Summary: The complainant requested information relating to an attempted fraud case in his name, and relating to fraud committed against Home Office employees. HMRC provided some information to the complainant but refused to disclose the information specific to the attempted tax fraud in the complainant-™s name, citing section 30(1)(a)(i) and (ii) and section 40 of the Act. Following the Commissioner-™s intervention HMRC withdrew its reliance on section 30 and clarified its reliance instead on section 40(1) of the Act. HMRC considered the request as a subject access request under the Data Protection Act, and disclosed all details it held to the complainant with the exception of the address used in the attempted tax fraud. The Commissioner finds that HMRC breached section 1(1)(a) of the Act in that it initially confirmed that it held information which it did not in fact hold, and section 10(1) by failing to respond within the required time frame in relation to one of the requests. The Commissioner also finds that HMRC breached section 17(1) by failing to provide full details of the exemptions applied within the statutory time limit. HMRC also breached section 17(1)(b) of the Act in that it claimed reliance on section 40(1) of the Act during the investigation but had failed to communicate this to the complainant, and section 17(3)(b) by failing to fully explain its assessment of the public interest test in relation to section 30. The Commissioner finds the exemption under section 40(1) applies to the information held, but has not made a decision in relation to the subject access request as this is beyond the scope of the Act.
Section of Act/EIR & Finding: FOI 1 - Complaint Partly Upheld, FOI 10 - Complaint Upheld, FOI 17 - Complaint Upheld, FOI 40 - Complaint Not upheld