IDG40420 - Sharing information outside of HMRC: disclosure for HMRC’s functions: disclosing anonymous information

Fully anonymised customer information (where there is no possibility of a third party correctly identifying the customer from the information disclosed, or deducing a customer's identity from the information) does not attract the criminal sanction for wrongful disclosure, and the act of disclosure is not subject to the Data Protection Act and GDPR 2018 (see IDG40160) and the Human Rights Act (see IDG40140). 

It is important however to consider whether a person’s identity could be deduced by a third party by using other information available to them, for example what is already in the public domain. If there is a likely risk of re-identification then it may not be appropriate to disclose. Please speak to your Security and Information Business Partner , or the Information Disclosure and Policy team for further guidance. 

Even where the information is fully anonymised, disclosure requires a valid legal basis. S.74 of the Digital Economy Act 2017 provides a legal gateway for disclosing non identifying information where a HMRC official considers there is a public interest to do so; please see IDG55500. You may also be able to disclose anonymised information for the purpose of HMRC’s functions. The methodology and factors to be taken into account to determine whether the functions basis can be relied upon is the same as set out at IDG40410.

HMRC publishes a range of aggregate, anonymised and other data that does not identify individual customers or enable their identity to be deduced (for example, aggregate tax receipts) for the purposes of its functions. These publications increase public understanding of, and confidence in, the tax system and hence will increase the amount of tax collected. Examples are listed below:

Examples

Publishing statistics or guidance

In the course of their normal duties, HMRC officers will regularly disclose administrative information (for example, about HMRC processes) or information drawn from customer data, which has been sufficiently anonymised so that the identity of individuals cannot be deduced.

This includes material published on HMRC’s internet site, general guidance given in telephone conversations, policy issues discussed in meetings with representative bodies, and statistics included in annual reports or published as National Statistics. The identity of the customer cannot be deduced from the information and the disclosure supports the functions of HMRC.

Case studies

Information may also be lawfully disclosed where it is necessary to include specific case details to carry out a function of HMRC but the customer identity can readily be anonymised. For example, referring to case studies in publicity and guidance material, or providing information to overseas authorities about trends in smuggling. It is important in such cases that the information provided is not sufficient to enable the identity of any customer(s) to be deduced.