The High Court considered a claim that HMRC breached the subject access rights (SAR) of the claimant under the UK General Data Protection Regulation, or GDPR.
Background:
Mr. Ashley brought a claim against HMRC for breach of his SARs under the UK GDPR. The SAR was made in the context of a (then) ongoing tax dispute. He sought to access his personal data as processed by HMRC in connection with its inquiry into his tax return for the 2011/12 tax year. The inquiry was conducted by the defendant's Wealthy and Mid-size Business Compliance Department (WMBC).
Following the inquiry, HMRC issued a Closure Notice under s.28A of the Taxes Management Act (TMA) 1970, concluding that the properties had been sold by the claimant at an overvalue, meaning he had obtained a taxable benefit, giving rise to a tax liability of c.£13.6 million. On 23 November 2016, the claimant appealed against the Closure Notice. On 8 December 2016, the appeal against the Closure Notice was acknowledged and the tax due was postponed. The parties then entered into discussion, and the Closure Notice was withdrawn on 21 October 2022.
In September 2022, Mr. Ashley made the SAR request under Article 15 to which HMRC responded in December 2022, refusing to disclose any copies of the claimant's personal data as held. In November 2023, Mr. Ashley wrote to HMRC expressing an intention to commence proceedings. HMRC delayed answering and the claimant started the claim in January 2024.
Decision:
The High Court first noted that HMRC is a data controller, within the meaning of Article 4 of the UK GDPR, in respect of personal data. Mrs. Justice Heather Williams found in Mr. Ashley's favour on each of the points he raised. However, she rejected the wider argument that all data relating to HMRC's assessment amount to his personal data.
The Court confirmed that the Court of Justice of the European Union's ruling in FF is still applicable and that HMRC's obligation under Article 15 is to provide a copy of the personal data. As was held in FF, “the obligation to supply additional contextual data will only apply where this is “necessary” to ensure that the provision of the data subject's personal data is intelligible so that they are able to exercise the rights conferred by the UK GDPR effectively.” By not adopting such an approach, HMRC was in breach of its duty. Mrs. Justice Heather Williams noted that HMRC “has currently adopted too narrow an approach to what amounts to the claimant's ‘personal data'.”
The Court even provided guidance for future cases by concluding that “it is unlikely that providing an extract that simply comprises the claimant's name or his initials or other entirely decontextualised personal data of that sort, will amount to compliance with this obligation (unless there is a proper basis, such as the application of a prescribed exemption or overriding third party rights, for withholding the additional data).” She also noted that “The sheer fact that the claimant understood the nature of the enquiry and the issues that it was directed to, does not mean that a particular extract of his personal data, denuded of its proper context, was intelligible to him.”
The High Court ultimately concluded that HMRC would need to reconsider its response to the SAR and anticipated that further data would need to be disclosed.
Implications:
This judgement contains a thorough guideline on the interaction of SARs within the context of tax assessment. It also provides guidance for future cases on what is necessary for compliance with the obligation. It also reiterated the need to comply promptly with SARs and the potential legal risks when failing to do so.
The case also underscores the difficulty an organisation with multiple departments can face in handling SARs. It also highlights the difficulty in applying the concept of ‘personal data' within a tax inquiry context.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
