1 The Information Commissioner s Office (ICO) response to Her Majesty s Revenue and Customs (HMRC) Consultation on Tackling Offshore Tax Evasion: A Requirement to Correct ( the Consultation ) The ICO has responsibility for promoting and enforcing the Data Protection Act 1998 (DPA), the Freedom of Information Act 2000 (FOIA), the Environmental Information Regulations 2004 (EIR) and the Privacy and Electronic Communications Regulations 2003 (PECR). We also deal with complaints under the Re-use of Public Sector Information Regulations 2015 (RPSI) and the INSPIRE Regulations 2009. We are independent from Government and uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals. The ICO does this by providing guidance to individuals and organisations, solving problems where we can, and taking appropriate action where the law is broken. Background The aim of this consultation is to introduce new legislation requiring any person who has undeclared tax liabilities in respect of an offshore interest to correct that situation by disclosing the relevant information to HMRC, with new sanctions for those who fail to correct (FTC). The ICO welcomes the opportunity to respond to this consultation. We have confined our comments to the aspects of the proposals that raise information rights issues. Chapter 5: The consequences of not correcting Penalties Models Chapter 5 of the consultation outlines two penalty models for those taxpayers who have failed to correct their offshore tax situation within the timeframe granted by HMRC (currently proposed as April 2017 September 2018). Both of the two models propose a sanction that taxpayers who fail to correct would be liable to have their details published. In section 5.10 of
2 the consultation, the proposal under Model 1 is described as Taxpayers who had failed to correct would also be liable to have their details published under rules similar to those at Section 94 FA [Finance Act, included at Annex A] 2009. In section 5.13 of the consultation, the proposal under Model 2 simply states FTC would be subject to publishing taxpayer details. The word details is not further defined in this consultation. Therefore, it is unclear from this consultation what the data fields being published in relation to taxpayer details will be. The DPA regulates the use of personal data. Personal data is defined in section 1 (1) of the DPA, and stated below: Personal data means data which relate to a living individual who can be identified (a) from those data, or (b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller, and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual. Based on the above broad definition, it is clear that many data fields held by HMRC about individual taxpayers for example the taxpayer s name, address, and tax reference number - will constitute personal data. As we state above, the details on taxpayers which HMRC propose to publish are not clearly defined. Section 94(4) of the Finance Act 2009, which Model 1 is similar to, does however list the data classes that can be published under an existing naming regime some of these data classes would constitute personal data. Therefore it is likely that the publication of such data would include personal data, and thus constitute processing under the DPA. Whenever personal data is being processed, the requirements of the DPA must be considered. The DPA does not act as a barrier to proposals such as the publication of tax evaders details, so long as sensible and appropriate safeguards are put in place. There must be a justifiable and proportionate balance between discharging HMRC s deterrence function and other factors such as the impact of the publication of personal data on individuals. Section 5.5 of the consultation document discusses five principles that should apply to all HMRC penalties, which have come out of a wider consultative piece of work that HMRC carried out last year 1. The first principle states: 1 https://www.gov.uk/government/consultations/hmrc-penalties-a-discussion-document
3 The penalty regime should be designed from the customer perspective, primarily to encourage compliance and prevent non-compliance [our emphasis]. The third principle states: Penalties must be applied fairly, ensuring that compliant customers are (and are seen to be) in a better position than the noncompliant [our emphasis]. It is clear that naming individuals for a deterrent effect is a penalty type to which these principles should apply. It is helpful to see that HMRC have already put thought into a principles-based penalties model generally, as the purpose and objective of any penalty should be established early on. For some individuals, there may be genuine privacy risks to their information being published via a naming regime depending on what data fields are involved. The Finance Act 2009 requires HMRC to afford an individual reasonable opportunity to make representations about whether their information should be published. At present only Model 1 links the publication penalty to Finance Act 2009 rules, and therefore its safeguards. We hope that a similar safeguard will be in place for the publication of taxpayers details under both penalty models proposed under the FTC regime. Before engaging in any processing of personal data for the purposes of naming taxpayers who have failed to correct, HMRC must ensure it has satisfied the relevant conditions for processing as set out in Schedule 2 - and if applicable Schedule 3 - of the DPA. Schedule 3 relates to the processing of sensitive personal data. The definition of sensitive personal data is broad, but does include information relating to the commission or alleged commission by an individual of any offence. HMRC will need to consider whether the naming of taxpayers under FTC would constitute processing of sensitive personal data. Notwithstanding valid schedule conditions, HMRC must also consider whether this processing would be fair and lawful and within the expectations of taxpayers, and if any exemptions to the requirements of the DPA may apply to the naming regime. There is no detail in this consultation as to how HMRC intend to carry out the publication of details of taxpayers who have failed to correct. Consideration should be given to the amount of time the information would remain in the public domain and how this could be justified in relation to the purpose of the publishing. We note that Section 94(8) and (9) of the Finance Act 2009 prescribe specific time limits in relation to publication; this may be an example for HMRC to consider in relation to publication under FTC. We would welcome similarly prescriptive and specific time limits in the legislation drafted following this consultation.
4 HMRC should also consider the format in which the information would be published, and whether their choice of format facilitates the potential for third parties to attempt to re-use the data for other purposes. HMRC should ensure that the information it publishes is disambiguated, i.e. that it clearly identifies the specific individual who failed to correct and minimises the risk of incorrect identification of others. HMRC should also consider the inclusion of a facility to report errors and a process for withdrawal of information in a timely manner when errors are validly reported. If not already done, the ICO suggest that HMRC considers at an early stage whether it needs to carry out a Privacy Impact Assessment (PIA) 2 whenever a proposal includes the publication of individuals personal data. Reasonable Excuse and Ensuring Requirement T0 Correct Awareness One issue of concern is whether individuals are given true opportunity to rectify their tax affairs, and if all those who fail to correct will automatically be classified as tax evaders. There is a real risk that individuals could suffer tangible adverse effects if incorrectly named as a tax evader. HMRC have provided an example in the consultation document of how such inadvertent classification as an evader can happen, whereby offshore tax schemes can include tax structures which were compliant when they were set up but are not now ( ) [Taxpayers] may not yet have engaged with the need to review their affairs and disclose any tax irregularities. The ICO welcome HMRC s statement that there should be no penalty if the taxpayer has a reasonable excuse for not having met the obligation to correct in the defined time period. We are keen that HMRC bear in mind the need to balance its legitimate objective of reducing tax evasion with individuals expectations of how their data might be used to achieve this, including publishing their data in order to identify such individuals as evaders. To achieve this HMRC should ensure that the Requirement To Correct window, and the risks of failing to correct, are widely publicised. Section 5.8 of the consultation document states that HMRC are considering what issues should be included within the definition of a reasonable excuse and expect that given the considerable publicity concerning offshore tax this would be rare. HMRC should ensure that this publicity is as effective as 2 See ICO guidance for more information on PIAs and privacy by design: https://ico.org.uk/for-organisations/guide-to-data-protection/privacy-by-design/
5 possible in reaching those taxpayers, and their advisors, who have offshore tax situations. It is not for the ICO to prescriptively define what format this might take. However efforts made by HMRC to make taxpayers aware of the potential for publication of their details will make it likelier that such publication will be within taxpayers expectations and thus less likely to lead to distress and data protection-related complaints. 13 October 2016
6 Annex A Finance Act 2009 Section 94 - Publishing details of deliberate tax defaulters (1) The Commissioners may publish information about any person if (a) in consequence of an investigation conducted by the Commissioners, one or more relevant tax penalties is found to have been incurred by the person, and (b) the potential lost revenue in relation to the penalty (or the aggregate of the potential lost revenue in relation to each of the penalties) exceeds 25,000. (2) A relevant tax penalty is (a) a penalty under paragraph 1 of Schedule 24 to FA 2007 (inaccuracy in taxpayer's document) in respect of a deliberate inaccuracy on the part of the person, (b) a penalty under paragraph 1A of that Schedule (inaccuracy in taxpayer's document attributable to deliberate supply of false information or deliberate withholding of information by person), (c) a penalty under paragraph 1 of Schedule 41 to FA 2008 (failure to notify) in respect of a deliberate failure on the part of the person, or (d) a penalty under paragraph 2 (unauthorised VAT invoice), 3 (putting product to use attracting higher duty etc) or 4 (handling goods subject to unpaid excise duty) of that Schedule in respect of deliberate action by the person. (3) Potential lost revenue, in relation to a penalty, has the meaning given by (a) paragraphs 5 to 8 of Schedule 24 to FA 2007, or (b) paragraphs 7 to 11 of Schedule 41 to FA 2008, in relation to the inaccuracy, failure or action to which the penalty relates. (4) The information that may be published is (a) the person's name (including any trading name, previous name or pseudonym),
7 (b) the person's address (or registered office), (c) the nature of any business carried on by the person, (d) the amount of the penalty or penalties and the potential lost revenue in relation to the penalty (or the aggregate of the potential lost revenue in relation to each of the penalties), (e) the periods or times to which the inaccuracy, failure or action giving rise to the penalty (or any of the penalties) relates, and (f) any such other information as the Commissioners consider it appropriate to publish in order to make clear the person's identity. (5) The information may be published in any manner that the Commissioners consider appropriate. (6) Before publishing any information the Commissioners must (a) inform the person that they are considering doing so, and (b) afford the person reasonable opportunity to make representations about whether it should be published. (7) No information may be published before the day when the penalty becomes final (or the latest day when any of the penalties becomes final). (8) No information may be published for the first time after the end of the period of one year beginning with that day (or that latest day). (9) No information may be published (or continue to be published) after the end of the period of one year beginning with the day on which it is first published. (10) No information may be published if the amount of the penalty is reduced under (a) paragraph 10 of Schedule 24 to FA 2007, or (b) paragraph 13 of Schedule 41 to FA 2008, (reductions for disclosure) to the full extent permitted. (11)For the purposes of this section a penalty becomes final (a) if it has been assessed, when the time for any appeal or further appeal relating to it expires or, if later, any appeal or final appeal relating to it is finally determined, or
8 (b) if a contract is made between the Commissioners and the person under which the Commissioners undertake not to assess the penalty or (if it has been assessed) not to take proceedings to recover it, at the time when the contract is made. (12) The Treasury may by order vary the amount for the time being specified in subsection (1). (13) This section comes into force on a day appointed by order made by the Treasury. (14) Orders under this section are to be made by statutory instrument. (15) A statutory instrument containing an order under subsection (12) is subject to annulment in pursuance of a resolution of the House of Commons. (16) In this section the Commissioners means the Commissioners for Her Majesty's Revenue and Customs.