What does section 22 of the Commissioners for Revenue and Customs Act 2005 do?

Section 22 provides that HMRC's powers to disclose information under sections 17 to 21 are always subject to data protection legislation and the Investigatory Powers Act 2016. No disclosure is permitted if it would breach data protection law or the rules governing interception of communications, ensuring taxpayer privacy is protected.

How does data protection law restrict HMRC's information-sharing powers?

Any disclosure of personal data by HMRC must comply with the data protection legislation as defined in the Data Protection Act 2018, including the UK GDPR. This means HMRC must observe the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, and security whenever sharing taxpayer information with other bodies.

What role does the Investigatory Powers Act 2016 play in limiting HMRC disclosures?

The Investigatory Powers Act 2016 governs the interception of communications, equipment interference, and acquisition of communications data. Section 22 prevents HMRC from disclosing information if doing so would breach Parts 1 to 7 or Chapter 1 of Part 9 of that Act, protecting material obtained through surveillance activities.

What is the practical effect of section 22 for accountants and taxpayers?

Section 22 reassures accountants and taxpayers that even where HMRC has broad information-sharing powers, those powers are always limited by data protection and privacy safeguards. HMRC cannot share client data in a way that breaches the UK GDPR or intercepted communications rules, ensuring full legal compliance.

Commissioners for Revenue and Customs Act 2005 section 22

Data protection, etc.

Section 22 confirms that the disclosure powers granted to HMRC under sections 17 to 21 of the Act are always subject to data protection law and the rules on interception of communications.

The various permissions for HMRC to disclose information (set out in sections 17 to 21) do not override data protection law or surveillance and interception rules.
No disclosure is permitted if it would breach the data protection legislation as defined in the Data Protection Act 2018.
No disclosure is permitted if it would be prohibited under the Investigatory Powers Act 2016, which governs the interception of communications, equipment interference, and the acquisition of communications data.
This section acts as a safeguard ensuring that taxpayer information shared by HMRC always complies with wider privacy and data protection obligations.

Access full legislation.And much more.

By becoming a member, your team gets full access to Tax World research tools and source-backed tax resources.

Become a member