: how a log flags snooping

Hypothetical example: an ATO officer has 40 assigned cases on a given day, and the log shows 43 records opened, including 3 with no link to the officer's work, one belonging to a neighbour. Those 3 entries are about 7% of the day's accesses (3 divided by 43) and would stand out in a pattern review.

Procedural fairness generally means the employee is told of the suspected breach and can respond. Without a legitimate work reason, the matter could lead to a Code of Conduct sanction and, where warranted, referral to police. The scenario is illustrative only and does not describe the ATO's specific procedures.

What taxpayers can do to protect their records

According to the ATO, its app sends real-time alerts when changes are made to an account and lets users lock it.

Anyone who believes their information has been mishandled can complain to the ATO first. If unhappy with the response, they can go to the Inspector-General of Taxation and Taxation Ombudsman, an office that already received 2,376 complaints in the six months to September 2026, up 74%.

The wider integrity push

Treasury is also consulting on proposed new ATO and Tax Practitioners Board powers against intermediary fraud and financial abuse. That is a proposal, not law, and comments close on 20 November.

Dates ahead: the ATO was listed to appear before Senate Estimates at 5pm and 7pm AEDT on 28 October, and self-lodgers face Monday 2 November because 31 October falls on a Saturday.