Legalize / United Kingdom / Public General Act

Digital Economy Act 2017

Type Public General Act

Publication 2017-04-27

Last updated 2026-02-12

State In force

Department Statute Law Database

Source legislation.gov.uk

articles Not indexed

Reform history JSON API

(e) such other persons as the appropriate national authority thinks appropriate.

(12) The fact that this section was not in force when consultation of the kind mentioned in subsection (11) took place is to be disregarded in determining whether there has been compliance with that subsection.

Further provisions about power in section 48

49

(1) Personal information disclosed under section 48 may only be used by the person to whom it is disclosed for the purposes for which it was disclosed, subject to subsection (2).

(2) Subsection (1) does not prevent the use of information by a person—

(a) if the information has already lawfully been made available to the public,

(b) if the person to whom the information relates consents to its use for another purpose,

(d) for the purposes of a criminal investigation,

(e) for the purposes of legal proceedings (whether civil or criminal),

(f) for the purposes of safeguarding vulnerable adults or children, or

(g) for the purposes of protecting national security.

(3) In subsection (2)(c) “anti-social behaviour” means conduct that—

(a) is likely to cause harassment, alarm or distress to any person, or

(b) is capable of causing nuisance or annoyance to a person in relation to that person's occupation of residential premises.

(4) Subsection (2) does not apply to information disclosed to a person under section 48 by the Revenue and Customs; but such information may be used by that person for purposes other than those for which it was disclosed with the consent of the Commissioners for Her Majesty's Revenue and Customs (which may be general or specific).

(5) For the purposes of this Chapter information is “personal information” if—

(a) it relates to and identifies a particular person (including a body corporate), but

(b) it is not information about the internal administrative arrangements of a specified person.

(6) For the purposes of subsection (5) information identifies a particular person if the identity of that person—

(a) is specified in the information,

(b) can be deduced from the information, or

(7) A disclosure under section 48 does not breach—

(a) any obligation of confidence owed by the person making the disclosure, or

(b) any other restriction on the disclosure of information (however imposed).

(8) But nothing in section 48 authorises the making of a disclosure which—

(a) contravenes the data protection legislation, or

(b) is prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016.

(9) Until the repeal of Part 1 of the Regulation of Investigatory Powers Act 2000 by paragraphs 45 and 54 of Schedule 10 to the Investigatory Powers Act 2016 is fully in force, subsection (8)(b) has effect as if it included a reference to that Part.

(10) Section 48 does not limit the circumstances in which information may be disclosed apart from that section.

(11) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Confidentiality of personal information

50

(1) Personal information received by a person (“P”) under section 48 may not be disclosed—

(a) by P, or

(b) by any other person who has received it directly or indirectly from P.

(2) Subsection (1) does not apply to a disclosure—

(a) which is required or permitted by any enactment (including section 48),

(b) which is required by an EU obligation,

(d) of information which has already lawfully been made available to the public,

(e) which is made for the prevention or detection of crime or the prevention of anti-social behaviour,

(f) which is made for the purposes of a criminal investigation,

(g) which is made for the purposes of legal proceedings (whether civil or criminal),

(h) which is a protected disclosure for any of the purposes of the Employment Rights Act 1996 or the Employment Rights (Northern Ireland) Order 1996 (SI 1996/1919 (NI 16)),

(i) consisting of the publication of information for the purposes of journalism, where the publication of the information is in the public interest,

(j) which is made with the consent of the person to whom it relates,

(k) which is made for the purposes of safeguarding vulnerable adults or children, or

(l) which is made for the purposes of protecting national security.

(3) In subsection (2)(e) “anti-social behaviour” means conduct that—

(a) is likely to cause harassment, alarm or distress to any person, or

(b) is capable of causing nuisance or annoyance to a person in relation to that person's occupation of residential premises.

(4) A person commits an offence if—

(a) the person discloses personal information in contravention of subsection (1), and

(b) at the time that the person makes the disclosure, the person knows that the disclosure contravenes that subsection or is reckless as to whether the disclosure does so.

(5) A person who is guilty of an offence under subsection (4) is liable on conviction on indictment to imprisonment for a term not exceeding two years, to a fine or to both.

(6) A person who is guilty of an offence under subsection (4) is liable on summary conviction—

(a) in England and Wales, to imprisonment for a term not exceeding the general limit in a magistrates’ court, to a fine or to both;

(b) in Scotland, to imprisonment for a term not exceeding 12 months, to a fine not exceeding the statutory maximum or to both;

(c) in Northern Ireland, to imprisonment for a term not exceeding 6 months, to a fine not exceeding the statutory maximum or to both.

(7) In the application of subsection (6)(a) to an offence committed before 2 May 2022 the reference to the general limit in a magistrates’ court is to be read as a reference to 6 months.

(8) This section does not apply to personal information disclosed under section 48 by the Revenue and Customs.

Information disclosed by the Revenue and Customs

51

(1) Personal information disclosed by the Revenue and Customs under section 48 and received by a person may not be disclosed by that person.

(2) Subsection (1) does not apply to a disclosure which is made with the consent of the Commissioners for Her Majesty's Revenue and Customs (which may be general or specific).

(3) A person who contravenes subsection (1) is guilty of an offence.

(4) It is a defence for a person charged with an offence under subsection (3) to prove that the person reasonably believed—

(a) that the disclosure was lawful, or

(b) that the information had already and lawfully been made available to the public.

(5) Subsections (4) to (7) of section 19 of the Commissioners for Revenue and Customs Act 2005 apply to an offence under subsection (3) as they apply to an offence under that section.

Code of practice

52

(1) The relevant Minister must issue a code of practice about—

(a) the disclosure of information under section 48, and

(b) the use of information disclosed under that section.

(2) The code of practice must be consistent with the code of practice prepared under section 121 of the Data Protection Act 2018 (data-sharing code) and issued under section 125(4) of that Act (as altered or replaced from time to time).

(3) A specified person must have regard to the code of practice in—

(a) disclosing information under section 48, and

(b) using information disclosed under that section.

(4) The relevant Minister may from time to time revise and re-issue the code of practice.

(5) Before issuing or reissuing the code of practice the relevant Minister must consult—

(a) the Information Commissioner,

(b) the Commissioners for Her Majesty's Revenue and Customs,

(d) the Welsh Ministers,

(e) the Department of Finance in Northern Ireland, and

(f) such other persons as the relevant Minister thinks appropriate.

(6) The fact that this section was not in force when consultation of the kind mentioned in subsection (5) took place is to be disregarded in determining whether there has been compliance with that subsection.

(7) The relevant Minister may not issue the code of practice unless a draft of the code has been laid before, and approved by a resolution of, each House of Parliament.

(8) Before reissuing the code the relevant Minister must lay a draft of the code as proposed to be reissued before Parliament.

(9) The relevant Minister may not reissue the code if, within the 40-day period, either House of Parliament resolves not to approve it.

(10) In subsection (9) “the 40 day period” means—

(a) the period of 40 days beginning with the day on which the draft is laid before Parliament, or

(b) if the draft is not laid before each House on the same day, the period of 40 days beginning with the later of the days on which it is laid before Parliament.

(11) For the purposes of subsection (10) no account is to be taken of any period during which Parliament is dissolved or prorogued or during which both Houses are adjourned for more than four days.

(12) As soon as is reasonably practicable after issuing or reissuing the code of practice the relevant Minister must lay, or arrange for the laying of, a copy of it before—

(a) the Scottish Parliament,

(b) the National Assembly for Wales, and

(13) In disclosing information under section 48, a person must have regard to the following codes of practice issued by the Information Commissioner under section 124A of the Data Protection Act 2018 (other codes of practice), so far as they apply to the information in question—

(a) any code which makes provision about the identification and reduction of the risks to privacy of a proposal to disclose information;

(b) any code which makes provision about the information to be provided to data subjects (within the meaning of that Act) about the use to be made of information collected from them.

(14) The duty in subsection (13) does not affect any other requirement for the person to have regard to a code of practice in disclosing the information.

Duty to review operation of Chapter

53

(1) As soon as is reasonably practicable after the end of three years beginning with the day on which this Chapter comes into force, the relevant Minister must review its operation for the purposes of deciding whether it should be amended or repealed.

(2) Before carrying out the review the relevant Minister must publish the criteria by reference to which that determination will be made.

(3) In carrying out the review the relevant Minister must consult—

(a) the Information Commissioner,

(b) the Scottish Ministers,

(d) the Department of Finance in Northern Ireland, and

(e) such other persons as the relevant Minister thinks appropriate.

(4) Once the review is completed the relevant Minister must—

(a) publish a report on its outcome, and

(b) lay, or arrange for the laying of, a copy of the report before—

(i) Parliament,

(ii) the Scottish Parliament,

(iii) the National Assembly for Wales, and

(iv) the Northern Ireland Assembly.

(5) If as a result of the review the relevant Minister decides that this Chapter should be amended or repealed, the relevant Minister may by regulations amend or repeal it (as the case may be).

(6) The power in subsection (5) to amend this Chapter—

(a) may be exercised for the purposes only of improving the effectiveness of the operation of the power in section 48(1), and

(b) may not be used to remove any of the safeguards relating to the use or disclosure of information in section 49, 50 or 51.

(7) The relevant Minister may only make regulations under subsection (5) with the consent of the Scottish Ministers if the regulations—

(a) repeal this Chapter,

(b) amend or remove the power of the Scottish Ministers to make regulations under section 48(5),

(d) affect the use by a Scottish body of information disclosed under that section by such a body, or

(e) affect the further disclosure to a Scottish body by such a body, or by a member, officer or employee of such a body, of information disclosed under this Chapter by a Scottish body.

(8) The relevant Minister may only make regulations under subsection (5) with the consent of the Welsh Ministers if the regulations—

(a) repeal this Chapter,

(b) amend or remove the power of the Welsh Ministers to make regulations under section 48(5),

(d) affect the use by a Welsh body of information disclosed under that section by such a body, or

(e) affect the further disclosure to a Welsh body by such a body, or by a member, officer or employee of such a body, of information disclosed under this Chapter by a Welsh body.

(9) The relevant Minister may only make regulations under subsection (5) with the consent of the Department of Finance in Northern Ireland if the regulations—

(a) repeal this Chapter,

(b) amend or remove the power of the Department to make regulations under section 48(5),

(d) affect the use by a Northern Ireland body of information disclosed under that section by such a body, or

(e) affect the further disclosure to a Northern Ireland body by such a body, or by a member, officer or employee of such a body, of information disclosed under this Chapter by a Northern Ireland body.

(10) The relevant Minister may only make regulations under subsection (5) with the consent of the Treasury in a case where the regulations could affect the disclosure of information by the Revenue and Customs.

(11) Anything required to be published by this section is to be published in such manner as the relevant Minister thinks fit.

Regulations under this Chapter

54

(1) Any power to make regulations under this Chapter is exercisable—

(a) in the case of regulations made by the relevant Minister or the Welsh Ministers, by statutory instrument, and

(b) in the case of regulations made by the Department of Finance in Northern Ireland, by statutory rule for the purposes of the Statutory Rules (Northern Ireland) Order 1979 (SI 1979/1573 (NI 12)).

(2) Regulations under this Chapter—

(a) may make different provision for different purposes;

(b) may contain consequential, supplementary, transitional or transitory provision or savings.

(3) In the case of regulations under section 48(5) which amend Schedule 7 so as to add an entry relating to a person or description of person, this includes power to make provision in relation to information disclosed by that person or a person of that description which is similar to that made by section 51 in relation to information disclosed by the Revenue and Customs.

(4) A statutory instrument containing regulations made under this Chapter by the relevant Minister may not be made unless a draft of the instrument has been laid before, and approved by a resolution of, each House of Parliament.

(5) Regulations made under section 48(5) by the Scottish Ministers are subject to the affirmative procedure.

(6) A statutory instrument containing regulations made under section 48(5) by the Welsh Ministers may not be made unless a draft of the instrument has been laid before, and approved by a resolution of, the National Assembly for Wales.

(7) Regulations under section 48(5) may not be made by the Department of Finance in Northern Ireland unless a draft of the regulations has been laid before, and approved by a resolution of, the Northern Ireland Assembly.

(8) If a draft of a statutory instrument containing regulations under section 48(5) would, apart from this subsection, be treated for the purposes of the standing orders of either House of Parliament as a hybrid instrument, it is to proceed in that House as if it were not such an instrument.

Interpretation of this Chapter

55

(1) In this Chapter—

“the appropriate national authority” means the relevant Minister, subject to subsections (2) to (4);

“enactment” includes—an enactment contained in, or in an instrument made under, an Act of the Scottish Parliament;an enactment contained in, or in an instrument made under, a Measure or Act of the National Assembly for Wales;an enactment contained in, or in an instrument made under, Northern Ireland legislation;an enactment contained in subordinate legislation within the meaning of the Interpretation Act 1978;

“functions” means functions of a public nature;

“Northern Ireland body” means—a Minister within the meaning of the Northern Ireland Act 1998,a Northern Ireland department,a Northern Ireland public authority within the meaning of the Statistics and Registration Service Act 2007, ora person providing services to a person within paragraph (a), (b) or (c);

“personal information” has the meaning given by section 49(5);

“public authority” means—a person or body exercising functions of a public nature in the United Kingdom,a person or body entirely or substantially funded from public money,an office-holder appointed by a person or body falling within paragraph (a), ora body more than half of whose governing body or members are appointed by a person or body falling within paragraph (a);

“relevant Minister” means the Secretary of State or the Minister for the Cabinet Office;

“the Revenue and Customs” has the meaning given by section 17(3) of the Commissioners for Revenue and Customs Act 2005;

“Scottish body” means—a person who is a part of the Scottish Administration,a Scottish public authority with mixed functions or no reserved functions (within the meaning of the Scotland Act 1998), ora person providing services to a person within paragraph (a) or (b);

“specified person” has the meaning given by section 48(4);

“Welsh body” means—a devolved Welsh authority as defined by section 157A of the Government of Wales Act 2006, ora person providing services to a devolved Welsh authority as defined by that section.

(2) The Scottish Ministers are the appropriate national authority in relation to regulations under section 48(5) which add, modify or remove an entry relating to a person who is, or a description of persons each of whom is, a Scottish body.

(3) The Welsh Ministers are the appropriate national authority in relation to regulations under section 48(5) which add, modify or remove an entry relating to a person who is, or a description of persons each of whom is, a Welsh body.

(4) The Department of Finance in Northern Ireland is the appropriate national authority in relation to regulations under section 48(5) which add, modify or remove an entry relating to a person who is, or a description of persons each of whom is, a Northern Ireland body.

CHAPTER 4 — Fraud against the public sector

Disclosure of information to combat fraud against the public sector

56

(1) A specified person may disclose information held by the person in connection with any of the person's functions to another specified person for the purposes of the taking of action in connection with fraud against a public authority.

(2) In this section and in Schedule 8 “fraud against a public authority” means a fraud offence which involves—

(a) loss to a public authority, or

(b) the exposure of a public authority to a risk of loss.

(3) In subsection (2)—

(a) “fraud offence” means an offence under section 1 of the Fraud Act 2006 or, in relation to Scotland, an offence of fraud, and

(b) “loss”, as it applies in relation to an offence under section 1 of the Fraud Act 2006, has the meaning given by section 5 of that Act.

(4) For the purposes of this section and Schedule 8 taking action in connection with fraud against a public authority includes any of the following—

(a) preventing fraud of that kind;

(b) detecting fraud of that kind;

(d) prosecuting fraud of that kind;

(e) bringing civil proceedings as a result of fraud of that kind;

(f) taking administrative action as a result of fraud of that kind.

(5) In this Chapter “specified person” means a person specified, or of a description specified, in Schedule 8.

(5A) Where in Schedule 8 functions are mentioned in relation to a specified person, the reference in subsection (1) to the person’s functions is limited to the person’s functions as mentioned in Schedule 8.

(6) The appropriate national authority may by regulations amend Schedule 8 so as to add, remove or modify an entry relating to a person or description of person.

(7) Regulations under subsection (6) may add an entry relating to a person or a description of person to Schedule 8 only if the following conditions are satisfied.

(8) The first condition is that—

(a) the person is a public authority or (as the case may be) each person of that description is a public authority, or

(b) the person provides services to a public authority or (as the case may be) each person of that description provides services to a public authority.

(9) The second condition is that the person or (as the case may be) a person of that description (“P” in either case)—

(a) requires information from a public authority or a person providing services to a public authority to improve P's ability to identify or reduce the risk of fraud against P or a public authority to which P provides services,

(b) has information which, if shared with a public authority or a person providing services to a public authority, has the potential to improve that authority's or that person's ability to identify or reduce the risk of fraud against that authority, or

(c) has functions of taking action in connection with fraud against a public authority, the exercise of which may be improved by the disclosure of information by or to P.

(10) In the case of a person (“P”) who is a specified person merely because of providing services to a public authority, the reference in subsection (1) to the functions of a specified person is limited to the functions P exercises for that purpose.

(11) In determining whether to make regulations under subsection (6) in relation to a person or description of person the appropriate national authority must have regard, in particular, to—

(a) the systems and procedures for the secure handling of information by that person or persons of that description, and

(b) in the case of regulations which remove a person from Schedule 8, whether that person, or any person providing services to that person, has had regard to the code of practice under section 60 as required by that section.

(12) Before making regulations under subsection (6) the appropriate national authority must consult—

(a) the Information Commissioner,

(b) the Commissioners for Her Majesty's Revenue and Customs,

(d) where the appropriate national authority is not the relevant Minister, the relevant Minister, and

(e) such other persons as the appropriate national authority thinks appropriate.

(13) The fact this section was not in force when consultation of the kind mentioned in subsection (12) took place is to be disregarded in determining whether there has been compliance with that subsection.

(14) In this Chapter “public authority” means—

(a) a person or body exercising functions of a public nature in the United Kingdom,

(b) a person or body entirely or substantially funded from public money,

(d) a body more than half of whose governing body or members are appointed by a person or body falling within paragraph (a).

Further provisions about power in section 56

57

(1) Personal information disclosed under section 56 may only be used by the person to whom it is disclosed for the purposes for which it was disclosed, subject to subsection (2).

(2) Subsection (1) does not prevent the use of information by a person—

(a) if the information has already lawfully been made available to the public,

(b) if the person to whom the information relates consents to its use for another purpose,

(d) for the purposes of a criminal investigation,

(e) for the purposes of legal proceedings (whether civil or criminal), or

(f) for the purposes of—

(i) preventing serious physical harm to a person,

(ii) preventing loss of human life,

(iii) safeguarding vulnerable adults or children,

(iv) responding to an emergency, or

(v) protecting national security.

(3) In subsection (2)(c) “anti-social behaviour” means conduct that—

(a) is likely to cause harassment, alarm or distress to any person, or

(b) is capable of causing nuisance or annoyance to a person in relation to that person's occupation of residential premises.

(4) Subsection (2) does not apply to information disclosed to a person under section 56 by the Revenue and Customs; but such information may be used by that person for purposes other than those for which it was disclosed with the consent of the Commissioners for Her Majesty's Revenue and Customs (which may be general or specific).

(5) For the purposes of this Chapter information is “personal information” if—

(a) it relates to and identifies a particular person (including a body corporate), but

(b) it is not information about the internal administrative arrangements of a specified person.

(6) For the purposes of subsection (1) information identifies a particular person if the identity of that person—

(a) is specified in the information,

(b) can be deduced from the information, or

(7) A disclosure under section 56 does not breach—

(a) any obligation of confidence owed by the person making the disclosure, or

(b) any other restriction on the disclosure of information (however imposed).

(8) But nothing in section 56 authorises the making of a disclosure which—

(a) contravenes the data protection legislation, or

(b) is prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016.

(9) Until the repeal of Part 1 of the Regulation of Investigatory Powers Act 2000 by paragraphs 45 and 54 of Schedule 10 to the Investigatory Powers Act 2016 is fully in force, subsection (8)(b) has effect as if it included a reference to that Part.

(10) Section 56 does not limit the circumstances in which information may be disclosed apart from that section.

(11) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Confidentiality of personal information

58

(1) Personal information received by a person (“P”) under section 56 may not be disclosed—

(a) by P, or

(b) by any other person who has received it directly or indirectly from P.

(2) Subsection (1) does not apply to a disclosure—

(a) which is required or permitted by any enactment (including section 56),

(b) which is required by an EU obligation,

(d) of information which has already lawfully been made available to the public,

(e) which is made for the prevention or detection of crime or the prevention of anti-social behaviour,

(f) which is made for the purposes of a criminal investigation,

(g) which is made for the purposes of legal proceedings (whether civil or criminal),

(h) which is a protected disclosure for any of the purposes of the Employment Rights Act 1996 or the Employment Rights (Northern Ireland) Order 1996 (SI 1996/1919 (NI 16)),

(i) consisting of the publication of information for the purposes of journalism, where the publication of the information is in the public interest,

(j) which is made with the consent of the person to whom it relates, or

(k) which is made for the purposes of—

(i) preventing serious physical harm to a person,

(ii) preventing loss of human life,

(iii) safeguarding vulnerable adults or children,

(iv) responding to an emergency, or

(v) protecting national security.

(3) In subsection (2)(e) “anti-social behaviour” means conduct that—

(a) is likely to cause harassment, alarm or distress to any person, or

(b) is capable of causing nuisance or annoyance to a person in relation to that person's occupation of residential premises.

(4) A person commits an offence if—

(a) the person discloses personal information in contravention of subsection (1), and

(b) at the time that the person makes the disclosure, the person knows that the disclosure contravenes that subsection or is reckless as to whether the disclosure does so.

(5) A person who is guilty of an offence under subsection (4) is liable on conviction on indictment to imprisonment for a term not exceeding two years, to a fine or to both.

(6) A person who is guilty of an offence under subsection (4) is liable on summary conviction—

(a) in England and Wales, to imprisonment for a term not exceeding the general limit in a magistrates’ court, to a fine or to both;

(b) in Scotland, to imprisonment for a term not exceeding 12 months, to a fine not exceeding the statutory maximum or to both;

(c) in Northern Ireland, to imprisonment for a term not exceeding 6 months, to a fine not exceeding the statutory maximum or to both.

(7) In the application of subsection (6)(a) to an offence committed before 2 May 2022 the reference to the general limit in a magistrates’ court is to be read as a reference to 6 months.

(8) This section does not apply to personal information disclosed under section 56 by the Revenue and Customs.

Information disclosed by the Revenue and Customs

59

(1) Personal information disclosed by the Revenue and Customs under section 56 and received by a person may not be disclosed by that person.

(2) Subsection (1) does not apply to a disclosure which is made with the consent of the Commissioners for Her Majesty's Revenue and Customs (which may be general or specific).

(3) A person who contravenes subsection (1) is guilty of an offence.

(4) It is a defence for a person charged with an offence under subsection (3) to prove that the person reasonably believed—

(a) that the disclosure was lawful, or

(b) that the information had already and lawfully been made available to the public.

(5) Subsections (4) to (7) of section 19 of the Commissioners for Revenue and Customs Act 2005 apply to an offence under subsection (3) as they apply to an offence under that section.

Code of practice

60

(1) The relevant Minister must issue a code of practice about—

(a) the disclosure of information under section 56, and

(b) the use of information disclosed under that section.

(2) The code of practice must be consistent with the code of practice prepared under section 121 of the Data Protection Act 2018 (data-sharing code) and issued under section 125(4) of that Act (as altered or replaced from time to time).

(3) A specified person must have regard to the code of practice in—

(a) disclosing information under section 56, and

(b) using information disclosed under that section.

(4) The relevant Minister may from time to time revise and re-issue the code of practice.

(5) Before issuing or reissuing the code of practice the relevant Minister must consult—

(a) the Information Commissioner,

(b) the Commissioners for Her Majesty's Revenue and Customs,

(d) the Welsh Ministers,

(e) the Department of Finance in Northern Ireland, and

(f) such other persons as the relevant Minister thinks appropriate.

(6) The fact that this section was not in force when consultation of the kind mentioned in subsection (5) took place is to be disregarded in determining whether there has been compliance with that subsection.

(7) The relevant Minister may not issue the code of practice unless a draft of the code has been laid before, and approved by a resolution of, each House of Parliament.

(8) Before reissuing the code the relevant Minister must lay a draft of the code as proposed to be reissued before Parliament.

(9) The relevant Minister may not reissue the code if, within the 40-day period, either House of Parliament resolves not to approve it.

(10) In subsection (9) “the 40 day period” means—

(a) the period of 40 days beginning with the day on which the draft is laid before Parliament, or

(b) if the draft is not laid before each House on the same day, the period of 40 days beginning with the later of the days on which it is laid before Parliament.

(11) For the purposes of subsection (10) no account is to be taken of any period during which Parliament is dissolved or prorogued or during which both Houses are adjourned for more than four days.

(12) As soon as is reasonably practicable after issuing or reissuing the code of practice the relevant Minister must lay, or arrange for the laying of, a copy of it before—

(a) the Scottish Parliament,

(b) the National Assembly for Wales, and

(13) In disclosing information under section 56, a person must have regard to the following codes of practice issued by the Information Commissioner under section 124A of the Data Protection Act 2018 (other codes of practice), so far as they apply to the information in question—

(a) any code which makes provision about the identification and reduction of the risks to privacy of a proposal to disclose information;

(b) any code which makes provision about the information to be provided to data subjects (within the meaning of that Act) about the use to be made of information collected from them.

(14) The duty in subsection (13) does not affect any other requirement for the person to have regard to a code of practice in disclosing the information.

Duty to review operation of Chapter

61

(1) As soon as is reasonably practicable after the end of three years beginning with the day on which this Chapter comes into force, the relevant Minister must review its operation for the purposes of deciding whether it should be amended or repealed.

(2) Before carrying out the review the relevant Minister must publish the criteria by reference to which that determination will be made.

(3) In carrying out the review the relevant Minister must consult—

(a) the Information Commissioner,

(b) the Scottish Ministers,

(d) the Department of Finance in Northern Ireland, and

(e) such other persons as the relevant Minister thinks appropriate.

(4) Once the review is completed the relevant Minister must—

(a) publish a report on its outcome, and

(b) lay, or arrange for the laying of, a copy of the report before—

(i) Parliament,

(ii) the Scottish Parliament,

(iii) the National Assembly for Wales, and

(iv) the Northern Ireland Assembly.

(5) If as a result of the review the relevant Minister decides that this Chapter should be amended or repealed, the relevant Minister may by regulations amend or repeal it (as the case may be).

(6) The power in subsection (5) to amend this Chapter—

(a) may be exercised for the purposes only of improving the effectiveness of the operation of the power in section 56(1), and

(b) may not be used to remove any of the safeguards relating to the use or disclosure of information in section 57, 58 or 59.

(7) The relevant Minister may only make regulations under subsection (5) with the consent of the Scottish Ministers if the regulations—

(a) repeal this Chapter,

(b) amend or remove the power of the Scottish Ministers to make regulations under section 56(6),

(d) affect the use by a Scottish body of information disclosed under that section by such a body, or

(e) affect the further disclosure to a Scottish body by such a body, or by a member, officer or employee of such a body, of information disclosed under this Chapter by a Scottish body.

(8) The relevant Minister may only make regulations under subsection (5) with the consent of the Welsh Ministers if the regulations—

(a) repeal this Chapter,

(b) amend or remove the power of the Welsh Ministers to make regulations under section 56(6),

(d) affect the use by a Welsh body of information disclosed under that section by such a body, or

(e) affect the further disclosure to a Welsh body by such a body, or by a member, officer or employee of such a body, of information disclosed under this Chapter by a Welsh body.

(9) The relevant Minister may only make regulations under subsection (5) with the consent of the Department of Finance in Northern Ireland if the regulations—

(a) repeal this Chapter,

(b) amend or remove the power of the Department to make regulations under section 56(6),

(d) affect the use by a Northern Ireland body of information disclosed under that section by such a body, or

(e) affect the further disclosure to a Northern Ireland body by such a body, or by a member, officer or employee of such a body, of information disclosed under this Chapter by a Northern Ireland body.

(10) The relevant Minister may only make regulations under subsection (5) with the consent of the Treasury in a case where the regulations could affect the disclosure of information by the Revenue and Customs.

(11) Anything required to be published by this section is to be published in such manner as the relevant Minister thinks fit.

Regulations under this Chapter

62

(1) Any power to make regulations under this Chapter is exercisable—

(a) in the case of regulations made by the relevant Minister or the Welsh Ministers, by statutory instrument, and

(b) in the case of regulations made by the Department of Finance in Northern Ireland, by statutory rule for the purposes of the Statutory Rules (Northern Ireland) Order 1979 (SI 1979/1573 (NI 12)).

(2) Regulations under this Chapter—

(a) may make different provision for different purposes;

(b) may contain consequential, supplementary, transitional or transitory provision or savings.

(3) In the case of regulations under section 56(6) which amend Schedule 8 so as to add an entry relating to a person or description of person, this includes power to make provision in relation to information disclosed by that person or a person of that description which is similar to that made by section 59 in relation to information disclosed by the Revenue and Customs.

(4) A statutory instrument containing regulations made under this Chapter by the relevant Minister may not be made unless a draft of the instrument has been laid before, and approved by a resolution of, each House of Parliament.

(5) Regulations made under section 56(6) by the Scottish Ministers are subject to the affirmative procedure.

(6) A statutory instrument containing regulations made under section 56(6) by the Welsh Ministers may not be made unless a draft of the instrument has been laid before, and approved by a resolution of, the National Assembly for Wales.

(7) Regulations under section 56(6) may not be made by the Department of Finance in Northern Ireland unless a draft of the regulations has been laid before, and approved by a resolution of, the Northern Ireland Assembly.

(8) If a draft of a statutory instrument containing regulations under section 56(6) would, apart from this subsection, be treated for the purposes of the standing orders of either House of Parliament as a hybrid instrument, it is to proceed in that House as if it were not such an instrument.

Interpretation of this Chapter

63

(1) In this Chapter—

“the appropriate national authority” means the relevant Minister, subject to subsections (2) to (4);

“enactment” includes—an enactment contained in, or in an instrument made under, an Act of the Scottish Parliament;an enactment contained in, or in an instrument made under, a Measure or Act of the National Assembly for Wales;an enactment contained in, or in an instrument made under, Northern Ireland legislation;an enactment contained in subordinate legislation within the meaning of the Interpretation Act 1978;

“functions” means functions of a public nature;

“Northern Ireland body” means—a Minister within the meaning of the Northern Ireland Act 1998,a Northern Ireland department,a Northern Ireland public authority within the meaning of the Statistics and Registration Service Act 2007, ora person providing services to a person within paragraph (a), (b) or (c);

“personal information” has the meaning given by section 57(5);

“public authority” has the meaning given by section 56(14);

“relevant Minister” means the Secretary of State or the Minister for the Cabinet Office;

“the Revenue and Customs” has the meaning given by section 17(3) of the Commissioners for Revenue and Customs Act 2005;

“Scottish body” means—a person who is a part of the Scottish Administration,a Scottish public authority with mixed functions or no reserved functions (within the meaning of the Scotland Act 1998), ora person providing services to a person within paragraph (a) or (b);

“specified person” has the meaning given by section 56(5);

“Welsh body” means—a devolved Welsh authority as defined by section 157A of the Government of Wales Act 2006, ora person providing services to a devolved Welsh authority as defined by that section.

(2) The Scottish Ministers are the appropriate national authority in relation to regulations under section 56(6) which add, modify or remove an entry relating to a person who is, or a description of persons each of whom is, a Scottish body.

(3) The Welsh Ministers are the appropriate national authority in relation to regulations under section 56(6) which add, modify or remove an entry relating to a person who is, or a description of persons each of whom is, a Welsh body.

(4) The Department of Finance in Northern Ireland is the appropriate national authority in relation to regulations under section 56(6) which add, modify or remove an entry relating to a person who is, or a description of persons each of whom is, a Northern Ireland body.

Disclosure of information for research purposes

64

(1) Information held by a public authority in connection with the authority's functions may be disclosed to another person for the purposes of research which is being or is to be carried out.

(2) If the information is personal information it may not be disclosed under subsection (1) unless the following conditions are met.

(3) The first condition is that, if the information identifies a particular person, it is processed before it is disclosed so that—

(a) the person's identity is not specified in the information, and

(b) it is not reasonably likely that the person's identity will be deduced from the information (whether by itself or taken together with other information).

(4) For the purposes of the first condition the information may be processed by—

(a) the public authority,

(b) a person other than the public authority, or

(subject to the following provisions of this Chapter).

(5) Personal information may be disclosed for the purpose of processing it for disclosure under subsection (1)—

(a) by a public authority to a person involved in processing the information for that purpose;

(b) subject to sections 67(5), 68(5) and 69(5) (information disclosed by revenue authorities), by one such person to another such person.

(6) The second condition is that each person who is involved in processing the information for disclosure takes reasonable steps to—

(a) minimise the risk of the accidental disclosure of information which identifies a particular person, and

(b) prevent the deliberate disclosure of such information (otherwise than in accordance with this Chapter).

(7) The third condition is that the disclosure is made by the public authority or by a person, other than the public authority, who is involved in processing the information for disclosure under subsection (1).

(8) The fourth condition is that the research for the purposes of which the information is disclosed is accredited under section 71.

(9) The fifth condition is that the following are accredited under section 71—

(a) any person (including the public authority) who is involved in processing the information for disclosure under subsection (1);

(b) any person to whom information is disclosed under subsection (1);

(10) The sixth condition is that each person who discloses the information or is involved in processing it for disclosure under subsection (1) has regard to the code of practice under section 70 in doing so.

(11) For the purposes of this Chapter information is “personal information” if—

(a) it relates to a particular person (including a body corporate), but

(b) it is not information about the internal administrative arrangements of a public authority.

(12) For the purposes of this Chapter information identifies a particular person if the identity of that person—

(a) is specified in the information,

(b) can be deduced from the information, or

(13) This section is subject to section 65.

Provisions supplementary to section 64

65

(1) A disclosure under section 64 does not breach—

(a) any obligation of confidence owed by the person making the disclosure, or

(b) any other restriction on the disclosure of information (however imposed).

(2) But nothing in section 64 authorises information to be disclosed if to do so would—

(a) contravene the data protection legislation, or

(b) be prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016.

(3) Until the repeal of Part 1 of the Regulation of Investigatory Powers Act 2000 by paragraphs 45 and 54 of Schedule 10 to the Investigatory Powers Act 2016 is fully in force, subsection (2)(b) has effect as if it included a reference to that Part.

(4) In its application to a public authority with functions relating to the provision of health services or adult social care, section 64 does not authorise the disclosure of information held by the authority in connection with such functions.

(5) Section 64 does not limit the circumstances in which information may be disclosed apart from that section.

(6) A person within subsection (7) may charge a person who requests information to be disclosed under section 64(1) a fee for work done in response to the request.

(7) The persons mentioned in subsection (6) are—

(a) the public authority to whom the request is made, and

(b) a person who is involved in processing the information for disclosure.

(8) A fee charged under subsection (6) by a public authority (including a person within subsection (7)(b) who is a public authority) must not exceed the cost to the person of doing the work for which the fee is charged.

(9) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Bar on further disclosure of personal information

66

(1) Subsection (2) applies to personal information—

(a) in which the identity of a particular person is specified or from which the identity of a particular person can be deduced, whether from the information itself or from that information taken together with any other published information, and

(b) which is received by a person (“P”) under section 64(1) (disclosure for research purposes).

(2) Personal information to which this subsection applies may not be disclosed—

(a) by P, or

(b) by any other person who has received it directly or indirectly from P.

(3) Subsection (2) does not apply to a disclosure—

(a) to a person by whom the research referred to in section 64(1) is being or is to be carried out, or

(b) for the purposes of enabling anything that is to be published as a result of the research to be reviewed before publication, where the disclosure is made to a person who is accredited under section 71 as a person to whom such information may be disclosed for that purpose.

(4) Subsection (5) applies to personal information which—

(a) identifies a particular person, and

(b) is received by a person (“P”) under section 64(5) (disclosure for processing).

(5) Personal information to which this subsection applies may not be disclosed—

(a) by P, or

(b) by any other person who has received it directly or indirectly from P.

(6) Subsection (5) does not apply to a disclosure—

(a) under section 64(1) or (5), or

(b) of information previously disclosed under section 64(1), where the disclosure is made by—

(i) the person to whom the information was disclosed under that provision, or

(ii) any person who has received the information directly or indirectly from the person mentioned in sub-paragraph (i),

(but subsection (2) may apply to such a disclosure).

(7) Subsection (2) or (5) does not apply to a disclosure—

(a) which is required or permitted by any enactment,

(b) which is required by an EU obligation,

(d) of information which has already lawfully been made available to the public,

(e) which is made for the prevention or detection of crime or the prevention of anti-social behaviour,

(f) which is made for the purposes of a criminal investigation,

(g) which is made for the purposes of legal proceedings (whether civil or criminal),

(h) which is a protected disclosure for any of the purposes of the Employment Rights Act 1996 or the Employment Rights (Northern Ireland) Order 1996 (SI 1996/1919 (NI 16)),

(i) consisting of the publication of information for the purposes of journalism, where the publication of the information is in the public interest, or

(j) which is made with the consent of the person to whom it relates.

(8) In subsection (7)(a) “enactment” includes—

(a) an enactment contained in, or in an instrument made under, an Act of the Scottish Parliament;

(b) an enactment contained in, or in an instrument made under, a Measure or Act of the National Assembly for Wales;

(d) an enactment contained in subordinate legislation within the meaning of the Interpretation Act 1978.

(9) In subsection (7)(e) “anti-social behaviour” means conduct that—

(a) is likely to cause harassment, alarm or distress to any person, or

(b) is capable of causing nuisance or annoyance to a person in relation to that person's occupation of residential premises.

(10) A person commits an offence if—

(a) the person discloses personal information in contravention of subsection (2) or (5), and

(b) at the time that the person makes the disclosure, the person knows that the disclosure contravenes that subsection or is reckless as to whether the disclosure does so.

(11) A person who is guilty of an offence under subsection (10) is liable on conviction on indictment to imprisonment for a term not exceeding two years, to a fine or to both.

(12) A person who is guilty of an offence under subsection (10) is liable on summary conviction—

(a) in England and Wales, to imprisonment for a term not exceeding the general limit in a magistrates’ court, to a fine or to both;

(b) in Scotland, to imprisonment for a term not exceeding 12 months, to a fine not exceeding the statutory maximum or to both;

(c) in Northern Ireland, to imprisonment for a term not exceeding 6 months, to a fine not exceeding the statutory maximum or to both.

(13) In the application of subsection (12)(a) to an offence committed before 2 May 2022 the reference to the general limit in a magistrates’ court is to be read as a reference to 6 months.

(14) This section does not apply to personal information disclosed under section 64(1) or (5) by the Revenue and Customs, the Welsh Revenue Authority or Revenue Scotland.

Information disclosed by the Revenue and Customs

67

(1) Subsection (2) applies to personal information—

(a) in which the identity of a particular person is specified or from which the identity of a particular person can be deduced, whether from the information itself or from that information taken together with any other published information, and

(b) which—

(i) is disclosed under section 64(1) (disclosure for research purposes) by the Revenue and Customs, or

(ii) is disclosed under section 64(1) by a person other than the Revenue and Customs and is derived from information disclosed under section 64(5) by the Revenue and Customs,

and is received by a person (“P”) under section 64(1).

(2) Personal information to which this subsection applies may not be disclosed—

(a) by P, or

(b) by a person to whom the information is disclosed by virtue of subsection (3).

(3) Subsection (2) does not apply to a disclosure—

(a) to a person by whom the research referred to in section 64(1) is being or is to be carried out, or

(b) for the purposes of enabling anything that is to be published as a result of the research to be reviewed before publication, where the disclosure is made to a person who is accredited under section 71 as a person to whom such information may be disclosed for that purpose.

(4) Subsection (5) applies to personal information which—

(a) identifies a particular person, and

(b) is disclosed by the Revenue and Customs under section 64(5) (disclosure for processing) and received by a person (“P”).

(5) Personal information to which this subsection applies may not be disclosed—

(a) by P, or

(b) by any other person who has received it under section 64(5).

(6) Subsection (5) does not apply to a disclosure under section 64(1).

(7) Subsection (2) or (5) does not apply to a disclosure which is made with the consent of the Commissioners for Her Majesty's Revenue and Customs (which may be general or specific).

(8) A person who contravenes subsection (2) or (5) is guilty of an offence.

(9) It is a defence for a person charged with an offence under subsection (8) to prove that the person reasonably believed—

(a) that the disclosure was lawful, or

(b) that the information had already and lawfully been made available to the public.

(10) Subsections (4) to (7) of section 19 of the Commissioners for Revenue and Customs Act 2005 apply to an offence under subsection (8) as they apply to an offence under that section.

Information disclosed by the Welsh Revenue Authority

68

(1) Subsection (2) applies to personal information—

(a) in which the identity of a particular person is specified or from which the identity of a particular person can be deduced, whether from the information itself or from that information taken together with any other published information, and

(b) which—

(i) is disclosed under section 64(1) (disclosure for research purposes) by the Welsh Revenue Authority, or

(ii) is disclosed under section 64(1) by a person other than the Welsh Revenue Authority and is derived from information disclosed under section 64(5) by the Welsh Revenue Authority,

and is received by a person (“P”) under section 64(1).

(2) Personal information to which this subsection applies may not be disclosed—

(a) by P, or

(b) by a person to whom the information is disclosed by virtue of subsection (3).

(3) Subsection (2) does not apply to a disclosure—

(a) to a person by whom the research referred to in section 64(1) is being or is to be carried out, or

(b) for the purposes of enabling anything that is to be published as a result of the research to be reviewed before publication, where the disclosure is made to a person who is accredited under section 71 as a person to whom such information may be disclosed for that purpose.

(4) Subsection (5) applies to personal information which—

(a) identifies a particular person, and

(b) is disclosed by the Welsh Revenue Authority under section 64(5) (disclosure for processing) and received by a person (“P”).

(5) Personal information to which this subsection applies may not be disclosed—

(a) by P, or

(b) by any other person who has received it under section 64(5).

(6) Subsection (5) does not apply to a disclosure under section 64(1).

(7) Subsection (2) or (5) does not apply to a disclosure which is made with the consent of the Welsh Revenue Authority (which may be general or specific).

(8) A person who contravenes subsection (2) or (5) is guilty of an offence.

(9) It is a defence for a person charged with an offence under subsection (8) to prove that the person reasonably believed—

(a) that the disclosure was lawful, or

(b) that the information had already and lawfully been made available to the public.

(10) A person who is guilty of an offence under subsection (8) is liable—

(a) on summary conviction, to imprisonment for a term not exceeding the general limit in a magistrates’ court, to a fine, or to both;

(b) on conviction on indictment to imprisonment for a term not exceeding two years, to a fine or to both.

(11) In the application of subsection (10)(a) to an offence committed before 2 May 2022 the reference to the general limit in a magistrates’ court is to be read as a reference to 6 months.

Information disclosed by Revenue Scotland

69

(1) Subsection (2) applies to personal information—

(a) in which the identity of a particular person is specified or from which the identity of a particular person can be deduced, whether from the information itself or from that information taken together with any other published information, and

(b) which—

(i) is disclosed under section 64(1) (disclosure for research purposes) by Revenue Scotland, or

(ii) is disclosed under section 64(1) by a person other than Revenue Scotland and is derived from information disclosed under section 64(5) by Revenue Scotland,

and is received by a person (“P”) under section 64(1).

(2) Personal information to which this subsection applies may not be disclosed—

(a) by P, or

(b) by a person to whom the information is disclosed by virtue of subsection (3).

(3) Subsection (2) does not apply to a disclosure—

(a) to a person by whom the research referred to in section 64(1) is being or is to be carried out, or

(b) for the purposes of enabling anything that is to be published as a result of the research to be reviewed before publication, where the disclosure is made to a person who is accredited under section 71 as a person to whom such information may be disclosed for that purpose.

(4) Subsection (5) applies to personal information which—

(a) identifies a particular person, and

(b) is disclosed by Revenue Scotland under section 64(5) (disclosure for processing) and received by a person (“P”).

(5) Personal information to which this subsection applies may not be disclosed—

(a) by P, or

(b) by any other person who has received it under section 64(5).

(6) Subsection (5) does not apply to a disclosure under section 64(1).

(7) Subsection (2) or (5) does not apply to a disclosure which is made with the consent of Revenue Scotland (which may be general or specific).

(8) A person who contravenes subsection (2) or (5) is guilty of an offence.

(9) It is a defence for a person charged with an offence under subsection (8) to prove that the person reasonably believed—

(a) that the disclosure was lawful, or

(b) that the information had already and lawfully been made available to the public.

(10) A person who is guilty of an offence under subsection (8) is liable—

(a) on summary conviction, to imprisonment for a term not exceeding 12 months, to a fine not exceeding the statutory maximum or to both;

(b) on conviction on indictment to imprisonment for a term not exceeding two years, to a fine or to both.

Code of practice

70

(1) The Statistics Board must issue a code of practice about—

(a) the disclosure of personal information under section 64,

(b) the processing of information under that section, and

(2) The code of practice must be consistent with the code of practice prepared under section 121 of the Data Protection Act 2018 (data-sharing code) and issued under section 125(4) of that Act (as altered or replaced from time to time).

(3) A public authority must have regard to the code of practice in disclosing personal information or participating in the processing of information under section 64.

(4) A person who is accredited under section 71(1)(a) must have regard to the code of practice in participating in the processing of information for disclosure under section 64(1).

(5) A person who is accredited under section 71(1)(b), (c) or (d) must have regard to the code of practice in holding or using personal information disclosed under section 64.

(6) The Statistics Board may from time to time revise and re-issue the code of practice.

(7) Before issuing or reissuing the code of practice the Statistics Board must consult—

(a) the Minister for the Cabinet Office,

(b) the Information Commissioner,

(d) the Scottish Ministers,

(e) the Welsh Ministers,

(f) the Department of Finance in Northern Ireland, and

(g) such other persons as the Statistics Board thinks appropriate.

(8) The fact that this section was not in force when consultation of the kind mentioned in subsection (7) took place is to be disregarded in determining whether there has been compliance with that subsection.

(9) The Statistics Board may not issue the code of practice unless a draft of the code has been laid before, and approved by a resolution of, each House of Parliament.

(10) Before reissuing the code the Statistics Board must lay a draft of the code as proposed to be reissued before Parliament.

(11) The Statistics Board may not reissue the code if, within the 40-day period, either House of Parliament resolves not to approve it.

(12) In subsection (11) “the 40 day period” means—

(a) the period of 40 days beginning with the day on which the draft is laid before Parliament, or

(b) if the draft is not laid before each House on the same day, the period of 40 days beginning with the later of the days on which it is laid before Parliament.

(13) For the purposes of subsection (12) no account is to be taken of any period during which Parliament is dissolved or prorogued or during which both Houses are adjourned for more than four days.

(14) As soon as is reasonably practicable after issuing or reissuing the code of practice the Statistics Board must lay a copy of it before—

(a) the Scottish Parliament,

(b) the National Assembly for Wales, and

(15) In disclosing information under section 64, a person must have regard to the following codes of practice issued by the Information Commissioner under section 124A of the Data Protection Act 2018 (other codes of practice), so far as they apply to the information in question—

(a) any code which makes provision about the identification and reduction of the risks to privacy of a proposal to disclose information;

(b) any code which makes provision about the information to be provided to data subjects (within the meaning of that Act) about the use to be made of information collected from them.

(16) The duty in subsection (15) does not affect any other requirement for the person to have regard to a code of practice in disclosing the information.

Accreditation for the purposes of this Chapter

71

(1) The Statistics Board—

(a) may accredit a person as a person who may be involved in the processing of information for disclosure under subsection (1) of section 64,

(b) may accredit a person as a person to whom information may be disclosed under that subsection,

(c) may accredit a person as a person by whom information disclosed under that subsection may be used for research purposes,

(d) may accredit a person as a person to whom such information may be disclosed for the purposes of a review of the kind mentioned in section 66(3)(b), 67(3)(b), 68(3)(b) or 69(3)(b),

(e) may accredit research for the purposes of section 64, and

(f) may withdraw accreditation given under any of paragraphs (a) to (e).

(2) The Statistics Board—

(a) must establish and publish conditions to be met by a person for accreditation under subsection (1)(a), (b), (c) or (d),

(b) must establish and publish conditions to be met by research for accreditation under subsection (1)(e), and

(3) The conditions established and published under subsection (2)(a) must, in the case of a person seeking accreditation to be involved in the processing of information for disclosure under section 64(1), include a condition that the person is a fit and proper person to be involved in such processing.

(4) The conditions established and published under subsection (2)(b) must include a condition that the research is in the public interest.

(5) The grounds established and published under subsection (2)(c) must, in the case of a person accredited under this section, include the ground that the person has failed to have regard to the code of practice under section 70.

(6) Before publishing conditions under subsection (2)(a) or (b) or grounds under subsection (2)(c), the Statistics Board must consult—

(a) the Minister for the Cabinet Office,

(b) the Information Commissioner,

(d) the Scottish Ministers,

(e) the Welsh Ministers,

(f) the Department of Finance in Northern Ireland, and

(g) such other persons as the Statistics Board thinks appropriate.

(7) The Statistics Board—

(a) may from time to time revise conditions or grounds published under this section, and

(b) if it does so, must publish the conditions or grounds as revised.

(8) Subsection (6) applies in relation to the publication of conditions or grounds under subsection (7) as it applies in relation to the publication of conditions or grounds under subsection (2).

(9) The Statistics Board must maintain and publish—

(a) a register of persons who are accredited under subsection (1)(a),

(b) a register of persons who are accredited under subsection (1)(b),

(d) a register of persons who are accredited under subsection (1)(d).

(10) A register under any of the paragraphs of subsection (9) may be combined with a register under any of the other paragraphs of that subsection.

(11) Anything required by this section to be published must be published in such manner as the Statistics Board thinks appropriate for bringing it to the attention of persons likely to be affected by it.

Delegation of functions of the Statistics Board

72

(1) The Statistics Board may delegate any of its functions under section 71 to another person if the Board thinks that the person—

(a) is a fit and proper person to exercise the function in question, and

(b) has expertise in statistical research and analysis.

(2) Subsection (1) does not affect the operation of section 36 of the Statistics and Registration Service Act 2007 (delegation of Board's functions).

Interpretation of this Chapter

73

(1) In this Chapter—

“personal information” has the meaning given by section 64(11);

“public authority” means a person with functions of a public nature, subject to subsection (2);

“the Revenue and Customs” has the meaning given by section 17(3) of the Commissioners for Revenue and Customs Act 2005.

(2) A person is not a public authority for the purposes of this Chapter if the person—

(a) only has functions relating to the provision of health services,

(b) only has functions relating to the provision of adult social care, or

(3) The following are to be disregarded in determining whether subsection (2) applies to a person—

(a) any power (however expressed) to do things which are incidental to the carrying out of another function of that person;

(b) any function which the person exercises or may exercise on behalf of another person.

(4) In this Chapter “health services” means—

(a) services which must or may be provided as part of the health service as defined by section 275(1) of the National Health Service Act 2006 or section 206(1) of the National Health Service (Wales) Act 2006,

(b) services which must or may be provided as part of the health service as defined by section 108(1) of the National Health Service (Scotland) Act 1978, or

(c) services designed to secure any of the objects of section 2(1)(a) of the Health and Social Care (Reform) Act (Northern Ireland) 2009.

(5) In this Chapter “adult social care” includes all forms of personal care and other practical assistance provided for individuals aged 18 or over who, by reason of age, illness, disability, pregnancy, childbirth, dependence on alcohol or drugs, or any other similar circumstances, are in need of such care or assistance.

(6) References in this Chapter to information which identifies a particular person are to be read in accordance with section 64(12).

CHAPTER 6 — Disclosure by revenue authorities

Disclosure of non-identifying information by the Revenue and Customs

74

(1) A Revenue and Customs official may disclose to any person information held by the Revenue and Customs in connection with a function of the Revenue and Customs if—

(a) the information is non-identifying information, and

(b) the official thinks that the disclosure would be in the public interest.

(2) Information is non-identifying information for the purposes of this section if—

(a) it is not, and has never been, identifying information, or

(b) it has been created by combining identifying information, but is not itself identifying information.

(3) Information is identifying information for the purposes of this section if it relates to a person whose identity—

(a) is specified in the information,

(b) can be deduced from the information, or

(4) In this section—

(a) “Revenue and Customs official” has the meaning given by section 18(4)(a) of the Commissioners for Revenue and Customs Act 2005,

(b) “the Revenue and Customs” has the meaning given by section 17(3) of that Act, and

Disclosure of non-identifying information by the Welsh Revenue Authority

75

(1) A relevant official of the Welsh Revenue Authority may disclose relevant information to any person if—

(a) the information is non-identifying information, and

(b) the official thinks that the disclosure would be in the public interest.

(2) Information is non-identifying information for the purposes of this section if—

(a) it is not, and has never been, identifying information, or

(b) it has been created by combining identifying information, but is not itself identifying information.

(3) Information is identifying information for the purposes of this section if it relates to a person whose identity—

(a) is specified in the information,

(b) can be deduced from the information, or

(4) In this section—

(a) “relevant official of the Welsh Revenue Authority” means a person within any of paragraphs (a) to (d) of section 17(2) of the Tax Collection and Management (Wales) Act 2016, and

(b) “relevant information” means information which—

(i) is held by the Welsh Revenue Authority in connection with its functions, or

(ii) is held by a person to whom any of the functions of the Welsh Revenue Authority have been delegated in connection with those functions.

Disclosure of non-identifying information by Revenue Scotland

76

(1) A relevant official of Revenue Scotland may disclose to any person information held by a relevant person in connection with a relevant function if—

(a) the information is non-identifying information, and

(b) the official thinks that the disclosure would be in the public interest.

(2) Information is non-identifying information for the purposes of this section if—

(a) it is not, and has never been, identifying information, or

(b) it has been created by combining identifying information, but is not itself identifying information.

(3) Information is identifying information for the purposes of this section if it relates to a person whose identity—

(a) is specified in the information,

(b) can be deduced from the information, or

(4) In this section—

(a) “relevant official of Revenue Scotland” means a relevant official as defined by section 15(2) of the Revenue Scotland and Tax Powers Act 2014,

(b) “relevant person” has the meaning given by section 13(2) of that Act, and

Disclosure of employer reference information by the Revenue and Customs

77

(1) A Revenue and Customs official may disclose employer reference information held by the Revenue and Customs to the Employers' Liability Tracing Office for use by it for the permitted purpose.

(2) The Employers' Liability Tracing Office is the company registered in England and Wales with the company registration number 06964651.

(3) The permitted purpose is the purpose of providing assistance in connection with—

(a) claims against an employer, or an employer's insurer, arising from personal injury or death that occurred, or is alleged to have occurred, in the course of a person's employment by that employer, or

(b) applications for a payment under the Diffuse Mesothelioma Payment Scheme established under the Mesothelioma Act 2014.

(4) “Employer reference information” means any of the following information relating to an employer—

(a) the employer's name and address;

(b) any combination of numbers, letters or characters that is uniquely associated with the employer and used by the Revenue and Customs to identify or refer to the employer, whether generally or for particular purposes.

(5) References in this section to an employer include references to a person who has at any time been an employer.

(6) In this section—

“employer” and “employment” have the same meaning as in the employment income Parts of the Income Tax (Earnings and Pensions) Act 2003;

“Revenue and Customs official” has the meaning given by section 18(4)(a) of the Commissioners for Revenue and Customs Act 2005;

“the Revenue and Customs” has the meaning given by section 17(3) of that Act.

CHAPTER 7 — Statistics

Disclosure of information by the Revenue and Customs to the Statistics Board

78

(1) Section 45 of the Statistics and Registration Service Act 2007 (disclosure of HMRC information to the Statistics Board) is amended as follows.

(2) In subsection (2) omit “, other than its function under section 22 (statistical services)”.

(3) After subsection (2) insert—

(2A) In determining whether the condition in subsection (2) is met the Commissioners must have regard to any views of the Board which have been communicated to them.

(4) In subsection (3) omit “, other than its function under section 22”.

(5) After that subsection insert—

(3A) Information disclosed under subsection (1) may not be used by the Board for the purposes of its function under section 22 (statistical services) except with the consent of the Commissioners.

(6) After subsection (4) insert—

(4A) In disclosing information under subsection (1), the Commissioners or an officer of Revenue and Customs must have regard to the following codes of practice issued by the Information Commissioner under section 51(3) of the Data Protection Act 1998, so far as they apply to the information in question— (a) any code which makes provision about the identification and reduction of the risks to privacy of a proposal to disclose information; (b) any code which makes provision about the information to be provided to data subjects (within the meaning of that Act) about the use to be made of information collected from them. (4B) The duty in subsection (4A) to have regard to a code of practice does not affect any other requirement for the Commissioners or an officer of Revenue and Customs to have regard to a code of practice under the Data Protection Act 1998 in disclosing the information. (4C) In determining how to comply with the duty in subsection (4A) the Commissioners or the officer of Revenue and Customs must have regard to any views of the Board which are communicated to the Commissioners or the officer.

(7) Omit subsection (5) (which prevents the disclosure of personal information not relating to imports or exports).

Disclosure of information by public authorities to the Statistics Board

79

(1) The Statistics and Registration Service Act 2007 is amended as follows.

(2) After section 45 insert—

(45A) (1) A public authority to which this section applies may, subject to this section, disclose to the Board any information held by the authority in connection with its functions. (2) This section applies to a public authority other than— (a) the Commissioners for Her Majesty's Revenue and Customs, or (b) an officer of Revenue and Customs. (3) A public authority may disclose information under subsection (1) only if it is satisfied that the Board requires the information to enable it to exercise one or more of its functions. (4) In determining whether the condition in subsection (3) is met the public authority must have regard to any views of the Board which have been communicated to the authority. (5) Information disclosed under subsection (1) may only be used by the Board for the purposes of any one or more of its functions. (6) Information disclosed under subsection (1) may not be used by the Board for the purposes of its function under section 22 (statistical services) except with the consent of the public authority which disclosed the information. (7) Where personal information is disclosed by a public authority to the Board under subsection (1), the Board may not disclose the information to an approved researcher under section 39(4)(i) except with the consent of the public authority. (8) In disclosing information under subsection (1), a public authority must have regard to the following codes of practice issued by the Information Commissioner under section 51(3) of the Data Protection Act 1998, so far as they apply to the information in question— (a) any code which makes provision about the identification and reduction of the risks to privacy of a proposal to disclose information; (b) any code which makes provision about the information to be provided to data subjects (within the meaning of that Act) about the use to be made of information collected from them. (9) The duty in subsection (8) to have regard to a code of practice does not affect any other requirement for the public authority to have regard to a code of practice under the Data Protection Act 1998 in disclosing the information. (10) In determining how to comply with the duty in subsection (8) the public authority must have regard to any views of the Board which are communicated to the authority. (11) A disclosure under subsection (1) does not breach— (a) any obligation of confidence owed by the public authority making the disclosure, or (b) any other restriction on the disclosure of information (however imposed). (12) But subsection (1) does not authorise the making of a disclosure which— (a) contravenes the Data Protection Act 1998, (b) is prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016, or (c) contravenes directly applicable EU legislation or any enactment to the extent that it implements EU legislation. (13) Until the repeal of Part 1 of the Regulation of Investigatory Powers Act 2000 by paragraphs 45 and 54 of Schedule 10 to the Investigatory Powers Act 2016 is fully in force, subsection (12)(b) has effect as if it included a reference to that Part. (14) This section does not limit the circumstances in which information may be disclosed apart from this section.

(3) Omit—

(a) section 47 (power to authorise disclosure to the Board);

(b) section 48 (power to authorise disclosure to the Board: Scotland);

(4) In section 54 (Data Protection Act 1998 and Human Rights Act 1998) for “47” substitute “ 50 ”.

(5) In section 65 (orders and regulations)—

(a) in subsection (4) omit “47(11),”,

(b) in subsection (5)(b) omit “47,”,

(d) in subsection (9)(c) omit “49 or”.

(6) In section 67 (general interpretation) for the definition of “enactment” substitute—

“enactment” includes— (a) an enactment contained in subordinate legislation within the meaning of the Interpretation Act 1978; (b) an enactment contained in, or in an instrument made under, an Act of the Scottish Parliament; (c) an enactment contained in, or in an instrument made under, a Measure or Act of the National Assembly for Wales; (d) an enactment contained in, or in an instrument made under, Northern Ireland legislation;

Access to information by the Statistics Board

80

After section 45A of the Statistics and Registration Service Act 2007 (inserted by section 79) insert—

Reading this document does not replace reading the official text published on legislation.gov.uk. Contains public sector information licensed under the Open Government Licence v3.0. We assume no responsibility for any inaccuracies arising from the conversion of the original CLML XML to this format.

This text is published under legislation.gov.uk's own terms of reuse, not a Legalize or public-domain licence. legislation.gov.uk
Open Government Licence v3.0 (attribution required)
© Crown and database right. Derived from content available under the Open Government Licence v3.0 from legislation.gov.uk.

Digital Economy Act 2017

Further provisions about power in section 48

49

Confidentiality of personal information

50

Information disclosed by the Revenue and Customs

51

Code of practice

52

Duty to review operation of Chapter

53

Regulations under this Chapter

54

Interpretation of this Chapter

55

CHAPTER 4 — Fraud against the public sector

Disclosure of information to combat fraud against the public sector

56

Further provisions about power in section 56

57

Confidentiality of personal information

58

Information disclosed by the Revenue and Customs

59

Code of practice

60

Duty to review operation of Chapter

61

Regulations under this Chapter

62

Interpretation of this Chapter

63

CHAPTER 5 — Sharing for research purposes

Disclosure of information for research purposes

64

Provisions supplementary to section 64

65

Bar on further disclosure of personal information

66

Information disclosed by the Revenue and Customs

67

Information disclosed by the Welsh Revenue Authority

68

Information disclosed by Revenue Scotland

69

Code of practice

70

Accreditation for the purposes of this Chapter

71

Delegation of functions of the Statistics Board

72

Interpretation of this Chapter

73

CHAPTER 6 — Disclosure by revenue authorities

Disclosure of non-identifying information by the Revenue and Customs

74

Disclosure of non-identifying information by the Welsh Revenue Authority

75

Disclosure of non-identifying information by Revenue Scotland

76

Disclosure of employer reference information by the Revenue and Customs

77

CHAPTER 7 — Statistics

Disclosure of information by the Revenue and Customs to the Statistics Board

78

Disclosure of information by public authorities to the Statistics Board

79

Access to information by the Statistics Board

80