NMWM16120 - Disclosure of information: Data Protection Act: issues relevant to HM Revenue & Customs’ disclosures
The Data Protection Act (NMWM16110) has implications across many HM Revenue & Customs functions. Detailed guidance on all the implications for HM Revenue & Customs is on the Data Protection Act page. Guidance in this manual and the Information Disclosure Guide is solely concerned with the information sharing provisions of the Data Protection Act. Further information can also be found in the HM Revenue & Customs Information Disclosure Guide.
In terms of the disclosure of personal data there are some key factors to consider:
- disclosure is a form of processing and is therefore covered by the Act;
- disclosure (processing) of personal data must be fair and lawful.
The requirement that the processing be fair and lawful means that there must be a legal basis for making the disclosure, for example because the Commissioners for Revenue and Customs Act allows it (NMWM16030), or there is a legal gateway in place which supports it (NMWM16070).
In addition, the type and volume of personal data to be disclosed must be proportionate to the purpose for which it will be used. This latter requirement is difficult to define absolutely but essentially it means that a judgement must be made about whether it is reasonable to disclose the data considering what it will be used for (NMWM16130).
Requests for information under the Data Protection Act can only be met in specific circumstances (NMWM16130). Consult your line manager if you are in any doubt about whether to disclose information requested under the Data Protection Act.