| answer text |
<p>7,227,106 customers have registered a voice recognition password to access HMRC
services.</p><p> </p><p>HMRC currently relies on the legal basis of consent to collect
and process voice data from individuals under Article 6(1)(a) of the GDPR. The legal
basis for most processing of personal data in HMRC is Article 6(1)(e) and section
8 DPA 2018, namely “public task”. However, HMRC does not rely on the “public task”
legal basis for Voice ID at present as HMRC allows the customer to decide whether
they want to use Voice ID for convenience and it is only one of 3 methods HMRC uses
to verify the identity of customers on the phone.</p><p> </p><p>As biometric data
is special category data, one of the additional conditions in Article 9 of GDPR also
needs to be met in order for HMRC to process this data. Given consent is the legal
basis for processing, HMRC relies on the Article 9 (2)(a) condition of explicit consent
for the processing. HMRC allows the customer to choose to opt in to use the service
for convenience and verification by other means remains possible.</p><p> </p><p>HMRC
obtains explicit consent from customers and clearly informs them about how they can
withdraw their consent.</p>
|
|
