Decision Letter.

OFFICIAL:Sensitive

Reply to: GPO Box 4889 SYDNEY NSW 2001

Australian Government
Australian Taxation Office

Right to Know

By email only to: foi+request-14913-16adb62f@righttoknow.org.au

Our reference: FOI-2026-00715
Contact officer: Joseph B
Email: foi@ato.gov.au
Date: 3 July 2026

## Decision regarding your Freedom of Information request

Dear Applicant,

The purpose of this letter is to give you a decision about access to documents that you requested under the Freedom of Information Act 1982 (FOI Act).

### Summary

I am an officer authorised under subsection 23(1) of the FOI Act to make decisions in relation to FOI requests.

On 4 June 2026, you requested access to the following documents:

Software Bill of Material (SBOM) artifacts for the myID Android application – the version that was current at the date of my access request (June 4, 2026)

### Decision

I have decided to refuse you access under section 24A of the FOI Act on the basis that documents responsive to your request cannot be found or do not exist.

### Material taken into account

I have taken the following material into account in making my decision:

- the terms of your request
- consultation with the ATO's Digital Identity Services (DIS) business area
- the FOI Act
- the guidelines issued by the Australian Information Commissioner under section 93A of the FOI Act (the FOI guidelines)

### Reasons for decision

Section 24A – Documents cannot be located or does not exist

Subsection 24A(1) of the FOI Act provides that an agency may refuse a request for access to a document if all reasonable steps have been taken to find the document, and the agency is satisfied that either the document is in the agency's possession but cannot be found or the document does not exist. I

OFFICIAL:Sensitive

1

OFFICIAL:Sensitive

have considered paragraphs 3.142 – 3.161 of the FOI guidelines, which provide guidance as to the meaning of 'all reasonable steps' in the context of subsection 24A(1).

In response to your FOI request, my colleague Joseph B contacted the ATO's Enterprise Solutions and Technology (EST) business area and requested that officers from EST conduct a reasonable search of all relevant ATO computer systems and files that may contain documents within the scope of your request. Following this, EST directed the search request to the DIS business area within EST, being the most appropriate area within EST to conduct searches as DIS is responsible for maintaining the myID platform.

I understand that you are seeking the version of SBOM artifacts for the myID Android application current as at 4 June 2026. After consultation with DIS, I have been advised that information held by the ATO's systems reflect only the current state of the platform as at the date it is extracted and that point in time historical snapshots in a consolidated SBOM form are not maintained. Therefore, the information you have requested as at 4 June 2026 does not exist and cannot be retrieved. As such, there is no discrete document which responds to the scope of your request.

I am therefore satisfied that all reasonable steps have been taken to find a document responsive to the terms of your request and that such a document cannot be found, or does not exist. Accordingly, I have refused your request for access pursuant to subsection 24A(1) of the FOI Act.

### **Your review rights**

If you are dissatisfied with my decision, you may apply for internal review or Australian Information Commissioner review of the decision. We encourage you to seek internal review as a first step as it may provide a more rapid resolution of your concerns.

### ***Internal review***

Under section 54 of the FOI Act, you may apply in writing to the ATO for an internal review of my decision. The internal review application must be made within 30 days of the date of this letter, quoting our reference number at the top of this letter, and be lodged in one of the following ways:

- email: FOI@ato.gov.au
- post: Australian Taxation Office, Office of General Counsel, GPO Box 4889, Sydney NSW 2001.

Where possible please attach reasons why you believe review of the decision is necessary.

The internal review will be carried out by another officer within 30 days. If you have not been informed of the outcome of the review within that time, you may apply to the Australian Information Commissioner under section 54L of the FOI Act.

### ***Australian Information Commissioner review***

Under section 54L of the FOI Act, you may apply to the Office of the Australian Information Commissioner (OAIC) to review my decision. An application for review by the OAIC must be made in writing within 60 days of the date of this letter, and be lodged in one of the following ways:

- online: https://webform.oaic.gov.au/prod?entitytype=ICReview&layoutcode=ICReviewWF
- email: foidr@oaic.gov.au
- post: GPO Box 5288, Sydney NSW 2001

Visit the OAIC website, https://www.oaic.gov.au/freedom-of-information/your-freedom-of-information-rights/freedom-of-information-reviews/information-commissioner-review, for more information about Australian Information Commissioner review.

OFFICIAL:Sensitive

2

OFFICIAL:Sensitive

# Complaints

Any complaint about the processing of your FOI request can be forwarded to the OAIC. The complaint needs to be in writing and identify the agency against which the complaint is made. There is no particular form required to make a complaint, however using the online form is preferable.

online: https://webform.oaic.gov.au/prod?entitytype=Complaint&layoutcode=FOIComplaintWF
email: foidr@oaic.gov.au
post: GPO Box 5288, Sydney NSW 2001

The OAIC can be contacted on 1300 363 992.

# Questions about this decision

If you have any questions, please email foi@ato.gov.au.

Yours sincerely

Tracy B

Senior Lawyer

Office of General Counsel

Australian Taxation Office

OFFICIAL:Sensitive

3