Introduction

This notice informs an individual or a business about the processing of their personal data by Welsh Revenue Authority (WRA) and the lawful uses to which their data will be put, when they either:

  • pay devolved Welsh taxes
  • are involved in a transaction that is liable to these taxes (for example selling property subject to Land Transaction Tax), or
  • contact WRA for advice and guidance, or as a stakeholder

Devolved taxes are those for which responsibility has been passed from the UK government to Welsh Ministers, and which are collected by the WRA. The taxes to which this currently applies are as follows:

  • Land Transaction Tax
  • Landfill Disposals Tax

The information the WRA collects from persons or businesses that pay these taxes often includes personal information, i.e. data about those persons. That information may have been obtained directly from those persons, or via an agent acting on behalf of those persons, about whom the WRA will also hold information.

A summary version of this privacy notice. Agents should ensure they provide a copy of the WRA privacy notice to clients paying a devolved tax so they understand what personal information is being collected and processed.

Which data will the WRA hold?

The following is a summary of the information and data that will be held by WRA, if relevant, to support the collection of these taxes, much of which will be personal:

  • title and full name
  • current and previous addresses
  • date of birth
  • email and telephone number
  • forms of identification such as national insurance number, passport number or driving licence number
  • information about any business involved, such as name or trading name; current and previous addresses; telephone number; and if applicable Companies House or VAT registration number, and
  • information related to the tax transactions themselves including any addresses and amounts involved.

WRA may also obtain and hold information from other organisations such as HMRC to support the intended uses of data and information set out later in this notice. This is likely to include personal data covered in the list above.

All of the personal data held by WRA is subject to the EU General Data Protection Regulation (GDPR), the Data Protection Act 2018 and any other applicable domestic and EU law.

Who is the data controller?

The data controller is defined as the public authority which, alone or jointly with others, determines the purposes and means of the processing of personal data. It is clear therefore that WRA is the controller of the personal data gathered as part of the collection and management of the devolved taxes listed above. In the case of data containing personal identifiers that are provided by other agencies to WRA, WRA will combine these data with existing information to create new datasets and will determine the purposes to which these data are put. WRA is therefore also the controller for this new information.

Lawfulness

The GDPR requires a lawful basis for processing personal data and in general, Article 6(1)(e) of the GDPR (scroll down to Article 6) applies to the processing of personal data by WRA, i.e. “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”.

The specific powers that apply to WRA in this respect are listed below:

Under these powers, WRA has the right to use the personal information for the purposes listed later, and WRA will only use these powers for the purposes listed later, in support of its official function of tax collection and management, and ensuring the correct amount of tax is paid.

There will also be occasions where the WRA also relies on the consent of an individual to hold their data under Article 6(1)(a) of the GDPR, i.e. “the data subject has given consent to the processing of his or her personal data for one or more specific purposes” and occasionally, there may also be a legal obligation for WRA to hold certain personal information, when Article 6(1)(c) will apply, i.e. “processing is necessary for compliance with a legal obligation to which the controller is subject”. Such cases are uncommon and will only apply to data held for non-tax management purposes, for example communication preferences.

WRA will, in general, not need to process special categories of personal data, as set out in Article 9 of the GDPR (scroll down to Article 9). An exception to this would be the storage of communication preferences which may reveal something about the health of an individual, and in such cases WRA will again rely on consent to hold this data, under Article 9(1)(a) of the GDPR, i.e. “the data subject has given explicit consent to the processing of those personal data for one or more specified purposes…”

How long will the WRA retain the personal information it holds?

WRA will retain the personal information it holds for as long as it supports the uses listed later. There will be cases where the WRA needs to hold data for periods of longer than 25 years, for example in checking for avoidance, fraud or error in separate transactions made many years apart by the same party. In the case of information used for analysis or research, WRA will, where possible, always seek to remove all information that identifies a given individual before conducting that analysis or research. Such data might then be retained for as long as it supports useful analysis or research.

An individual’s rights

The GDPR (scroll down to Chapter 3) lists certain rights which apply to an individual in the context of storing and using their personal data, in line with the powers set out above. These rights relate to the legal basis for processing the data and the purposes to which the data are put. For most purposes, the rights of the subject are limited, as set out in this notice. Other rights apply for a limited set of purposes, as follows:

Information about you supplied directly to the WRA for tax collection and management
Information about you supplied directly to the WRA for ensuring compliance with the law around tax

This will include advice and guidance WRA provide in respect of the taxes for which it has responsibility.

  • right to be informed (this notice)
  • right to access your information (this may be restricted in certain circumstances)
  • limited right to correct any errors in your information (this may be restricted in certain circumstances)
Information about you obtained from other organisations for ensuring compliance with the law around tax
Information about you used for assessing risk of fraud or error, including automatic profiling
  • right to be informed (this notice)
  • right to correct any errors in your information
  • subject to there being legitimate grounds which may preclude processing, the right to object use of your information and the right to restrict processing while any objection is assessed by WRA
Information about you used in analysis or research
Information about you shared lawfully for analysis or research

Wherever possible, the WRA will remove any identifiable information about an individual or their agent from the data used for these purposes, and will only pass identifiable data to other parties where the law allows for it, and where the research would not be possible without it.

  • right to be informed (this notice)
Information about you collected as a customer or stakeholder of WRA that does not directly relate to tax (for example communication preferences, or that gathered as part of receiving feedback or a complaint)

This will not include advice and guidance WRA provides in respect of the taxes for which it has responsibility.

  • right to be informed (this notice)
  • right to access your information
  • right to correct any errors in your information
  • right to have your information removed (except where the data are required by law)
  • right to restrict use of your information
  • right to be notified of a correction, removal or restriction applied to your information
  • right to receive your information in a format suitable for transmission to another body
  • right to not be subject to decision based solely on automated processing unless you give explicit consent for that

More guidance on these rights can be found on the Information Commissioner’s Office website.

How will the data held by the WRA be used?

The personal data and information held by the WRA will be used for the following purposes:

  • supporting the collection and management of devolved taxes in Wales
  • ensuring compliance with tax legislation by:
    • assessing the risk of avoidance, error and fraud in tax returns and payments, including taking risk based decisions via automated processing which may lead to further investigation
    • reducing that avoidance, error and fraud by recovering debt and applying appropriate penalties, and
    • taking other lawful action against an individual, organisation or their agent in support of the above
  • where the law allows, working with public sector partners (including but not limited to:
    • law enforcement agencies
    • relevant government departments including HMRC, Revenue Scotland and Welsh Government
    • local authorities, and
    • Natural Resources Wales)
    in support of common functions, including the sharing and linking of an individual’s, organisation’s and agent’s data
  • supporting detailed analysis and research to understand the tax collected in Wales and to develop and improve tax services provided here, including the wider sharing of data for this purpose with non government agencies and researchers, and
  • providing advice and guidance to an individual as requested and using their preferred means of communication.

Data used by WRA that comes from other sources, such as relevant government departments is generally not publicly accessible, although occasionally elements of that data which are not personal information are publicly accessible, for example property information provided by HM Land Registry.

WRA will only use the personal data and information it holds to support the above purposes, and will also ensure that:

  • an individual or their agent are not identified in any analyses or research reports published by WRA
  • information about an individual or their agent is not shared with an external partner unless there is a lawful reason to do so, and the processing is fair and necessary, and
  • information about an individual or their agent is not used or held further where any of the rights mentioned earlier apply and have been exercised by that individual or agent.

Results from analyses carried out using the data will be made available in statistical publications released via the WRA website. External users, including the wider public, will be able to use this published information for their own purposes via an Open Government Licence.

Wider data sharing of the data and information held by the WRA

In line with WRA’s role as data controller for the data and information it holds, WRA may decide to share that data and information with non government agencies and researchers for statistical or research purposes. In every case, any such disclosures will be approved and controlled by an appropriate data access agreement, which:

  • limits the use to the specific requirement identified, ensuring that no individual or agent can be identified in any published reports, and
  • allows the data to only be stored for the duration of the research project, requiring the data to be destroyed after that period, and
  • demands that the transfer, storage and eventual destruction of the data are carried out securely.

Wherever possible, the WRA will remove any identifiable information about an individual or their agent from the data used for these purposes, and will only pass identifiable data to other parties where the law allows for it, and where the research would not be possible without it.

Security arrangements for the data held by the WRA

The WRA will collect and store data and information about an individual and their agent securely. WRA will only pass this data and information to other parties where it is lawful to do so and via controls which:

  • require an identified purpose, and
  • ensure that data and information are transmitted to those parties securely.

Contact points for information and complaints

Questions about either this notice or an individual’s rights should be directed in writing to the Welsh Revenue Authority at the address below. Complaints should also be directed to this address in the first instance, although you can also complain directly to the Information Commissioner’s Office.

Data Protection Officer
Welsh Revenue Authority
PO Box 110
Pontypridd
CF37 9EH

Email: data@wra.gov.wales
Web: gov.wales/wra

Information Commissioner’s Office (Wales)
Churchill House
17 Churchill Way
Cardiff
CF10 2HH

Tel: 029 2067 8400 / 0303 123 1113
Email: casework@ico.org.uk
Web: ico.org.uk