Reports of Fraud
At the end of May nearly 2,000 reports had been made to HMRC of suspected furlough fraud, with whistleblowing organisations saying many more are likely to come forward. This is also likely to increase once penalties start to be issued and employees start to worry about being caught and punished for going along with their employers that have breached the scheme rules.
We have already seen the revenue authorities in the Republic of Ireland contacting all employers to confirm: they meet the eligibility criteria for its Temporary Wage Subsidy Scheme (the equivalent of the UK’s Job Retention Scheme), that employees are receiving the correct amount of subsidy, and the subsidy amount is being correctly recorded in employee payslips. Employers are being required to send in employee payslips in support of their responses.
Government Action
The UK has drafted legislation (due to be passed in July) that will give HMRC the power to check grants made to employees through the job retention scheme and allow it to reclaim any overpaid money through income tax assessments. Where HMRC suspects fraud it will take criminal and civil enforcement action, including pursuing company office holders where businesses have become insolvent.
To give businesses a chance to come clean about any “errors”, the legislation will allow them 30 days to report these to HMRC; if they don’t report and are later caught, they will face severe enforcement action.
Data protection
Some employers are already questioning whether tax authorities have the right to see payslips, especially those that may contain what is perceived to be sensitive and unrelated information. Concerns have also been expressed about whether employers would breach the Data Protection Act (GDPR) by releasing this information.
Tax authorities have the authority to demand information by way of legislation, and just because they may request this information to be sent by email, this should not be seen as being any different to seeing it if it was part of an onsite inspection.
In so far as data protection is concerned, businesses should refer to Article 6(1)(c) of GDPR which provides a lawful basis for processing where “Processing is necessary for compliance with a legal obligation to which the controller is subject”. The Information Commissioner’s Office website provides this example for where this lawful basis applies, “An employer needs to process personal data to comply with its legal obligation to disclose employee salary details to HMRC. The employer can point to the HMRC website where the requirements are set out to demonstrate this obligation. In this situation it is not necessary to cite each specific piece of legislation.”
It is clear enforcement agencies are going to be working hard to catch those who have or attempt to defraud the public purse, but they are also pragmatic enough to recognise that some businesses may want to come clean if given the opportunity. It would be advisable to take this opportunity before matters were to get out of hand.
We are committed to helping our customers in these difficult times and can provide various resources and services that can help you manage your regulatory compliance. Download our complete legal solutions catalogue for more information.