IDG40120 - Sharing information outside of HMRC: legal obligations: lawful disclosure under section 18 CRCA
Background
What is the CRCA?
What does the CRCA say about information sharing?
Information sharing lawfully permitted under CRCA
Necessity and proportionality
Wrongful disclosure of information
Is verifying information that someone already holds a disclosure?
Further guidance
Background
Your ability to disclose HMRC information to anyone is restricted by the Commissioners for Revenue and Customs Act 2005 (CRCA). Only by acting in accordance with the provisions of CRCA are you using HMRC information in a lawful way. Sharing information with anyone in a way that is not covered by the CRCA means you may personally be liable to a criminal sanction (see IDG40100).
HMRC declaration of confidentiality (all HMRC staff) (PDF 51 KB)
What is the CRCA?
The CRCA is the Act of Parliament that created HM Revenue and Customs in April 2005. The legislation applies to all HMRC officers, whether they were former Inland Revenue or former Customs and Excise staff. The CRCA replaces former legislation on information sharing between the two predecessor departments such as Section 127 Finance Act 1972. It also applies to all information in the new department, even information gathered prior to April 2005. The use of existing statutory gateways remains unaltered.
What does the CRCA say about information sharing?
The CRCA sets out what use HMRC may make of its information and the specific circumstances when we may disclose that information.
Section 18 of CRCA makes clear that you must not give (‘disclose’) HMRC information to anyone, unless you have lawful authority to do so. This includes Other Government Departments and their agencies, local authorities, the police or any other public bodies.
Sections 17, 18 and 20 define when a HMRC member of staff has lawful authority to disclose information. These situations are outlined below.
Information sharing lawfully permitted under CRCA
Sharing information within HMRC is permitted by section 17. See IDG20000.
Disclosing information to persons outside HMRC is permitted in certain limited circumstances detailed below:
- For the purposes of HMRC’s functions. An example is where it is necessary to advise a bailiff of a taxpayer’s name and address in order that the bailiff can enforce collection of overdue tax. See IDG40400.
- Where the person or organisation that the information is about has given their consent, see IDG40310. An example could be a taxpayer who provides authorisation for an agent, accountant or other third party to receive confidential information.
- Where the duty of confidentiality is specifically overridden by legislation that permits the disclosure of information to a particular third party. These are often known as ‘legal’ or ‘information’ ‘gateways’. See IDG40320.
- Where HMRC receives a court order that is binding on the Crown which instructs HMRC to disclose information. See IDG40510.
- Where disclosure is made for the purposes of a prosecution being pursued by HMRC. See IDG54300.
- Where disclosure is in the public interest. See IDG60000.
- Disclosure to the relevant prosecuting authorities. See IDG54300.
Necessity and proportionality
Where a lawful method of disclosure is identified care must still be taken to ensure any information disclosed via that method meets the tests of necessity and proportionality in the Human Rights Act and the Data Protection Act. See IDG40140 and IDG40160.
Wrongful disclosure of information
Section 19 of the CRCA makes it a criminal offence for HMRC officers who deliberately disclosure HMRC information in a way that is not lawful. In addition to the department taking disciplinary action, the offence carries a maximum penalty of imprisonment for two years, an unlimited fine or both. Please read IDG40130.
Is verifying information that someone already holds a disclosure?
Yes. Even though someone may already hold information, if they ask HMRC to verify whether that information is correct, HMRC is still making a disclosure of information that is protected by HMRC’s duty of confidentiality. This means you should not verify information unless there is lawful authority for you to do so (see the bullets above regarding disclosing information to persons outside HMRC).
There are, however, situations where it is important to verify information held, such as VAT details or National Insurance Numbers. See IDG40400 for further guidance on how disclosure can be made in these situations.
Equally there can be situations where you must ensure you neither confirm nor deny information that may be presented to you, i.e. you should make no disclosure at all, for example where a journalist asks Press Office to confirm the veracity of a story in the press about someone’s personal tax affairs. See HMRC’s ‘Neither confirm nor deny policy’regarding human intelligence sources.
Further guidance
For further guidance and assistance generally on confidentiality please contact your Security & Information Business Partner (SIBP).