STANDARD MODEL FOI LETTER – FOR UK PUBLIC BODIES (example: to HMRC)
Target: HM Revenue & Customs (HMRC)
Focus: Liability for Data Sharing with Spain (AEOI/CRS) & Failure to Recover Losses from Officials.
[Copy and Paste into Email/PDF]
To: Freedom of Information Team / Data Protection Officer
Email: foi.request@hmrc.gov.uk
Re: Freedom of Information Request – Disclosures Relating to [Automatic Exchange of Information (AEOI/CRS) Transfers to Spain] by [HMRC] and Potential Locus for COCOO
I write on behalf of Competition & Consumer Organisation Party Limited (COCOO.uk), a charity dedicated to protecting the Wider Public Interest (WPI) and the taxpayer. We intervene in regulatory failures where the harm is diffuse (affecting the general public or fragmented groups) and where an “enforcement vacuum” exists because no individual victim has the financial incentive to sue.
This request is made to assess whether the specific DORCAP (Decision, Omission, Regulation, Conduct, Action, or Policy) referenced above—specifically the transfer of taxpayer data to a jurisdiction (Spain) operating an illegal penalty regime—meets the criteria for “Rule of Law” intervention established in Walton v Scottish Ministers [2012]. Specifically, we seek to verify if this matter involves ultra vires conduct, misfeasance, abuse of power, bad faith, failure to notify or assess ultra vires risks and foreseeable harms, or reckless conduct causing competition distortions, thereby supporting COCOO’s locus standi and potential success in a judicial review claim or intervention.
Under the Freedom of Information Act 2000, please provide the following information in electronic format where possible. If any part is exempt, provide reasons and consider redacted disclosure where feasible.
PART 1: ESTABLISHING THE “ENFORCEMENT VACUUM” (Locus Standi Data)
To confirm COCOO’s standing under the Lord Hope principle, we require evidence of diffuse or fragmented harms, low individual incentives to sue, and absence of other claimants.
-
Victim Demographics and Harm Diffusion: Please provide a breakdown of the number of complaints or representations received regarding data sharing with Spain (AEAT) in the last 5 years, categorised by complainant type (e.g., “Individual/Household,” “Micro-SME,” vs. “Large Corporate”). Include any internal estimates of the total number of affected parties and whether the harm is assessed as diffuse (spread across many with minimal individual impact) or fragmented.
-
The “Rational Apathy” Economics: Does the Authority hold any impact assessment, internal memo, or economic analysis that estimates the average financial loss or detriment per person resulting from this DORCAP? If yes, disclose the key figures or summaries confirming that individual losses are de minimis, making private litigation uneconomic.
-
Litigation History and Claimant Vacuum: Has any commercial entity, trade association, or individual commenced Judicial Review proceedings, civil litigation, or formal challenges against HMRC regarding CRS data transfers to Spain in the last 3 years? If yes, specify the nature and status; a “Nil” return would confirm the enforcement vacuum.
PART 2: LEGALITY & RISK (Governance Checks)
To evaluate grounds for success in challenging the DORCAP as ultra vires, misfeasance, or similar wrongs.
-
Ultra Vires Risk Assessment: Please disclose the existence (and, if not privileged, a redacted summary) of any Risk Register entry, Board Submission, or internal advice that flagged the risk of Data Sharing with non-compliant EU jurisdictions (Spain) as “Medium” or “High” risk for ultra vires conduct or Human Rights breaches. Specifically, did the legal team notify the Senior Responsible Officer (SRO) of these risks prior to the CJEU Judgment C-788/19?
PART 3: SPECIFIC CIRCUMSTANCES – THE “REGRESO” TRAP
To gather targeted evidence linking the DORCAP to COCOO’s intervention criteria regarding the failure to recover public funds.
Confirm whether the Department has ever exercised its rights under the Civil Liability (Contribution) Act 1978 or claimed breach of contract under the Civil Service Code to recover damages, settlements, or legal costs from its own officials following a finding of misfeasance, gross negligence, or bad faith. Specifically:
-
Provide the total number of such financial recovery actions attempted against officials in the last 10 years.
-
Compare this against the total number of liability payouts (settlements or court awards) made by the Department in the same period.
-
If the number of recovery actions is zero, confirm if this reflects a policy decision to absorb all liabilities caused by official misconduct, effectively waiving the taxpayer’s statutory right to restitution before the 2-year limitation period expires.
PART 4: SYSTEMIC ASPECTS AND AUDIT TRAIL
To determine if the risk of ultra vires conduct is being monitored or hidden.
-
Internal Audit Schedule: Provide the titles and dates of any Internal Audit reports finalized in the last 3 years that specifically examined the “Management of Legal Risk” or “International Data Exchange Compliance.”
-
Board Oversight: Confirm if the Audit & Risk Committee has received any “Red” or “Amber” rated assurance reports regarding the failure to notify or mitigate ultra vires risks in the last 24 months.
-
NAO Interaction: Confirm if the department has disclosed the potential “contingent liability” of claims related to Modelo 720/Data Sharing to the National Audit Office (NAO) for the most recent Annual Report & Accounts.
Advice and Assistance
If you determine that this request exceeds the cost limit (Section 12), please contact me immediately under your Section 16 duty to provide advice and assistance, so that we may refine the request to fit within the limit.
Sincerely,
Oscar Moya
Director, COCOO.uk