Department comes under scrutiny from privacy groups and Information Commissioner's Office for permission to use voice as passwords.
HMRC has responded to an accusation from a privacy campaign group that it has analysed and stored millions of individuals' data without consent by saying it is resolving an issue between “implied and active consent”.
According to the privacy campaign group Big Brother Watch, which first told the Daily Mail about the claim, HMRC's Voice ID system has collected 5.1 million audio signatures and is creating "biometric ID cards by the back door".
The Voice ID scheme, introduced last year, is designed so that people's voices act as passwords to confirm their identity and access personal tax accounts.
It asks callers to repeat the phrase "my voice is my password" to register. Customers can then use the phrase to confirm their identity each time they contact the department.
But an HMRC spokesperson told UKAuthority that the department is “resolving the issue between implied and active consent that may exist with our Voice ID system".
The spokesperson said that on first contact with HMRC customers are given the opportunity to skip security questions by setting up Voice ID. From that point on they are assumed to have consented to the process as long as they continue to use the system. Customers can also access systems without using Voice ID.
"We’re not building up an algorithm on people. It’s a question of what level of consent is required before we can retain someone’s voice to match it up. It’s an administrative point," the spokesperson said.
"Our Voice ID system is very popular with customers as it gives a quick and secure route into our systems. Our customers’ data, including for Voice ID, is stored securely. We take our GDPR responsibilities extremely seriously.”
The General Data Protection Regulation (GDPR), which came into force last month, requires organisations to obtain explicit consent before they use biometric data to identify someone.
The Information Commissioner’s Office (ICO) is now investigating the claim. A spokesperson said: “We have received a complaint about HMRC’s voice ID scheme and will be making enquiries.”
Image by respiro, CC BY 2.0 through flickr
