Impact assessment

Safeguarding customer data programme: initial equality impact assessment

Published 17 November 2021

Project objectives

1. We will implement Multi-Factor Authentication (MFA) and Identity Verification (IDV) as 2 mandatory steps when a customer or organisation accesses Online Tax Registration Service (OTRS) or 29 KANA forms online.

2. For businesses and organisations only, we will implement MFA on 65 online services.

3. We will implement an enhancement to the National Insurance and PAYE Service (NPS) so that online tax registration request (via OTRS or SA1 and CWF1 online short-forms) will be checked for new addresses. If a new address is detected, the submission will be rejected, and the customer will be asked to update their address in their Personal Tax Account (PTA) first and then resubmit

Customer groups affected

All customers who register for Self Assessment tax, Corporation Tax (CT), PAYE or Machine Gaming Duty online or who use one of the 29 online short-forms (KANA) will see a change to the way they log in to OTRS or KANA online. Each customer will be asked to verify their identity using one of the available evidences/forms of ID.

Estimated between 2% to 5% of those customers may have difficulty verifying their identity online if their personal information is not known or not available.

Businesses and organisations that access one of the 65 services in scope for MFA will need to set up and pass MFA the next time they log in.

What customers will need to do

What customers need to do as a result of the change

Customers registering for tax via the OTRS or who use any of the 29 KANA forms will now need to first log into their Government Gateway account and then verify their identity online using one of six possible evidences/forms of ID.

Customers who are not already registered for MFA will need to register a device and set up MFA to receive access codes when accessing OTRS or any of the 29 KANA forms.

Businesses and Organisations who are not already registered for Multi Factor Authentication (MFA) will need to register a device and set up MFA to receive access codes when accessing one of the 65 services in scope.

If a new address is detected on a tax registration request via the OTRS the customer will be asked to update the address in their personal or business tax account.

How customers will access this service

Customers will continue to access these services online. Customers who are unable to verify their identity online may need to revert to paper or telephone transactions with HMRC

When customers need to do this

Change one (OTRS and KANA forms) first takes effect on 15 June 2021 (OTRS and two KANA forms only). The changes to the remaining 27 KANA forms take effect from 5 July 2021.

Change 2 (MFA roll out for businesses and organisations) will be gradually rolled out between July and November 2021.

Change 3 (NPS enhancement) will take effect from 23 June 2021.

Assessing the impact

We assessed the equality impacts on all the protected characteristic groups in line with the Equality Act and Public Sector Equality Duty and section 75 of the Northern Ireland Act:

• racial groups
• disabled and not disabled
• gender
• sexual orientation
• religion or belief
• pregnancy and maternity
• marriage and civil partnership
• carers
• political opinion (for Northern Ireland only)
• people who use different languages (Including Welsh Language and British Sign Language)

It is not anticipated that there will be any specific impacts on customers within the protected characteristic groups listed above. Customers who require extra support can contact HMRC via the Online Services Helpdesk 0300 200 3600 or speak to one of HMRC’s webchat advisers.

The following equality impacts have been identified.

Gender reassignment

Impact on customers

Customers who have recently undergone or are currently undergoing gender reassignment may have difficulty verifying their identity if their employment record, passport, Self Assessment record, tax credits record or Northern Ireland driving licence have not been updated to reflect their identity.

It is difficult to determine the specific impacts as it will vary between customers. Factors that will determine the impact, if any, are:

• if and when a person changes their identity as part of gender reassignment
• if and when a person updates their personal identification records, such as passport, Northern Ireland driving licence, employment records etc.

Proposed mitigation

None, however, we will monitor call and postal requests to remain aware of any immediate impacts on this customer group.

Age

Impact on customers

Customers aged 20 or younger may have difficulty verifying their identity online if they:

• are still in school/full time education so would not have pay slips to use
• have no Self Assessment record
• have no credit history/record
• have no tax credit history as they now have to apply for Universal Credit
• do not have a driving licence (Northern Ireland driving licences only)

Customers aged 60 or older may also have difficulty verifying their identity online if they:

• have limited digital skills or reduced digital footprint
• have no self-assessment record
• have no recent employment record
• have no credit history/record
• do not have a driving licence (Northern Ireland driving licences only)
• have no passport

Proposed mitigation

We will:

1. redeploy resources to meet the additional demand in phone and postal requests
2. review internal guidance to make sure our staff have the right information to support customers
3. update online pages to tell customers what to do if they have trouble verifying their identity
4. communicate to agents what changes they may see
5. communicate to our internal call and post handling teams to let them know what is changing and what impact this will have on the customer
6. communicate the changes to our complaints teams

Opportunities to promote equalities

We have considered opportunities to promote equalities and good relations between people in each of the protected characteristic groups and those outside of that group and none were identified.

A full equality impact assessment is not recommended.