HMRC failed to comply with GDPR and exposed my information to another person

o12011

Approximately 3 years ago, I became a foster carer.

This meant I had to register for self assessment, which I did in early 2019. I received my UTR and subsequently requested my activation code to access my self assessment. I waited 14 days and nothing arrived, so contacted HMRC who advised I had to wait a further 14 days and if it still doesn't arrive, request a new one. I waited, nothing arrived, so I requested a new one. Again, nothing arrived, I went through this cycle for almost a year! During this time, due to mental health issues (and hearing such tragic stories of children I was to care for), I made the decision to return to employment and end my foster care journey. The issue with self assessment had totally gone out of my mind - foolishly!

Fast forward to early 2021, I started doing freelance work, which I needed to again access self assessment for. This time I persisted with the same cycle of waiting for a code which never arrived, until 3 months later, I was fortunate to speak to a very helpful adviser at HMRC who advised that as I had waited more than the 10 working days they advise, they was able to allow access manually from their side. I was very pleased that after 2 years of trying, I finally had access!!

I logged in and noticed around 15 messages were on my account, upon looking there was countless messages stating my tax return was late, then they had issued penalties, then interest on those penalties, etc. I clicked into one of the messages and immediately noticed the letters have all been sent to an address I moved from 9 years ago (3 addresses ago)!! - I had been through security a number of times with HMRC where my address was confirmed and not once had anyone said anything!

Immediately, I called back and spoke to a lady who confirmed they had my current address on her system, but on a separate system where the letters had been generated from had my old address. I asked how this was possible when the UTR number was sent to my current address (where I have resided for 5 years), she again advised that they were separate systems. I explained that this was very concerning to me as I had moved out 10 years ago and had 2 other addresses in between. She said this must have been my most recent employers error, which didn't make sense as my most recent employer I had been with since July 2014 which was 2 years after I had moved out of the address where the letters were going - so my employer never had that address... or even knew about it!

Anyway, I submitted the outstanding tax returns and then made an appeal in May 2021 and was advised that a decision would be given by June 2021. They have postponed this deadline multiple times and I have just been advised they will have a decision by 13th September 2021.

Has anyone else gone through anything similar? Also do I have a case for compensation or at least the penalty charges wiped out due to HMRC failing to comply with GDPR. My information was sent on multiple occasions to a property I moved out from 9 years ago and therefore, by failing to keep my data accurate and up to date, my information has been exposed to someone else.

Ditzy_Mitzy

All you can do is be reasonable in your dealings with HMRC and hope they see your side of things.  They have made an administrative error, however your case is weakened somewhat by the fact that you haven't declared income in the years it was earned.  You knew tax returns were required, given your attempts to register for self-assessment.  Unfortunately you can't ignore HMRC and they don't go away.  They might waive some of the charges, but you'll get further by being nice to them.  I can't see a complaint getting anywhere.  
GDPR issue is neither here nor there.  You haven't any proof that the new occupant of the address actually opened any of the letters for a start.  He might have returned them to sender unopened.  

The_Fat_Controller

I think the clue is in your OP "I went through this cycle for almost a year"

If it didn't work twice you should have asked them why.