HMRC likely violated GDPR data accuracy rules in child benefit clampdown

Ministers may have breached the UK General Data Protection Regulation (GDPR) rules on data accuracy after the child benefit of thousands of families was suspended based on flawed Home Office travel data, according to legal experts. The Information Commissioner's Office (ICO) has contacted HMRC over the issues raised.

The flawed data, used by HMRC as part of a benefit crackdown, has been found to have incorrectly flagged family holidays and trips as far back as three years ago as one-way tickets abroad. Payments were subsequently stopped for families who returned via Dublin Airport and even for passengers who were refused boarding after a child fell ill at the departure gate. Barrister and data protection expert Eleonor Duhs noted that using inaccurate data to make decisions on benefit payments suggests a breach of data protection law.

HMRC confirmed it has reinstated payments to 1,979 families as of 31 October. While the authority is "confident" that the majority of the 23,500 payments were suspended correctly, it has urged anyone who was wrongly sanctioned to call its helpline. 

Training Announcement: Freevacy offers a range of independent data protection qualifications from IAPP and BCS. Our certified courses are available at foundation and practitioner levels and cover multiple legal jurisdictions, data protection operations management, and the implementation of complex privacy solutions in technical environments. Find out more.