Credit: Karl-Josef Hildenbrand/DPA/Press Association Images

HM Revenue and Customs has spent £3.2m on software tools and access to databases that can provide individual and bulk data on UK citizens and businesses.

The tax agency has signed a three-year contract with IT reseller SCC, with work sub-contracted to software firm GBG Connexus, which describes its technology as a “trace and investigate solution”.

Under the terms of the deal, HMRC will have access to the company’s “flat file” offering, which provides bulk data on the last 10 years of electoral roll information, citizens’ dates of birth and death, addresses, postcode grid references, and email and telephone contact details where consent has been given. The flat file also covers company information, including financial data, as well as addresses and telephone numbers for businesses and their directors – including those that have been disqualified.

The department will receive all this information via bulk monthly updates.

In addition to this, 6,000 users – primarily HMRC’s fraud and risk professionals, who have powers to conduct criminal investigations – will have access to a web portal that will allow them to “locate, confirm and validate an individual’s identity”. This service will tap into an expanded version of the data sources provided in the flat file.

A total of 223 of the tax agency’s investigators will be given access to the “enhanced” product which, in addition to the flat file databases, also allows “real-time lookup [of] previous and forwarding addresses” linked to credit products, as well as “links for alias names”.

This data is updated daily, as is the information that powers the “live landline and mobile validation service”, which enables enhanced licensees to check whether a phone number is still live and – in the case of live mobile numbers – the country location and current network connection of the phone.

The contract reveals that bulk data is hosted at a GBG-owned datacentre at the company’s UK headquarters in Chester.

“The datacentre has key card access that is limited to authorised personnel, CCTV is in place and all perimeters under control with alarms and motion detection,” the document added.

The web portal, meanwhile, is hosted by Amazon Web Services at its London datacentre facility.

The contract came into effect on 31 March, and is due to expire on 30 March 2024.