IDG43000 - Lawful disclosure: Disclosure with the customer's consent

describes the limited situations in which customer information may be disclosed outside HMRC.

One of these circumstances is where the customer who is the subject of the information consents to use of their information for that purpose. Section 18(2)(h) CRCA permits disclosures made:

‘with the consent of each person to whom the information relates’

The Data Protection Act 1998 (see IDG41400) further requires that consent should be

‘a positive indication of the wishes of the data subject’

It should also be freely given, fully informed and specific to the circumstances in which it is sought. The data subject (i.e. the customer) should also be able to withdraw their consent as easily as they give it.

When is a customer likely to consent to disclosure of their personal information?

It may sometimes be in the customer’s interest to disclose information about them to a third party. For example:

• a customer may wish to deal with the department through an agent, accountant or other representative. See IDG52000.
• passing a customer’s information to another government department may provide customer service benefits. See IDG44000.

Procedure to obtain consent

Consent will generally be provided in writing, but may also be verbal in certain limited circumstances.

Written consent

For most direct taxes, the standard way for a customer to provide consent is by completing and returning form 64-8. For VAT areas, guidance is forthcoming which will outline how the 64-8 is to be used for obtaining consent. However, until this guidance is issued (through usual VAT communication channels), please proceed as currently. Please ask your manager if you are unsure which form your business area uses to secure customer consent, or contact the Customer Consent Contact in the Small & Medium Enterprises and Employers customer unit (see IDG90100 for contact details).

All other ex-C&E regimes should continue with current procedures.

While using official forms is to be encouraged, written consent can be given in other ways, such as a letter. The written consent must identify:

• whom the customer gives HMRC consent to disclose information to, and
• the nature of the information to be disclosed.

In all cases the written consent must be signed by the customer. The signature should be original and not a photocopy. If you are unsure about whether the consent should still apply (for example because it is old), or if you are unsure about whether the consent applies to the information in question, please contact Information Strategy (see IDG90100).

Verbal consent

In some cases written consent cannot be obtained in a way convenient for all involved. This will generally be during a telephone conversation with a customer where they have another person with them who they want to speak on their behalf. In these rare cases, verbal consent may be accepted. You may only disclose in these cases when the below procedure is followed:

• the identity of the customer must be satisfactorily verified; and
• the customer must confirm that they are providing consent for HMRC to disclose information to a named party.

The representative must pass the normal security checks, so that they are verified satisfactorily, whoever they claim to be. For example the customer’s solicitor, agent, spouse, family member, friend, or member of voluntary advice service must all pass the checks.

• Verbal consent may only be accepted where it is known that the consent will be recorded using that office’s full automatic voice recording facilities. Generally such equipment is only used in Contact Centres. Recording in this way provides a comprehensive audit trail that can be retrieved and used in evidence in any subsequent cases of dispute.

The customer and the third party should be made aware that the verbal consent applies for the purpose of that single telephone conversation and that written consent must be provided if the third party wishes to act on the customer’s behalf on future occasions.

Full guidance on how to handle such telephone calls can be found on the Caller Verification part of the Customer Contact Standards and Procedures intranet site - (see IDG90150 for link).

Obtaining consent when in interviews with the customer and third party

There will be circumstances where you can anticipate the possibility of disclosing personal information. For example, during an interview with a customer and their spouse (or some other third party). To avoid any later disputes over whether consent was given you should start the interview by drawing attention to the likelihood of personal information being disclosed and should immediately obtain the customer’s written consent for this. This need not be on a form 64-8 and can simply be written as detailed above.

Obtaining consent where the customer is dead or, if a company, has been dissolved

If a customer has died but their Personal Representative wishes to give consent for the disclosure of HMRC information relating to the deceased, follow the procedure outlined at IDG34050 by which the Personal Representative acts on behalf of the deceased.

If the customer was a company and is in an insolvency process, follow the procedure at IDG54000 which permits the person handling the company’s affairs to give consent. If the company has been dissolved then there is no person able to give the company’s consent and so this method of disclosure cannot be used.

Information that should not be disclosed

HMRC is under no obligation to disclose every piece of information held. For example where disclosure would compromise an ongoing investigation you must not disclose. Seek further guidance from your manager if you are unsure.

Further guidance

For further guidance and assistance generally on confidentiality, contact Information Strategy (see IDG90100).