Privacy campaigners have said that the voices of millions of taxpayers have been analysed and stored by HM Revenue and Customs (HMRC) without consent.
It is alleged HMRC's Voice ID system has collected 5.1 million audio signatures. The Voice ID scheme, which was launched last year, asks callers to repeat the phrase "my voice is my password" to register.Once this task is complete, they can use the phrase to confirm their identity when managing their taxes.
The Information Commissioner's Office (ICO) says it is now following up complaints about the service.
However, HMRC says the data is held securely, this process helps speed up security procedures and improves access to its digital services.
Big Brother Watch said taxpayers were being "railroaded into a mass ID scheme", as they were not given the choice to opt out. They have also accused HMRC of creating "biometric ID cards by the back door".
Silkie Carlo, director of Big Brother Watch stated;
"These voice IDs could allow ordinary citizens to be identified by government agencies across other areas of their private lives."
A HMRC spokesperson said the Voice ID system was "very popular with customers". HMRC sources also told the BBC that identifying details were stored separately from the voice recordings.
The General Data Protection Regulation (GDPR), which came into force on 25th May 2018 refers to sensitive personal data as “special categories of personal data” (see Article 9).
The special categories specifically include genetic data, and biometric data where processed to uniquely identify an individual.
In order to lawfully process special category data, businesses must identify both a lawful basis under Article 6 and a separate condition for processing special category data under Article 9. Businesses also need to read these alongside the Data Protection Act 2018, which adds more specific conditions and safeguards in relation to this type of data.
HMRC need to be clear which lawful basis and specific conditions they have identified for processing the voices of 5.1 million tax payers if consent has not been obtained.
If your business needs assistance with data protection practices in order to avoid falling foul of the new Regulations, please do not hesitate the Regulation Team at Short Richardson & Forth on 0191 232 0283 or at email@example.com.