Comments from ACCA to HM Revenue and Customs, December 2013.
ACCA welcomes the moves to improve the efficiency and economy of HMRC operations, and to pass on the benefits of improved systems to taxpayers and their agents. However, there are a number of concerns which need to be addressed in the field of online access to HMRC systems and taxpayer confidential information. The introduction of voluntary online communications is a valuable first step in assessing the viability and practicability of fully online communications between HMRC and individual taxpayers, but HMRC must be fully aware of the risks and ensure that these are identified and communicated to those volunteering for the programme.
HMRC intends to make available electronically the Self Assessment products listed at paragraph 9 to those who have opted in to Self Assessment Online. Views are sought on the suitability of those products being made available online.
The move towards online delivery of all government services is inexorable and ultimately holds the potential for considerable improvements in both efficiency and effectiveness of service delivery. However, there are for the time being still a number of constraints on the benefits and utility of digital process for many users of government services, and the delivery of self-assessment for personal income tax is one of those areas. It is with this in mind that the repeated assurance throughout the consultation that the delivery of these services will be optional, and rolled out only when technologically feasible and can be “best delivered”, is welcomed by ACCA.
The reference to use of social media accounts raises a number of concerns in the current internet environment. Such accounts are not necessarily secure, and individuals are frequently comparatively careless of their identity credentials. With the growth of smartphone access, the ability of others to access social media accounts seems to be increasing, and while most hijackings of accounts are relatively benign and result in little more than embarrassment for the victim, the prospect of linking the accounts to valuable information such as tax assessment details raises a number of concerns.
Any linkage between the tax system and an individual’s social media accounts would have to be a strictly one-way messaging service, sending only the most generic ‘You have mail in your HMRC box’ type. Even the knowledge that an individual uses online self-assessment could be valuable to the extent that it alerts malefactors to the potentially greater value of the individuals online identity. Knowing that someone uses online self assessment would alert fraudsters to the fact that their other personal information and credentials would be known to the HMRC systems, reducing the effort required (and likelihood of ‘payback’) in attempting to impersonate them to the HMRC system.
We note also that at point 15 the consultation indicates that a valid telephone number would be required for an individual to initiate fully online self-assessment. It is not clear whether this would need to be a mobile number, with a view to sending of SMS messages, or whether a normal fixed landline would be appropriate. There are still individuals who might feel comfortable filing online, and communicating with HMRC via secure mail, who do not have a personal mobile phone. Others might use only Pay As You Go access, and HMRC would need to consider whether this would constitute a ‘valid’ number. Many of those who might find fully online self-assessment most useful, for example those who frequently travel overseas, or even are resident overseas but with a taxable source of UK income necessitating UK tax returns, might find it inconvenient or impossible to maintain a UK based mobile telephone. Would HMRC consider a foreign telephone number to be valid, and if so how would ‘validity’ be verified?
Many customers registered to use the Self Assessment Online service do not personally access the system, but allow their appointed agent to file on their behalf (see paragraph 22). HMRC welcomes suggestions on how customer consent can be best achieved in circumstances such as these.
For new self-assessment taxpayers, consent should be given at time of appointment of the agent through the 64-8 process. Where all previous correspondence has been on paper there would seem no viable alternative to the notification from HMRC to the taxpayer that the agent has opted for online communications to be on paper. Where HMRC has a confirmed channel of digital communication with the taxpayer, this could be used to confirm that the agent also has opted for online communications
For existing clients who do not wish to communicate directly with HMRC and do not have any recognised method of digital communication then while the option for future communication to be online only could itself be submitted online (in the same way as any other agent authorised communication) HMRC would have to notify the taxpayer of that option in writing to the last known postal address of the taxpayer. While this would in many cases be viewed as an irritation by the taxpayer, and will impose a one-off administrative burden on the agent who will want to warn the taxpayer in advance of the impending letter, the scope for fraudulent election into the system is otherwise too great.
Many of the issues and concerns around this aspect of online security have already been discussed with HMRC in the context of the new agent strategy work, and the maturity of the on-line environment as a suitable forum for confidential financial transactions remains a matter of concern.
It is imperative that for the time being any option to communicate entirely on-line remains just that, an option. The scope for attack at both ends of the transaction is considerable, and while HMRC may be fully apprised of all the risks, and be taking every reasonable effort to secure its systems against malicious activity, the same will inevitably not be true of all taxpayers. HMRC must ensure that the risks of digital only communication are clearly communicated to all those taxpayers who wish to adopt the new technology, and the risks and liabilities should be clearly set out.
Comments are sought on whether the draft legislation set out in Annex A works as intended and facilitates HMRC’s electronic interaction with its customers. In particular HMRC welcomes views on the definition of ‘secure mailbox’, the deemed delivery provisions and conditions and the provision and withdrawal of consent.
The definition of ‘secure mailbox’ seems comparatively broad, which may be a reflection of the desire to allow for change in the delivery of online services in the near future. The retirement of existing access mechanisms and introduction of new systems for digital interaction with government will result in changed processes and system architectures for HMRC. It therefore seems reasonable to avoid direct reference to specific technical features of the current system, which may be inappropriate in future, and require redrafting of the legislation to update.
In addition, while the system is voluntary there is an underlying assumption that those taking advantage of the facility will be doing so in good faith and unlikely to seek to exploit any potential weakness or ambiguity in the legislation for their own ends.
However it must be borne in mind that if the totality of self-assessment communication were to become a mandatory on-line service, then all taxpayers would be forced to use it, whatever their attitude towards either HMRC or the digital agenda. At this point the legislation is likely to be tested more critically by those with a greater desire to ‘break’ the system. While a relatively generic definition may suffice for the time being, it would have to be reviewed before any mandation of fully online self-assessment processes.
HMRC welcomes comments on the assessment of the impacts of these proposals in the Tax Impact and Information Assessment on page 12 including but not limited to the equalities impacts, impacts on individuals and burden reductions.
While the use of fully online self-assessment remains voluntary there should be no overall negative impacts, as those taxpayers for whom the net impact might be negative would simply continue to use the paper option. Equally, the HMRC commitment to enable each separate item of communication only as it becomes viable and appropriate should protect against any negative impacts.
However, the assessment of all impacts as benign is appropriate only while the use of entirely online self-assessment remains voluntary, and any revised proposal to impose fully online self-assessment on the whole population oftaxpayers would need to be re-assessed, taking into account the points raised in the recent joint cases of LH Bishop Electrical Company Ltd et al Commissioners for HMRC.
ACCA has received a number of comments from members, and the following extracts are indicative of the concerns of many of our members. In particular it was noted that driving large numbers of comparatively vulnerable taxpayers to appoint agents would significantly increase the scope for criminal activity in this area, with a need for HMRC to carefully monitor those setting themselves up as agents specifically to deal with online assessment:
“HMRC and the Government need to acknowledge the fact that not every individual who must make an income tax return annually has a computer and is capable of using it. Only those keyboard competent would be able to cope with the many types of communication in which a tax payer becomes involved.”
“Over the years more and more returns, correspondence etc. become capable of being on line and with this increase will arise the matter of security. I am most concerned at the protection firstly on HMRC computers but more particularly on the tax payer’s computer. Increasingly leading to fraud etc. there are those who are able to break into computer systems and with increased use that danger must increase. HMRC - and the government - must consider a staged process because as people go older then a proportion of computer use will obviously increase [as a matter of demographics].”
“A paperless self assessment system will more than likely lead to individuals having to appoint agents and that cost must not be placed on the tax payer.”