You may find that your voice recognition information has been deleted. HMRC were found to have broken GDPR on biometric data, requiring them to get rid of five million taxpayers’ voice recognition records.
What voice recognition security option?
In 2017, HMRC started this new security feature as part of their solution to the much publicised, lengthy phone line queues. The idea is that registering for voice recognition speeds up the process of accessing your tax records and getting help with enquiries. There are less steps to the security process.
Taxpayers simply say the phrase “my voice is my password” several times as registration for this system. HMRC has a sophisticated algorithm which allows people to be identified immediately by their voice alone.
How did HMRC break GDPR?
The new General Data Protection Rules came into force in May 2018 and are Europe wide. They are designed to protect the individual by regulating the collection, storage and usage of your data. Voice recognition is considered biometric data, like fingerprint or retina scanning. You must be specifically asked to give your consent before any of your biometric data can be collected. This was HMRC’s mistake.
The Information Commissioner’s Office (ICO) investigated HMRC’s use of voice recognition data after it was brought to their attention by the privacy activist group Big Brother Watch. The ICO ruled that HMRC had broken GDPR because they did not offer individuals the chance to opt out of the voice recognition scheme. This is a direct breach of the rules because people did not give their consent to the collection of the data as they were automatically entered into the system.
As reported by the BBC, ICO Deputy Commissioner, Mr Wood said: “We welcome HMRC’s prompt action to begin deleting personal data that it obtained unlawfully. Our investigation exposed a significant breach of data protection law. HMRC appears to have given little or no consideration to it with regard to its voice ID service…Innovative digital services help make our lives easier but it must not be at the expense of people’s fundamental right to privacy.”
Does that mean HMRC no longer use voice recognition?
No, HMRC are continuing with their voice recognition system. Many of their customers like its simplicity and speed. As HMRC Chief Executive, Sir Jon Thompson, said: “I am satisfied that HMRC should continue to use voice ID. It is popular with our customers, is a more secure way of protecting customer data, and enables us to get callers through to an adviser faster.”
In October HMRC changed the way the collect and store voice recognition information in order to fully comply with GDPR. Since then, 1.5 million people told HMRC that they want to carry on using the system. If you are one of those people, then your voice recognition records are still on file with HMRC.
If you registered, but have not confirmed that you wish to continue with the service or used it since October, then you’re records are one of the five million that HMRC must delete by June 5th.
The director of Big Brother Watch, Silkie Carlo, is pleased with this outcome from the ICO: “This is a massive success for Big Brother Watch, restoring data rights for millions of ordinary people around the country.
To our knowledge, this is the biggest ever deletion of biometric IDs from a state-held database. This sets a vital precedent for biometrics collection and the database state, showing that campaigners and the ICO have real teeth and no government department is above the law.”
