This might also interest you...

Data Protection: Voicing our Concerns

28 Jun 2018


Privacy campaigners have said that the voices of millions of taxpayers have been analysed and stored by HM Revenue and Customs (HMRC) without consent.


It is alleged HMRC's Voice ID system has collected 5.1 million audio signatures. The Voice ID scheme, which was launched last year, asks callers to repeat the phrase "my voice is my password" to register.Once this task is complete, they can use the phrase to confirm their identity when managing their taxes.


The Information Commissioner's Office (ICO) says it is now following up complaints about the service.


However, HMRC says the data is held securely, this process helps speed up security procedures and improves access to its digital services.


Big Brother Watch said taxpayers were being "railroaded into a mass ID scheme", as they were not given the choice to opt out. They have also accused HMRC of creating "biometric ID cards by the back door".


Silkie Carlo, director of Big Brother Watch stated;


 "These voice IDs could allow ordinary citizens to be identified by government agencies across other areas of their private lives."


A HMRC spokesperson said the Voice ID system was "very popular with customers". HMRC sources also told the BBC that identifying details were stored separately from the voice recordings.

Data Breach?


The General Data Protection Regulation (GDPR), which came into force on 25th May 2018 refers to sensitive personal data as “special categories of personal data” (see Article 9).


The special categories specifically include genetic data, and biometric data where processed to uniquely identify an individual.


In order to lawfully process special category data, businesses must identify both a lawful basis under Article 6 and a separate condition for processing special category data under Article 9. Businesses also need to read these alongside the Data Protection Act 2018, which adds more specific conditions and safeguards in relation to this type of data.


HMRC need to be clear which lawful basis and specific conditions they have identified for processing the voices of 5.1 million tax payers if consent has not been obtained.


If your business needs assistance with data protection practices in order to avoid falling foul of the new Regulations, please do not hesitate the Regulation Team at Short Richardson & Forth on 0191 232 0283 or at

Share on Facebook
Share on Twitter
Please reload

Please reload

  • FB
  • Twitter
  • LinkedIn
  • Youtube

Short Richardson & Forth, 4 Mosley Street, Newcastle upon Tyne, NE1 1DE

Tel: +44 (0)191 232 0283  ·  Email:


Short Richardson and Forth Solicitors Limited is a private limited company registered in England and Wales under company number 10572065, authorised and regulated by the Solicitors Regulation Authority No 637150.

Short Richardson and Forth Solicitors Limited is a private limited company constituted and run in accordance with the provisions of the Companies Act 2006. The term “partner” has been used to denote individual senior solicitors employed by Short Richardson and Forth Solicitors Limited.