IDG40500 - Legal obligations on information use imposed by the Commissioners for Revenue and Customs Act (CRCA) 2005: Disclosure with lawful authority under the CRCA

Background

Your ability to disclose HMRC information to anyone is restricted by the Commissioners for Revenue and Customs Act 2005 (CRCA). Only by acting in accordance with the provisions of CRCA are you using HMRC information in a lawful way. Sharing information with anyone in a way that is not covered by the CRCA means you may personally be liable to a criminal sanction (see IDG40750).

What is the CRCA?

The CRCA is the Act of Parliament that created HM Revenue and Customs in April 2005. The legislation applies to all HMRC officers, whether they were former Inland Revenue or former Customs and Excise staff. The CRCA replaces former legislation on information sharing between the two predecessor departments such as Section 127 Finance Act 1972. It also applies to all information in the new department, even information gathered prior to April 2005. The use of existing statutory gateways remains unaltered.

What does the CRCA say about information sharing?

The CRCA sets out what use HMRC may make of its information and the specific circumstances when we may disclose that information.

Section 18 of CRCA makes clear that you must not give (‘disclose’) HMRC information to anyone, unless you have lawful authority to do so. This includes Other Government Departments and their agencies, local authorities, the police or any other public bodies.

Sections 17, 18 and 20 define when a HMRC member of staff has lawful authority to disclose information. These situations are outlined below.

Information sharing lawfully permitted under CRCA

Sharing information within HMRC is permitted by section 17. See IDG25000.

Disclosing information to persons outside HMRC is permitted in certain limited circumstances detailed below:

• For the purposes of HMRC’s functions. An example is where it is necessary to advise a bailiff of a taxpayer’s name and address in order that the bailiff can enforce collection of overdue tax. See IDG47000.
• Where the person or organisation that the information is about has given their consent, see IDG43000. An example could be a taxpayer who provides authorisation for an agent, accountant or other third party to receive confidential information.
• Where the duty of confidentiality is specifically overridden by legislation that permits the disclosure of information to a particular third party. These are often known as ‘legal’ or ‘information’ ‘gateways’. See IDG44000.
• Where HMRC receives a court order that is binding on the Crown which instructs HMRC to disclose information. See IDG45050.
• Where disclosure is made for the purposes of a prosecution being pursued by HMRC. See IDG67750.
• Where disclosure is in the public interest. See IDG46050.
• Disclosure to the relevant prosecuting authorities. See IDG67750.

Necessity and proportionality

Where a lawful method of disclosure is identified care must still be taken to ensure any information disclosed via that method meets the tests of necessity and proportionality in the Human Rights Act and the Data Protection Act. See IDG41050 and IDG41400.

Wrongful disclosure of information

Section 19 of the CRCA makes it a criminal offence for HMRC officers who deliberately disclosure HMRC information in a way that is not lawful. In addition to the department taking disciplinary action, the offence carries a maximum penalty of imprisonment for two years, an unlimited fine or both. Please read IDG40750.

Is verifying information that someone already holds a disclosure?

Yes. Even though someone may already hold information, if they ask HMRC to verify whether that information is correct, HMRC is still making a disclosure of information that is protected by HMRC’s duty of confidentiality. This means you should not verify information unless there is lawful authority for you to do so (see the bullets above regarding disclosing information to persons outside HMRC).

There are, however, situations where it is important to verify information held, such as VAT details or National Insurance Numbers. See IDG47100 for further guidance on how disclosure can be made in these situations.

Equally there can be situations where you must ensure you neither confirm nor deny information that may be presented to you, i.e. you should make no disclosure at all, for example where a journalist asks Press Office to confirm the veracity of a story in the press about someone’s personal tax affairs. See HMRC’s ‘Neither confirm nor deny policy’ regarding human intelligence sources.

Further guidance

For further guidance and assistance generally on confidentiality, contact Information Strategy (see IDG90100).