Freedom of Information Requests to HMRC: Strategic Use in Tax Disputes

Freedom of Information requests to HMRC are widely misunderstood and as a result widely mis-used. Practitioners frequently submit an FOI request expecting to learn what HMRC knows about a specific client, receive a near-automatic refusal citing section 44 and conclude that FOI is useless against HMRC. That conclusion is wrong, but only because the request was aimed at the wrong target. FOI cannot unlock identifiable taxpayer information – that is what subject access requests are for – but it is a genuinely powerful tool for obtaining HMRC's internal guidance, policy reasoning, statistical patterns and process information that shapes how every enquiry, assessment and penalty decision is actually made. This guide explains exactly where the line falls, why it falls there and how to use FOI effectively on the right side of it.

Why FOI Is Still a Useful Tool Against HMRC

The Freedom of Information Act 2000 gives any person, anywhere, the right to request recorded information held by a public authority, including HMRC. It is a right exercisable by anyone for any reason – FOIA is, famously, “motive-blind” in the same way the data protection regime is purpose-blind – and it requires no standing, no connection to any dispute and no justification. That breadth is exactly why it is so often misapplied: practitioners ask it to do the job of a subject access request, get refused and give up on it altogether.

Used correctly, FOI is one of the few routes available to discover how HMRC actually interprets and applies legislation in practice, as opposed to how its public-facing guidance presents that interpretation. HMRC’s internal manuals (the Compliance Handbook, the Enquiry Manual, the Statement of Practice background papers, internal technical notes) are recorded information like any other and large parts of them are not published in full. Where HMRC has taken an internally consistent but publicly unstated position on a point of statutory interpretation – on the application of the deliberate-behaviour penalty regime, on the threshold for a discovery assessment, on the internal criteria for offering a contract settlement instead of prosecution – an FOI request is frequently the only route to surfacing that position in terms HMRC cannot easily walk back from once disclosed.

FOI is also valuable precisely because it is not limited to a single requester’s own case. A practitioner running multiple HMRC disputes across different clients can use FOI to build a evidential and policy picture – statistics on settlement rates, internal criteria for selecting cases for COP9 versus a standard enquiry, historic guidance versions superseded by the current published manual – that no individual client’s case file or DSAR response could ever provide.

The Legal Framework: FOIA 2000 in Outline

Section 1 of the Freedom of Information Act 2000 creates two distinct rights: the right to be told whether the public authority holds the requested information (the duty to confirm or deny), and the right to have that information communicated. Both rights are subject to the exemptions in Part II of the Act. Exemptions fall into two categories that are frequently confused but operate very differently. Absolute exemptions (including section 44, the central provision discussed below) apply without any public interest balancing exercise: if the exemption is engaged, the information is withheld, full stop. Qualified exemptions (including sections 30, 31, 35, 36 and 42, also discussed below) require the public authority to go on and weigh the public interest in disclosure against the public interest in maintaining the exemption and disclosure must follow unless the latter outweighs the former.

HMRC, as a Crown body listed in Schedule 1 to FOIA, is squarely within scope of the Act. Requests must be made in writing (including by email), must state the requester’s real name and must describe the information sought with reasonable specificity. HMRC must respond within 20 working days, either providing the information, confirming an exemption applies (with reasons) or confirming that it does not hold the information.

The Section 44 Absolute Exemption and the CRCA 2005 Mechanism

Section 44(1)(a) FOIA provides an absolute exemption for information whose disclosure (otherwise than under the Act) is prohibited by or under any enactment. This is sometimes called a “statutory bar” exemption: FOIA defers to whatever other statute already prohibits disclosure, rather than creating its own substantive test. For HMRC, the relevant enactment is section 18 of the Commissioners for Revenue and Customs Act 2005.

Section 18(1) CRCA 2005 imposes a duty of confidentiality on HMRC officials: a person who is or was a Revenue and Customs official may not disclose information that is held by the Revenue and Customs in connection with a function of the Revenue and Customs and that relates to a person whose identity is specified in or can be deduced from, the disclosure. Section 19 CRCA makes wrongful disclosure of such information a criminal offence in specified circumstances, underlining that this is a substantive statutory prohibition, not a mere internal policy.

Section 18(2) and (3) CRCA then set out a list of circumstances in which disclosure is nonetheless permitted – for example, disclosure with consent, disclosure for the purposes of a function of the Revenue and Customs, disclosure for specified law enforcement and statistical purposes and disclosure required by another enactment or court order. Critically, section 23 CRCA expressly disapplies most of these carve-outs for the specific purpose of determining whether disclosure is prohibited by or under an enactment for the purposes of section 44(1)(a) FOIA. In other words, Parliament anticipated that requesters would try to use the section 18(2)/(3) gateways to argue that disclosure was not, after all, prohibited and closed that route off specifically in the FOIA context. The practical effect is that the section 18(1) duty operates close to absolutely for FOIA purposes: if information relates to an identifiable person and was held by HMRC in connection with its functions, section 44 will almost always bite, regardless of whether one of the general section 18(2)/(3) gateways might otherwise have permitted disclosure in a different context.

Two further points sharpen the scope of section 18(1). First, the prohibition applies only where the identity of the person concerned is specified in the disclosure or can be deduced from it. A request that seeks genuinely anonymised or aggregated information – for example, statistics on the number of COP9 cases resulting in prosecution in a given year, without any case-level detail – falls outside section 18(1) because no individual’s identity is specified or deducible. Second, the information must be held “in connection with a function of the Revenue and Customs”, which is a wide formulation covering essentially all of HMRC’s casework, but does not extend to information HMRC holds in some other capacity (for example, as an ordinary employer or landlord) unrelated to its tax functions.

Section 40(1): Why Your Own Data Needs a Different Route

Section 44 is not the only absolute exemption capable of blocking an FOI request aimed at identifiable taxpayer information, and for a requester asking about their own affairs it is not even the most direct one. Section 40(1) FOIA provides a free-standing absolute exemption for any information that constitutes the applicant’s own personal data and, unlike section 44, requires no separate enactment to be identified: the fact that the data subject is also the person making the request is sufficient on its own. Where section 40(1) applies, HMRC should not simply refuse the request; the correct course is to explain that the requester’s own data must be sought through a subject access request under Article 15 UK GDPR rather than FOI.

In practice, section 40(1) and section 44/CRCA 2005 will often overlap on the same facts, but they do different jobs. Section 44 (via the section 18 CRCA confidentiality duty) is aimed primarily at protecting third-party identifiable taxpayer information from disclosure to the world at large, regardless of who is asking. Section 40(1) exists specifically to redirect a requester who is asking about themselves into the data protection regime. Practitioners should expect HMRC to rely on section 40(1) as the more precise tool wherever a request is unambiguously about the requester’s own tax affairs and should not be misled into thinking the confidentiality-duty route is the only, or even the primary, obstacle.

Other Exemptions HMRC Relies On

Even where section 44 is not engaged because the requested information does not relate to an identifiable person, HMRC has a further set of qualified exemptions available, each requiring a public interest balancing test.

Section 31 – Law Enforcement

Section 31 exempts information whose disclosure would be likely to prejudice the prevention or detection of crime, the apprehension or prosecution of offenders or the assessment or collection of any tax or duty. This closely mirrors the DPA 2018 crime and taxation exemption discussed in our companion guide on subject access requests and the same underlying logic applies: a prejudice test, not a category-based exclusion and HMRC must show how disclosure of the specific information requested would cause the relevant prejudice, not simply assert that the topic is sensitive.

Section 30 – Investigations and Proceedings

Section 30 exempts information held for the purposes of an investigation that the public authority has a duty to conduct with a view to ascertaining whether a person should be prosecuted or for the purposes of criminal proceedings the authority has power to conduct. The Upper Tribunal’s decision in Edward Williams v Information Commissioner [2023] UKUT 142 (AAC), concerning the Independent Office for Police Conduct, confirms that a body can rely on this exemption even where it is not itself the body that ultimately decides whether to prosecute, provided it has a relevant statutory investigatory function feeding into that decision. Although that case did not concern HMRC, the same reasoning would apply to HMRC’s Fraud Investigation Service, which investigates with a view to a charging decision made by the Crown Prosecution Service.

Sections 35 and 36 – Policy Formulation and Effective Conduct of Public Affairs

Section 35 exempts information held by a government department relating to the formulation or development of government policy, including ministerial communications and advice from law officers. Section 36 exempts information whose disclosure would, in the reasonable opinion of a qualified person, be likely to prejudice the effective conduct of public affairs – for example by inhibiting the free and frank provision of advice or exchange of views. HMRC frequently relies on these exemptions to withhold draft guidance, internal discussions about how a piece of legislation should be interpreted before a final policy position is settled and internal deliberations about operational priorities. Both are qualified exemptions, so the public interest in transparency about how tax policy and enforcement priorities are formed must be weighed against the public interest in protecting candid internal deliberation; the balance shifts in favour of disclosure once a policy is settled and is simply not yet published.

Section 32 – Court Records

Section 32 provides an absolute exemption for information held only by virtue of being contained in a document filed with or otherwise placed in the custody of, a court for the purposes of proceedings or in a document served on a public authority for the purposes of proceedings. This is why FOI is not the right route to obtain tribunal bundle material in an ongoing tax appeal; the better route, where the documents are not otherwise available, is the open justice principle recognised in Aria Technology Ltd v HMRC (Situation Publishing Ltd as third party) [2018] UKUT 111 (TCC), under which the Upper Tribunal recognised a strong presumption in favour of third-party access to tribunal documents, particularly notices of appeal and grounds of appeal, once proceedings are under way.

Section 42 – Legal Professional Privilege

Section 42 provides a qualified exemption for information in respect of which a claim to legal professional privilege could be maintained in legal proceedings. HMRC relies on this to withhold internal legal advice, including advice from its Solicitor’s Office on the merits or conduct of a specific case or on a point of general legal interpretation. The same general LPP principles discussed in our DSAR guide apply equally here – advice privilege is confined to advice from qualified lawyers and litigation privilege requires litigation to be reasonably in contemplation – though as a qualified exemption, the public interest balance must still be conducted even where privilege genuinely attaches.

Section 21 – Information Reasonably Accessible by Other Means

Section 21 is an absolute exemption, but a narrow and practitioner-friendly one: it applies only where the requested information is already reasonably accessible to the requester by other means, typically because it is already published. HMRC sometimes uses section 21 to point a requester to an existing published manual page rather than disclosing further detail. Where the published material does not actually contain the specific detail requested, section 21 is not engaged and HMRC must address the substance of what is actually missing from the published version.

What FOI Can Actually Obtain From HMRC

Given the scope of section 44, the productive use of FOI against HMRC is concentrated in a specific set of categories:

• Unpublished or superseded internal guidance – earlier versions of manual pages, internal technical notes elaborating on a published position and guidance given to specific HMRC teams that has not been folded into the public manuals.
• Statistics and aggregated data – settlement rates, prosecution rates, average penalty levels by behaviour category, regional enforcement activity and Connect-related statistics that do not identify individuals.
• Process and criteria information – the internal criteria HMRC applies when deciding whether to offer a contract settlement, when to escalate a civil enquiry to COP9 or when to issue a Personal Liability Notice, provided the request is framed around the criteria rather than their application to a specific case.
• Historic policy positions – correspondence and internal papers showing how a current published position was arrived at, useful where a taxpayer wants to argue that HMRC’s current interpretation represents a change of practice with implications for legitimate expectation.
• Information about systems and tools – the categories of data sources feeding into Connect (as opposed to any specific risk score or flag relating to an individual), procurement and contractual information about third-party data-sharing arrangements and information about retention periods and data-sharing agreements with other departments.

Each of these categories is genuinely obtainable because none of them, properly framed, requires HMRC to disclose information that specifies or allows the deduction of any individual’s identity and the qualified exemptions discussed above, while real obstacles, are subject to a public interest test that frequently favours disclosure for this kind of institutional, rather than case-specific, information.

Case Law and Decision Notices

The CRCA 2005 / FOIA 2000 Interaction

The interaction between section 18 CRCA and section 44 FOIA and the specific role of section 23 CRCA in closing off the section 18(2)/(3) gateways for FOIA purposes, has been confirmed repeatedly in ICO decision notices and is reflected in HMRC’s own internal guidance to caseworkers handling FOI requests, which directs staff to treat any information specifying or allowing deduction of an identifiable taxpayer’s identity as falling within section 44 as a matter of course. Practitioners should not expect to successfully argue around this mechanism by reference to the general section 18(2)/(3) exceptions; the statutory drafting was specifically designed to prevent that argument succeeding in the FOIA context.

Edward Williams v Information Commissioner [2023] UKUT 142 (AAC)

The Upper Tribunal (Administrative Appeals Chamber) considered whether the Independent Office for Police Conduct could rely on the section 30(1)(a)(i) investigations exemption notwithstanding that it was not itself the body responsible for the ultimate charging decision. The Tribunal accepted the Information Commissioner’s submission that a body with a statutory duty to investigate with a view to a charging decision can rely on the exemption even though a different body makes that final decision, reasoning that a narrower reading would undermine the purpose of protecting the integrity of the investigative process. The analogous read-across for HMRC is that its Fraud Investigation Service can rely on section 30 in relation to material generated during a criminal investigation, notwithstanding that charging decisions in England and Wales rest with the Crown Prosecution Service rather than HMRC itself.

Aria Technology Ltd v HMRC (Situation Publishing Ltd as third party) [2018] UKUT 0111 (TCC)

The Upper Tribunal (Tax and Chancery Chamber) considered an application by a third-party journalist for access to the notice of appeal, grounds of appeal and HMRC’s response in a VAT fraud appeal. The Tribunal held that there is a strong presumption in favour of open justice and access to tribunal documents, particularly where sought for journalistic or analytical purposes and ordered disclosure of the principal pleadings once the time for appealing that decision had passed. For practitioners, this case is the reminder that the open justice principle – not FOIA, which is excluded from court-held material by section 32 – is the correct route to documents already before the tribunal in a live or concluded tax appeal.

Drafting an Effective FOI Request

The most common reason an FOI request to HMRC fails is that it is framed, even inadvertently, in a way that specifies or allows deduction of an identifiable individual’s identity, triggering section 44 regardless of the requester’s actual interest in non-identifying material. The following principles consistently improve outcomes:

1. Never reference a specific taxpayer, case reference or sufficiently narrow fact pattern that would allow HMRC (or a reader of the response) to deduce whose case is involved, even where the requester already knows the answer for their own client. If the underlying interest is genuinely about that client’s own data, use a DSAR instead.
2. Frame requests around criteria, statistics, guidance and process, not outcomes in specific cases. “What internal criteria does HMRC apply when deciding whether to offer a contract settlement instead of pursuing a criminal investigation” is answerable; “why was my client offered/refused a contract settlement” is not.
3. Ask for statistics in aggregated form with a stated minimum cohort size, anticipating that HMRC may otherwise refuse on the basis that a small cohort would risk indirect identification.
4. Request specific document types by name where known – named internal manual chapters, specific guidance titles, named policy papers – rather than open-ended categories, to reduce the scope for a “disproportionate cost” refusal under section 12 FOIA (which permits refusal where compliance would exceed the appropriate cost limit).
5. Anticipate the section 21 redirect by checking HMRC’s published manuals first and, where the request seeks something genuinely absent from the published version, say so explicitly in the request to forestall a section 21 refusal.
6. Where section 35/36 is in play, frame the request to target settled rather than live policy positions and consider requesting confirmation of the date a position was settled if that itself is unclear.

Challenging a Refusal: Review, ICO, Tribunal

Where HMRC refuses a request, in whole or in part, three escalating routes are available:

1. Internal review. HMRC operates an internal review process; a review request should specifically engage with the exemption claimed (for example, challenging whether the requested statistic genuinely allows deduction of an individual’s identity or arguing the public interest balance under section 35/36) rather than simply restating the original request.
2. Complaint to the Information Commissioner’s Office. The ICO will investigate and issue a decision notice, which can require disclosure where it finds the exemption was wrongly applied or the public interest balance wrongly struck. ICO decision notices concerning HMRC are published and form a useful body of precedent on how specific exemptions have been applied in practice.
3. Appeal to the First-tier Tribunal (Information Rights). Either party can appeal an ICO decision notice to the First-tier Tribunal, which can substitute its own decision and from there a further appeal lies to the Upper Tribunal on a point of law only.

Because qualified exemptions require a public interest balancing exercise, refusals based on sections 30, 31, 35, 36 or 42 are generally more vulnerable to challenge than refusals based on section 44, where the only live argument is usually whether the underlying CRCA 2005 conditions (identifiability, connection with a Revenue and Customs function) are actually met on the facts.

Tactical Use of FOI in Tax Disputes

Used as part of a wider case strategy rather than as a single isolated request, FOI can materially strengthen a tax dispute in several ways:

• Legitimate expectation arguments. Where a client wants to argue HMRC has departed from a previously settled practice, FOI-obtained historic guidance versions and internal papers showing when and why a position changed can be the central evidential plank of that argument.
• Penalty mitigation and behaviour categorisation. Statistics on how frequently a given fact pattern results in a “careless” versus “deliberate” categorisation, obtained in aggregated form, can support submissions on proportionality and consistency of treatment, even though they cannot determine the outcome of any individual case.
• COP9 and escalation criteria. Internal criteria for case selection, obtained by FOI, can be used to test whether HMRC’s stated reasons for escalating a case to COP9 or referring it to the Fraud Investigation Service are consistent with its own published or internally-applied thresholds.
• Understanding data-sharing arrangements. Where a client’s enquiry appears to have been triggered by third-party data, FOI requests about the categories of data shared under specific international agreements (CRS, FATCA) or domestic data-sharing arrangements can corroborate or contextualise findings made through a parallel DSAR.

Run in combination with a DSAR – FOI for the institutional and policy picture, DSAR for the client’s own case-specific data – the two disclosure routes are genuinely complementary rather than substitutes for one another and using only one typically leaves significant available material undiscovered.

Practitioner Checklist

1. Confirm the request is genuinely about institutional/policy information, not a specific client’s own data – use a DSAR for the latter.
2. Check the request cannot, even indirectly, specify or allow deduction of an identifiable taxpayer’s identity.
3. Check HMRC’s published manuals first to forestall a section 21 redirect and state explicitly if the published version is incomplete.
4. Frame statistical requests with an aggregation threshold to avoid a small-cohort identifiability refusal.
5. Anticipate which qualified exemption (ss.30, 31, 35, 36, 42) is most likely to be raised and address the public interest balance pre-emptively in the request.
6. On refusal, use internal review to engage substantively with the specific exemption and public interest reasoning given.
7. Escalate unresolved refusals to the ICO and from there to the First-tier Tribunal (Information Rights) if necessary.
8. Combine with a parallel DSAR where the dispute also requires access to the client’s own case-specific HMRC data.

Frequently Asked Questions

Related guides in this series

• Data Subject Access Requests Against HMRC: The Crime & Taxation Exemption
• Legal Professional Privilege in HMRC Investigations
• Judicial Review of HMRC Decisions
• Financial Institution Notices & HMRC’s Information Notice Framework