Administrative Court quashes HMRC's refusal to disclose information

In R (on the application of Privacy International) v The Commissioners for HM Revenue and Customs,[1] the Administrative Court has quashed a decision by HMRC that it did not have a duty to disclose information concerning its export control functions.

Background

Privacy International ('Privacy'), is a UK non-government organisation ('NGO') and expert on privacy issues which especially focuses on and investigates the use of surveillance at an international level. It brought an application for judicial review on its own behalf and also on behalf of two political activists who had been the victims of unlawful surveillance by the governments of Ethiopia and Bahrain. The unlawful surveillance was facilitated by equipment such as malicious software (known as 'malware') that is covertly installed to infect a user's computer or mobile phone device. The installed malware then enables full access to the user's emails, social media and internet usage and can even remotely operate the device's camera and microphone to record the user. Privacy contended that this surveillance was conducted using equipment and malware that was provided illegally by a UK company, Gamma International ('Gamma'), in breach of UK regulations on exports, which HMRC has a statutory duty to enforce.

Privacy raised its concerns over the failure by HMRC to impose export controls over malware such as that sold by Gamma in a pre-action protocol letter to the Secretary of State for Business and Skills dated 12 July 2012. This letter sought confirmation that export controls would immediately be imposed (or an explanation provided if not) and pre-action disclosure of "all minutes of meetings/correspondence with Gamma". The Secretary of State's response proposed treating the latter request as a Freedom of Information Request, explaining that, under section 41(1), Freedom of Information Act 2000 ('FOIA'), the information sought was exempt from disclosure as it had been provided in confidence and there was insufficient public interest to release it.

This prompted Privacy to write directly to HMRC on 9 November 2012 and again on 21 December 2012 (the 'Complaint Letters'), requesting information regarding HMRC's export control function in relation to the malware provided by Gamma. HMRC's position was set out in three letters dated 9 January 2013 (the 'Decision Letter'), 10 January 2013 and 8 March 2013. The Decision Letter stated that "section 18 of the Commissioners for Revenue and Customs Act 2005 [(the Act)] imposes strict controls on the disclosure of information held by HMRC [and that] the starting point of this legislation is that without specific legal authority officials of HMRC may not disclose any information held by HMRC in connection with its functions". Consequently, the letter explained that HMRC had no power under section 18 to provide information about its investigations to Privacy or any third party, including victims of foreign regimes who used malware products. Privacy considered HMRC's decision to be a serious misdirection of the law and applied for judicial review of its decision.

The parties' submissions

HMRC submitted that the power to disclose information was narrow due to (a) the terms of the legislation contained in the Commissioners for Revenue and Customs Act 2005 (the 'CRCA'), (b) the fact that disclosure was supported by criminal sanctions, and (c) the fact that FOIA was inapplicable to information covered by section 18 CRCA and which identifies or is capable of identifying a person.

Privacy submitted that the scope for discretion was quite broad and that HMRC was entitled to do anything it thought "necessary or expedient in connection with the exercise of their functions or incidental or conducive to the exercise of their powers".

In addition, Privacy contrasted HMRC's actions in this case to its actions in the recent case of R (on the application of Ingenious Media Holdings plc and another) v HMRC,[2] in which two taxpayers objected to being named in an 'off the record' meeting on tax avoidance between Dave Hartnett, then HMRC permanent secretary for tax, and journalists from The Times newspaper. In Ingenious, HMRC argued that the basis for providing such information was the broad discretion and evaluative 'margin of appreciation' it had when exercising its disclosure power. The court in Ingenious recognised that the scope of the margin of appreciation is context-dependent and found that HMRC's decision to disclose information was justified as it was based on policy considerations applicable in the field of tax and revenue collection.

Decision

The court granted Privacy's application to quash the Decision Letter and remitted the decision for reconsideration.

It found that the Decision Letter contained an error of law on its face as it implied that the legislation governing disclosure is strict such that there are no circumstances which could authorise HMRC to disclose information. On the contrary, section 18(2)(a) and (d) of CRCA set out exceptions to the general prohibition upon disclosure of information by HMRC, such as (broadly) where the provision of information is contingent to a "function" of HMRC. In this case, the function of HMRC concerns its role (a) as an enforcer of offences under Article 35 of the Export Control Order 2008, and (b) as an investigator of criminal wrongdoing under the Police and Criminal Evidence Act 1984. The court also found that there were significant failings made by HMRC in reaching its decision in the Decision Letter, including that it had failed (a) to obtain evidence from the relevant operational unit within HMRC, and (b) to have regard to the actual issues raised in the Complaint Letters and provide a comprehensive response thereto. Additionally, the court commented that the whole process adopted by HMRC in dealing with this complaint was confused and flawed.

Having quashed the decision in the Decision Letter and to assist HMRC's reconsideration of the request, the court then addressed the scope of HMRC's discretion. The court confirmed that the scope of HMRC's discretion is fact and context dependent, a position which is consistent with Ingenious. To determine the scope of the discretion applicable to HMRC, the court assessed the relevance and weight of the individual considerations that arose on the facts. In particular, it noted the distinction between the different categories of complainant and the fact that, in exercising its discretion, HMRC must consider the interests and status of both the persons requesting information and those who are the subject of complaints and investigations. The court considered that complainants such as NGOs, the press and pressure groups have an important role to play in that they report and investigate issues of public interest and have the locus to challenge legality on behalf of victims. Accordingly, these considerations may apply to an NGO such as Privacy in challenging the decision by HMRC not to prosecute Gamma for breaches of export controls, particularly since Privacy itself would have agreed to adhere to confidentiality conditions.

Comment

The court's decision to quash the Decision Letter and its comments on numerous failings with HMRC's handling of Privacy's complaint will no doubt be embarrassing for HMRC. In particular, HMRC's incorrect assessment of its authority to disclose information is surprising given its assertion in Ingenious that it had authority to do so. Indeed, one could be forgiven for concluding that HMRC operate one policy when briefing journalists 'off the record' about taxpayers it considers to be involved in tax avoidance and another more restrictive policy when information is requested by concerned organisations such as Privacy.  

The case has further reinforced the importance of HMRC assessing both the individual facts and the context of any given request when exercising its discretion to disclose information.  

[1] [2014] EWHC 1475 (Admin).

[2] [2013] EWHC 3258 (Admin).