Although people may not be using HMRC services directly, the tax authority can still collect individuals’ data through tax advisers and Making Tax Digital software
HMRC only monitors transactions, which show how people interact with its services, when individuals are signed in however data can still be tracked when individuals are not necessarily signed into services themselves.
For example, personal data can be collected when a tax adviser is signed in on an individual’s behalf, when an employer pays income tax via PAYE or when Making Tax Digital software is used to record business records.
The tax authority collects data on:
- computers, phones or devices used;
- internet connections used;
- what individuals do on HMRC’s services; and
- what individuals tell HMRC.
When individuals sign in to one of HMRC’s services it creates unique identifiers in the browser, application or device being using. HMRC also gives a transaction monitoring cookie which it uses to help recognise and individual and link them to their account.
The information collected includes:
- unique identifiers;
- browser type and settings;
- device type and settings;
- operating system;
- mobile network information including carrier name and phone number; and
- application version number.
HMRC also collects information about the interaction of individuals’ apps, software, browsers and devices with our services, including the IP address, date and time and referrer URL of the request.
This information is collected by HMRC to improve the security of its services by detecting, preventing and responding to fraud, abuse, security risks and technical issues.
When crime is detecting personal data may be shared with third parties.
Personal data on HMRC’s transaction monitoring records is kept for six years plus the current year.[1]
[1] Produced from Croner-i