HMRC has been given 28 days to delete an estimated five million taxpayer biometric ‘voice prints’

HMRC has been given 28 days to delete an estimated five million taxpayer biometric ‘voice prints’ obtained from callers to its helplines, after an investigation by the Information Commissioner’s Office (ICO) found they were being held illegally in contravention of data protection rules

Callers were asked to create a voice ID by repeating the phrase ‘my voice is my password’, but the ICO found that HMRC failed to give taxpayers sufficient information about how their biometric data would be processed and failed to give them the chance to give or withhold consent. This is a breach of the General Data Protection Regulation (GDPR).