.. • OFFICIAL ~~ HSE @HMRevenue & Customs Process Level Memorandum of Understanding on Information Exchange between HM Revenue and Customs Risk and Intelligence Directorate Gateway Exchange Team & Health and Safety Executive Version 0.4 MoU Ref MoU-URR-P0001 1 G306 -OFFICIAL Contents Section Title 1 2 3 Introduction legal Purpose of the agreement Procedures 4 5 6. 7 Information Handling, Security and assurance Responsibilities under the Data Protection Act 1998 and Human Rights Act 1998 Subject Access and Freedom of Information 10 11 Monitoring and review arrangements Issues disputes and resolution Costs Signatories to the Agreement AnnexA Annex B Annex C Annex 0 Annex E HSE to HMRC Request form template HMRC to HSE request form template Document Control Contacts Glossary of Terms and Abbreviations 8 9 Version 0.4 MoU Reference Number - MoU-URR-P0001 G306 2 OFFICIAL 1. Introduction HMRC - HM Revenue & Customs: Home Page was established in April 2005 by the Commissioners for Revenue and Customs Act 2005 (,CRCA 2005'), merging the Inland Revenue and HM Customs and Excise. HMRC's functions are set out in sections 5 - 7, 9 and Schedule 1 of the CRCA 2005 and can be summarised as all powers pertaining and ancillary to the collection and management of the revenue and duties. HMRC's purpose is to make sure that the money is available to fund the UK's public services. HMRC also helps families and individuals with targeted financial support. 1.2 The Health and Safety Executive (HSE) is responsible for enforcing the Health and Safety at Work etc. Act 1974 (HSWA) throughout Great Britain. Its job is to 'prevent people being killed , injured or made ill by work'. HSE: Information about health and safety at work 1.3 This Process Level MoU sits under the HMRC Umbrella MoU reference MoU-U-RR 1.4 A glossary of key terms and abbreviations can be found at Annex E. 2. Legal 2.1. Both organisations are legally obliged to handle personal information according to the recuirements of Ihe Data Protection Act 1998 (DPA) and the Human Righls Act 1998 (HRA) . 2.2 HMRC may disclose information to the HSE using the legal gateway in section 19 of the Anti Terrorism , Crime and Security Act 2001 (ATCSA). This allows HMRC to disclose information to another law enforcement agency for the purposes of assisting criminal investigations or proceedings, including for the purpose of determining whether investigations or proceedings should be initiated or brought to an end. All disclosures must be proportionate and comply with HMRC's Anti Terrorism Crime & Security Act 2001 : Code of Practice on the Disclosure of Information, available from http://bit.lyl1f25Qry. 2.3 HSE may disclose information to HMRC using the legal gateway in section 17 of the Anti Terrorism Crime and Security Act 2001 (ATCSA). Under that section, an investigating authority may request information which was obtained by HSE for the purpose of assisting their criminal investigations or proceedings (whether in the United Kingdom or abroad) , including whether these investigations or proceedings should be initiated or brought to an end . Section 28(7) HSWA has been amended by section 17(1) ATCSA to permit such disclosure. 2.4 . HSE will use information supplied by HMRC for regulatory enforcement purposes, i.e. as part of prosecution evidence. However, HSE undertakes not to supply information to any third party unless required , or permitted , by law. Where not permitted/required by law HSE will seek agreement wilh HMRC 2.5 HMRC will not disclose data supplied by HSE to any third party unless permitted or required by law and will not make any such disclosure without prior agreement by HSE Version 0.4 MoU Reference Number - MoU-URR-P0001 G306 3 OFFICIAL 3. Purpose of the agreement 3.1 This Memorandum of Understanding (MaU) sets out the agreement between HM Revenue and Customs (HMRC) and the Health and Safety Executive that govems the exchange of information under the Anti Terrorism Crime and Security Act 2001. It should be noted that 'exchange' covers all transfers of information between the two organisations. 3.2 Information will only be exchanged where it is lawful to do so. The relevant legal bases are detailed within this agreement. 3.3 This MoU is not a contract nor is it legally binding. It does not in itself create lawful means for the exchange of information; it simply documents the processes and procedures agreed between the organisations. The agreement should not be interpreted as removing or reducing existing legal obligations or responsibilities on each party , for example as data controllers under the Data Protection Act. 3.4 HMRC and HSE both undertake to comply fully wilh the requirements of the OPA and the HRA 3.5 This MoU is not intended to create any legal rights enforceable by any third party or by either party against each other. 4. Procedures Procedure for HSE to obtain Data from HMRC 4.1 Every request for disclosure of information must be made in writing (pdf via, secure e-mail). A specimen request form is at Appendix A. Verbal requests will not be accepted. 4.2 Disclosures will be made on a case-by-case basis. Requests must therefore be for a specifically named individual or company. Bulk requests and lists will not be accepted. 4.3 The request must contain details of the criminal investigation or criminal proceedings to which it relates and specify the information required - e.g. current address , or details of income for a stated year. 4 .4 Any HSE Inspector may make a request which must be authorised by the inspectors line Manager or other senior manager. Authorisation is to be given only jf the authoriSing officer is satisfied that the request is for the purpose of obtaining information to assist the HSE in a criminal investigation and! or prosecution. The request must be submitted to HMRC via HSEs appoinled Single Poinl of Contact (SPOC) officer. 4.5 HSE AuthoriSing Officers must be of at least Band 3 grade. 4.6 The HSE will provide HMRC wilh an up-to-date lisl of its appoinled SPOCs detailing: Full name Business address Rank or grade Official telephone number Official e-mail address Version 0.4 MoU Reference Number - MoU-URR-P0001 G306 4 OFFICIAL 4.7 Requests should bear the appropriate Government Security Classification https:/Iwww.gov.uklgovernmenUpublications/government-security-classifications 4.8 Requests for information must be sent only by one of the HSE SPoC officers to the Gateway Exchange Team London. Requests must not be passed to any other officer of HMRC. 4.9 Each SPoC officer will consider if there are other avenues open to obtain the information in a timely way. Only if this fails will HSE contact HMRC for the infonnation. 4.1 0 HMRC prefers requests to be sent by secure email. E-mail requests should include the authorisation from the authorising officer in the e-mail chain and sent to: [email protected] 4.11 E-mail requests using the GSI address should only be up to GSC Official. 4.12 HSE will only engage in postal requests in exceptional circumstances 4.13 Postal requests should be s double enveloped (e.g . the inner envelope should be marked "Official" and sealed inside another envelope without a security marking on it and show a return address in the event of non-<lelivery). The protective marking must be shown prominently on the inner cover. They should be sent to:Gateway Exchange Team (London) Custom House Annexe, First Floor 20 Lower Thames St London EC3R 6EE Tel: 08707852296 4.14 Providing that the principles of the Code of Practice have been respected and GET is satisfied that the request is for the purposes of a criminal investigationl prosecution it will normally disclose the requested information to the full extent that HMRC holds that information. The disclosure will always be proportionate to the purpose for which it was sought. 4.15 Any disclosure by HMRC will be made in writing or by secure electronic communication to the Single Point of Contact or Requesting Officer (copied to the SPoC). - 4.16 4.17 Spontaneous disclosures or proactive disclosures can be made without a request by either HSE or HMRC were there are potential tax irregularities or health and safety breaches. Spontaneous disclosures by HMRC to HSE are to be made to HSE at the following email address: fod [email protected] Procedure for HMRC to obtain Data from HSE 4.18 A specimen request form is at Annex B Version 0.4 MoU Reference Number - MoU·URR-P0001 G306 5 OFFICIAL 4 .19 The HSE will consider and, if appropriate, arrange for the disclosure of the requested information HSE holds 4.20 Spontaneous disclosures from HSE to HMRC should be sent· preferably in 5)(5x5 format - to [email protected] If necessary contacting the Intelligence bureau for advice on 03000 521779 4.21 Requests for information may be sent by the HMRC SPoC officers only by post, fax or e-mail to HSE at: Health and Safety Executive Legal and Enforcement Team 1.3 Redgrave Court Merton Road , Bootie Merseyside L20 7HS Fax: 0151 951 3019 E-mail: fod [email protected] 4.22 The HSE SPeC officers in its Legal and Enforcement Team will consider and, if appropriate, arrange for the disclosure of the requested information HSE holds S. Information Handling Security and Assurance Both parties agree to : • Only use the information for purposes that are in accordance with the legal basis under which they received it • • Only hold the data while there is a business need to keep it • Store data received securely and in accordance with the prevailing central government standards, for example in secure premises and on secure IT systems • Move, process and destroy data securely i. e. in line with HM Government Security Policy Framework and in particular Security Policy 2: Security of Information, issued by the Cabinet Office, when handling, transferring , staring, accessing or destroying information. • Comply with reporting requirements (e.g. reporting data losses or wrongful disclosure), in line with the Cabinet Office Checklist for Managing Potential Loss of Data or Information . Report any data losses, wrongful disclosures or breaches of security relating to information originating in HMRC or HSE to the designated in Annex 0 contacts immediately (within 24 hours of becoming aware). This includes both advising and consulting with HMRC or HSE on the appropriate steps to take, e.g. notification to the Information Commissioner's Office or dissemination of any information to the data subjects. • Provide written , signed assurance that they have complied with these undertakings regularly upon request Version 0.4 Ensure that only people who have a genuine business need to see the data will have access to it MoU Reference Number - MoUwURRwP0001 G306 6 OFFICIAL 6. Responsibilities under Data Protection Act (OPA) and Human Rights Act (HRA) 6 .1 HMRC and HSE are public authorities for the purposes of section 6 HRA It would be unlawful for HMRC and HSE to act in a way that is incompatible with the European Convention on Human Rights. 6.2 HMRC and HSE undertake to comply with the requirements of the DPA and HRA in carrying out any of the actions described in this agreement. 6.3 HMRC is the data controller of any information it holds for the purposes of its functions, including any information it acquires from HSE for the purposes of HMRC's functions under the procedures set out iii this MOU . 6.4 HSE is the data controller of any information it holds for the purposes of its functions , including any inform ation it acquires from HMRC for the purposes of those functions under the procedures set out in this MoU . 7. Subject Access & Freedom of Information (Fol) and Environmental Information Regulations Act 2004 (EIR) 7.1 8. If HMRC or HSE receives a Fol or EIR request involving information which originated from the other, the receiving party will contact its central Fol team which will then liaise with the central Fol team for the originator of the information to determine whether the originator wishes to claim an exemption under the provisions of the DPA or FOI. The receiving party must be mindful of the timeframe for response. If necessary the initial contact can be via the Contacts for this document. Monitoring and Review Arrangements 8.1 This agreement will be formally reviewed at least annually. 8.2 The parties may agree to meet more frequently to resolve any matters or concerns arising out of the operation of the MoU. 9. Issues, Disputes and Resolution 9.1 Where a problem arises it should be reported, in writing , to the designated contacts (listed in Annex D). The contacts will endeavour to resolve the problem within 2 working days. 9.2 Where it is not possible to resolve the issue within 2 working days or the issue is of such severity that customers may be negatively affected, the issue will be escalated to the senior management team for each partner. They will be notified with an explanation of why the dispute has not been resolved so that they can take appropriate action for resolution or plan contingency arrangements. Version 0.4 MoU Reference Number - MoU-URR-P0001 G306 7 OFFICIAL 9.3 Where the 'business as usual' channels fail to reach agreement, the organisations will attempt to negotiate a settlement in the spirit of jOint resolution within 20 working days of a formal notification being received . 9.4 Any issues regarding ongoing delivery aspects of the information supply, such as data integrity or quality, should be addressed through 'business as usual' channels as detailed in Annex D. 9.5 If it is decided as a result of issues arising that changes to this agreement are required , a formal change notification should be sent to the 'Data Exchange Coordinator'. External changes affecting the operational delivery responsibilities of the organisations may also necessitate the review and potential amendment of this agreement. 10. Costs 10.1 HMRC will not charge the HSE for information requested under the arrangements in this MoU unless the number of requests made per year ended April by the HSE exceeds 50. Should the HSE make more than 50 requests HMRC may decide to charge an administration fee for all requests made in that year, not just those over the 50. HMRC will ensure that HSE is advised well in advance of this 50 limit being reached. 10.2 For these purposes each individual or company named on a request counts as a separate request 10.3 HSE may charge HMRC for information requested under the arrangements in this MoU which will be on a time and materials basis with charges based on HSEs average salary costs. Version 0.4 MoV Reference Number - MoU-URR-P0001 G306 8 OFFIC IAL 11. Signatories to this Agreement' Date'1{6( ,<tKevin Myers Acting Chief Executive, Health and safety Executive .. ............ <-~~ - ..... ............. .... . ~/( /'\...( Date.......... . Euan Stewart Risk & Intelligence Service, HM Revenue & Customs Version 0.4 MoU Reference Number - MoU-URR-P0001 G306 9 OFFICIAL ANNEX A - HSE to HMRC Request Form REQUEST FOR INFORMATION FROM HM REVENUE & CUSTOMS UNDER THE ANTITERRORISM CRIME AND SECURITY ACT 2001 ONLY. (This form should NOT be used for CPIA Requests) Protective Mar1<lng Information Report Witness Statement Restricted D Confidential D seeretD Top Secret D Format of Reply Required (Tick Only One Box) 0 0 Requests for both go to GET London. Email: [email protected] We will aim to meet your key date as shown below. This may not always be achieved. so please only use this facility in cases of urgency. We do need a date, do not just state urgent. Please list any KEY dates (court dates or interview datas) If required urgently please state the [lIi!l!QD Disclosure Officers Do not use this form . Please make a CPIA reQuest. Address: Tel no (not 101i: PNN/GSI ATCSA Requesting Officers Name: Force/Agency: E-mail address If you have any speCific Informatton which would be of use to HM Revenue & Customs (tax avoidance, fraud, MTIC, Smuggling etc) then please email this directly to the HMRC Intelliaence Bureau ([email protected]) Legal person about whom information is sought: A SEPARATE request is required for EACH legal entity (e.g. INDIVIDUAL and COMPANY) Full name: Full address: Date of birth: National Insurance No: Other relevant Information: I.e previous addresses & linked cases State details of the criminal investigation or proceedings to which request relates These details must show how the INDIVIDUAL or COMPANY are linked Nature of Enquiry: Version 0.4 to the Investigation, stating the type of INVESTIGATION (Ie money laundering/financial etc) and what CRIMINAL OFFENCE the legal person named above is personally suspected of. tf this infonnation Is not I Drovided, your request will be REJECTED MoU Reference Number - MoU-URR-P0001 G306 10 OFFICIAL Oporation Name (if relevant) : Protective Marking Restrtcted D Confidential D secretD Top Secret D Information requested: Please note that the exchange of information is not mandatory and only information that is proportionate to the nature of your enquiry will be provided . Information required From to (All replies will be made in tax years. A tax year begins on 6th April and ends on 5th April i.e. 6"' April 2009 to 5th April 2010. Most of our databases only hold the last 6 tax year's information.) If no timescale is provided the request will be rejected . The list below Is not comprehensive of the Intannatlon held by HMRC. Please use the 'other' box for infonnation you consider relevant to your Investigation that Is held by HMRC. Please only tick the boxes that are relevant & proportionate to your enquiry/investigation. Individuals o o o o o o n Latest Address & Current Employment Private & Businesses addresses held Declared Income (PAVE, Self - Employment & Other income shown on tax returns, such as Land & Property & Capital Gains). Tax Credits Bank! Building SOCiety accounts and all other identifiable investments, including Stamp Duty & Land Tax delails (only held for last 5 years) Child Benefit Payments VAT Registration delails Ve rsion 0.4 MoU Reference Number - MoU-URR-P0001 G306 11 OFFICIAL o VAT Returns/Payments State the Period Required (Only the last 3 years will be supplied) o o Telephone contact numbers Agent/Accountants details Other (please specify) Companies o o o Company Tax Returns VAT Registration detail .. VAT Returns/Payments (State the Period Required) Other (please specify} Please give brief details to show that: • the requested information cannot be obtained by other means or from other sources • the requested information will be of substantial value to the investigation or proceedings • lack of access to the requested information will oreiudice the investigation or proceedings. Version 0.4 MoU Reference Number - MoU-URR-P0001 G306 12 OFFICIAL This form needs signing by an Authorising Officer. For Police requests this is Inspector level or above. For other law enforcement agencies this is Senior Officer or above. If the request is sent eledronically then the Authorising Officer must show their approval of Ihe request in the email chain sent to HMRC. A list of Authorised Officers is held by the Single Point of Conted for your Force/Agency. Name (print) .. ..•.•••. . .. ... .... ••..• ••• .. .....• E-mail address ... .......... ....... ... .... ~ Ran k ................ .. ............... ... ......... Signature ............ .••........ •....... .. ......••. Date ............................................. ... Protective Marking Version 0.4 Restrided 0 Confidential 0 Secret 0 Top Secret 0 MoU Reference Number - MoU· URR-P0001 G306 13 OFFICIAL ANNEX B HMRC to HSE Request Fonn Template REQUEST FOR INFORMATION by HMRC From HEALTH AND SAFETY EXECUTIVE UNDER THE ANTI-TERRORISM CRIME AND SECURITY ACT 2001 Protective Marking Restricted D Confidential D Secret D Topsecret D Requests for information should be emailed to: fod [email protected] .gov.uk Please list any KEY dates (court dates or interview dates) If required urgently please state the reason Requesting Officers Name: Authority Tel no: Fax No: E-mail address Address Legal person about whom information is sought: A SEPARATE request is required for EACH legal entity (e.g. INDIVIDUAL and COMPANY) Name: Address: Other relevant information as appropriate Nature of Enquiry: Version 0.4 State details ofthe criminol investigation or proceedings to which request relates These details must show how the individual or company are linked to the investigation, and state what criminal offence they are suspected of. MoU Reference Number- MoU-URR- P0001 G306 14 .. OFFICIAL I Please note that the Information requested : excha~ge of information is not mandatory. Only information that is proportionate to the nature of your enquiry will be provided . Please provide full details of the information sought, explain why it is necessary and whether you have taken any steps already to obtain the required Information. Please give brief details to show that: • the requested information cannot be obtained by other means or from other sources • the requested information will be of substantial value to the investigation or proceedings • lack of access to the requested information will prejudice the investigation or proceedings. This form needs authorising by an SEO or above. Name (print) ................................. Grade ...... ' ................... .... ........ .. . ' ... Location ....................................... Signature .......................................... Date ..... .. ....................... ..... ... .. .. ...... Please use this space to provide any Information which would be of use to Health and Safety Executive. This Information may al80 be sent to HSE Protective Marking Version 0.4 Restricted D Confidential D secretD TopsecretD MoU Reference Number - MoU-URR-P0001 G306 15 OFFICIAL An nex C Doc ument Control Personnel Key Personnel Author Approvers Review Control Name Peter McCafferty Organisation (Team) HMRC Steve Bridge External Data Exchange Team I Information Policy and Disclosure Teaml RIS Data Guardian FOD Legal and Enforcement Team Peter McCafferty HSE HMRC Wayne Crumpton HSE HSE HMRC Version History Version Date Summary of changes Changes marked 0.1 2012 Initial draft Yes 0.2 201 3 Minor amendments No 0.3 Nov 2013 Incorporated comments from Meeting No 0.4 Dec 2014 Comments on charging updated and minor presentation No 0.4 Jan 2014 Comments from HSE Lawyers No Final version No 1.0 Review dates Version Publication date Review date 1.0 ? ? Version 0.4 MoU Reference Number - MoU-URR-P0001 G306 16 OFFICIAL Annex 0 - Contacts Business As Usual Contact details Each party has nominated a Single Point of Contact (SPOC) • The SP~C for HMRC is Paul Wright Gateway Exchange Team (Tel: 08707852220) [email protected] • The SP~C for HSE is Steve Bridge, FOD Legal and Enforcement (Tel: 01519514971) Email - [email protected] Escalation (i) Escalation within HMRC Initially - Peter McCafferty 03000564679 Email: _pete [email protected] Central HMRC contacts are: Contact Dan Leonard , Security & Information Directorate Central Policy Information Pollcy & Disclosure team Inbox External Data Exchange team Inbox E-mail Leonard , Dan (S&ID) [email protected] Responsibility Security Incidents ccp, disclosure (RP CCP London) Legal issues Data Exchange, Coordinator (IMS Live Services) [email protected] EDE process and central FOI team Inbox Request, FOI (CenPollnformation Policy and Disclosure) fai .ren uestta>hmrc.n 5 i. nov .uk Freedom of Infonnation Requests Version 0.4 cCl~ · disciosure@hmrc . gsi . gov . uk database of MoUs MoU Reference Number - MoU-URR-P0001 G306 17 OFFICIAL (iil Escalation within HSE Inilially - Wayne Crumpton Email: wayne,[email protected],uk Contact Jonathon Sibley E-mail Responsibility [email protected] 019() IT Security Officer 0190445 5790 Jayne Thorniley [email protected] HSE Data Protection Officer and FOI requests [email protected] Legal and Enforcement issues 01519513355 Legal and Enforcement Team Version 0.4 MOU Reference Number - MoU-URR-P0001 G306 18 OFFICIAL Annex E Glossary of Terms and Abbreviations Abbreviation Description CRCA MoU FolA EIR Fol HMRC PSB 5PF ATCSA CoP The Commissioners for Revenue and Customs Act Memorandum of Understanding Freedom of Information Act Environmental Information Regulations Act 2004 Freedom of Information Her Majesty's Revenue and Customs Public Sector Body Security Policy Framework Anti Terrorism Crime & Security Act 2001 Anti Terrorism Crime & Security Act 2001 : Gode of Practice on the Oisclosure of InformationCommissioners for Revenue & Customs Act 2005 Data Protection Act 1998 Gatewav Exchan!le Team H M Revenue & Customs Human Rights Act 1998 Memorandum of Understanding Health and Safety Executive Single Point of Contact CRCA DPA GET HMRC HRA MoU HSE SPoC Definition Interpretation " Data Controller" has the meaning set out in section 1 of the Data Protection Act 1998, i. e. 'a [natural or legal] person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal data are, or are to be, processed '. " Data Processor" has the meaning set out in section 1 of the Data Protection Act 1998, i.e. 'in relation to personal data, any [natural or legal] person who processes the data on behalf of the data controller' . "Data Protection Legislation" means the Data Protection Act 1998, the EU Data Protection Directive 95/461EC, the Regulation of Investigatory Powers Act 2000, the Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000 (51 2000/2699), the Electronic Communications Data Protection Directive 2002lS8IEC, the Privacy and Electronic Communications (EC Directive) Regulations 2003 and all applicable laws and regulations relating to processing of personal data and privacy, including where applicable the guidance and codes of practice issued by the Information Commissioner Version 0.4 MoU Reference Number - MoU-URR-P0001 G306 19 OFFICIAL lIFolA" means the Freedom of Information Act 2000 and any subordinate legislation made under this Act together with any guidance and/or codes of practice issued by the Information Commissioner or relevant Government Department in relation to such legislation "Law" means any applicable law, statute, bye ~ law, regulation , order, regulatory policy, guidance or industry code , rule of court or directives or requirements of any Regulatory Body, delegated or subordinate legislation or notice of any Regulatory Body "Ad Hoc Transfer" Is defined as being bulk data with a protective marking of restricted or above and the transfer is part of a pilot or project with a definitive end date. " Regulatory Bodies" means those government departments and regulatory statutory and other entities , committees and bodies which, whether under statute, rules, regulations, codes of practice or otherwise , are entitled to regulate, investigate, or influence matters dealt with in this Agreement and "Regulatory 80dy~ shall be construed accordingly Mpublic sector bodY- Th is will generally be another government department (OGD) but could be another public sector body (e.g. Local Authority) . Information sharing with a private sector body needs to be covered by a commercial contract, not an MoU. Version 0.4 MoU Reference Number - MoU-URR-P0001 G306 20
© Copyright 2026 Paperzz