Interactive Brokers Australia

Numbered sections, dated version header, and a contact path exist, but the policy has no table of contents, no plain-language commitment, and no introductory summary of commitments. Most materially, the policy is distributed only as a PDF inside the IBKR onboarding flow — APP 1.4 expects the policy to be freely available, and §12 of the policy itself promises website publication that does not match observed distribution.

No specific findings.

Purposes stated: legal/regulatory compliance (AML/CTF, Corporations Act, FATCA), eligibility determination, identity verification, service improvement, and unauthorised-activity monitoring. Silent on marketing use — neither asserted nor disclaimed. No explicit purpose-limitation commitment beyond the stated purposes.

No specific findings.

Document carries a version code ('3311') and date (13 November 2025). §12 reserves right to revise 'from time to time for any reason' and to upload to the website. No review cadence, no changelog, no commitment to notify users of changes. A 'Complaints Officer' exists; no Privacy Officer is named.

No specific findings.

Strong itemisation: names, addresses, DOB, email, phone, TFN, passport, driver's licence, marital and employment status, annual income, net worth, trading history, investment objectives, deposit/transfer information. Sources also disclosed (directly from client, public registers, government databases, information aggregators). Sensitive-information handling not explicitly flagged (TFN handled implicitly), and automated-collection detail limited to a brief cookies mention.

No specific findings.

Categories of recipients enumerated clearly — IB Group affiliates, other financial institutions and sub-custodians, external consulting/legal/audit firms, regulators and government bodies in Australia and abroad, professional verification firms, and courts. No specific third parties named. No clause stating recipients are contractually bound to equivalent privacy obligations.

No specific findings.

Only the breach-notification commitment is disclosed (§8, aligned with the NDB scheme). No mention of encryption (in transit or at rest), no access controls or authentication practices, no security certifications or standards, no staff training, no audit cadence. Notably thin for a broker holding TFNs, passport numbers, and trading history.

No specific findings.

Acknowledges overseas storage in §2 — 'inside and outside of Australia in places where we maintain electronic storage facilities.' Does not name any country or region, does not describe safeguards, SCCs, BCRs, or any contractual mechanism. For a US-headquartered group operating globally, this is the thinnest possible APP 8 disclosure.

No specific findings.

Access right disclosed (§11). Implicit correction obligation via the client agreement. OAIC complaint pathway disclosed with full contact details. Response timeframe of 30 days stated, with 1 business day acknowledgment for complaints. No deletion right addressed at all (which AML/CTF retention does not excuse mentioning). No marketing opt-out — consistent with the silence on marketing in purpose limitation.

No specific findings.

Mentions electronic matching of identity against government records, with a manual-verification fallback if electronic checks fail — providing a partial human-review path. No disclosure of AI or machine-learning use, no breakdown of decision types, no logic transparency, no opt-out. Not aligned with the December 2026 Privacy Act ADM-transparency reforms.

No specific findings.

Not addressed in any section. Product context (regulated brokerage, adults-only by AFSL requirement) reduces relevance, but the policy contains no statement to that effect either.

No specific findings.