Digital Economy Bill (HC Bill 87)

Digital Economy BillPage 40

(b) a person providing services to a public authority.

(6) In the case of a person (“P”) who is a specified person merely because of
providing services to a public authority, the reference in subsection (1) to the
functions of a specified person is limited to the functions P exercises for that
5purpose.

(7) In determining whether to make regulations under subsection (4) in relation to
a person or description of person the appropriate national authority must have
regard, in particular, to—

(a) the systems and procedures for the secure handling of information by
10that person or persons of that description, and

(b) in the case of regulations which amend or revoke previous regulations
so that the person ceases to be a specified person, whether that person,
or any person providing services to that person, has had regard to the
code of practice under section 44 as required by that section.

(8) 15Before making regulations under subsection (4) the appropriate national
authority must consult—

(a) the Information Commissioner,

(b) the Commissioners for Her Majesty’s Revenue and Customs,

(c) each other person who is the appropriate national authority in relation
20to regulations under subsection (4),

(d) where the appropriate national authority is not the relevant Minister,
the Minister for the Cabinet Office, and

(e) such other persons as the appropriate national authority thinks
appropriate.

(9) 25The fact that this section was not in force when consultation of the kind
mentioned in subsection (8) took place is to be disregarded in determining
whether there has been compliance with that subsection.

41 Further provisions about power in section 40

(1) Personal information disclosed under section 40 may only be used by the
30person to whom it is disclosed for the purposes for which it was disclosed,
subject to subsection (2).

(2) Subsection (1) does not prevent the use of information by a person—

(a) if the information has already lawfully been made available to the
public,

(b) 35if the person to whom the information relates consents to its use for
another purpose,

(c) for the prevention or detection of crime or the prevention of anti-social
behaviour,

(d) for the purposes of a criminal investigation,

(e) 40for the purposes of legal proceedings (whether civil or criminal),

(f) for the purposes of safeguarding vulnerable adults or children, or

(g) for the purposes of protecting national security.

(3) In subsection (2)(c) “anti-social behaviour” has the same meaning as in Part 1
of the Anti-social Behaviour, Crime and Policing Act 2014 (see section 2 of that
45Act).

Digital Economy BillPage 41

(4) Subsection (2) does not apply to information disclosed to a person under
section 40 by the Revenue and Customs; but such information may be used by
that person for purposes other than those for which it was disclosed with the
consent of the Commissioners for Her Majesty’s Revenue and Customs (which
5may be general or specific).

(5) For the purposes of this Chapter information is “personal information” if—

(a) it relates to and identifies a particular person (including a body
corporate), but

(b) it is not information about the internal administrative arrangements of
10a specified person.

(6) For the purposes of subsection (5) information identifies a particular person if
the identity of that person—

(a) is specified in the information,

(b) can be deduced from the information, or

(c) 15can be deduced from the information taken together with any other
information.

(7) A disclosure under section 40 does not breach—

(a) any obligation of confidence owed by the person making the
disclosure, or

(b) 20any other restriction on the disclosure of information (however
imposed).

(8) But nothing in section 40 authorises the making of a disclosure which—

(a) contravenes the Data Protection Act 1998, or

(b) is prohibited by Part 1 of the Regulation of Investigatory Powers Act
252000.

(9) Section 40 does not limit the circumstances in which information may be
disclosed apart from that section.

42 Confidentiality of personal information

(1) Personal information received by a person (“P”) under section 40 may not be
30disclosed—

(a) by P, or

(b) by any other person who has received it directly or indirectly from P.

(2) Subsection (1) does not apply to a disclosure—

(a) which is required or permitted by any enactment (including section 40),

(b) 35which is required by an EU obligation,

(c) which is made in pursuance of an order of the court,

(d) of information which has already lawfully been made available to the
public,

(e) for the prevention or detection of crime or the prevention of anti-social
40behaviour,

(f) which is made for the purposes of a criminal investigation,

(g) which is made for the purposes of legal proceedings (whether civil or
criminal),

(h) which is made with the consent of the person to whom it relates,

(i) 45which is made for the purposes of safeguarding vulnerable adults or
children, or

Digital Economy BillPage 42

(j) which is made for the purposes of protecting national security.

(3) In subsection (2)(e) “anti-social behaviour” has the same meaning as in Part 1
of the Anti-social Behaviour, Crime and Policing Act 2014 (see section 2 of that
Act).

(4) 5A person commits an offence if—

(a) the person discloses personal information in contravention of
subsection (1), and

(b) at the time that the person makes the disclosure, the person knows that
the disclosure contravenes that subsection or is reckless as to whether
10the disclosure does so.

(5) A person who is guilty of an offence under subsection (4) is liable on conviction
on indictment to imprisonment for a term not exceeding two years, to a fine or
to both.

(6) A person who is guilty of an offence under subsection (4) is liable on summary
15conviction—

(a) in England and Wales, to imprisonment for a term not exceeding 12
months, to a fine or to both;

(b) in Scotland, to imprisonment for a term not exceeding 12 months, to a
fine not exceeding the statutory maximum or to both;

(c) 20in Northern Ireland, to imprisonment for a term not exceeding 6
months, to a fine not exceeding the statutory maximum or to both.

(7) In the application of subsection (6)(a) to an offence committed before the
coming into force of section 154(1) of the Criminal Justice Act 2003 the
reference to 12 months is to be read as a reference to 6 months.

(8) 25This section does not apply to personal information disclosed under section 40
by the Revenue and Customs.

43 Information disclosed by the Revenue and Customs

(1) Personal information disclosed by the Revenue and Customs under section 40
and received by a person (“P”) may not be disclosed—

(a) 30by P, or

(b) by any other person who has received it directly or indirectly from P.

(2) Subsection (1) does not apply to a disclosure which is made with the consent
of the Commissioners for Her Majesty’s Revenue and Customs (which may be
general or specific).

(3) 35A person who contravenes subsection (1) is guilty of an offence.

(4) It is a defence for a person charged with an offence under subsection (3) to
prove that the person reasonably believed—

(a) that the disclosure was lawful, or

(b) that the information had already and lawfully been made available to
40the public.

(5) Subsections (4) to (7) of section 19 of the Commissioners for Revenue and
Customs Act 2005 apply to an offence under subsection (3) as they apply to an
offence under that section.

Digital Economy BillPage 43

44 Code of practice

(1) The relevant Minister must issue a code of practice about—

(a) the disclosure of information under section 40, and

(b) the use of information disclosed under that section.

(2) 5The code of practice must be consistent with the code of practice issued under
section 52B (data-sharing code) of the Data Protection Act 1998 (as altered or
replaced from time to time).

(3) A specified person must have regard to the code of practice in—

(a) disclosing information under section 40, and

(b) 10using information disclosed under that section.

(4) The relevant Minister may from time to time revise and re-issue the code of
practice.

(5) Before issuing or reissuing the code of practice the relevant Minister must
consult—

(a) 15the Information Commissioner,

(b) the Commissioners for Her Majesty’s Revenue and Customs,

(c) the Scottish Ministers,

(d) the Welsh Ministers,

(e) the Department of Finance in Northern Ireland, and

(f) 20such other persons as the relevant Minister thinks appropriate.

(6) The fact that this section was not in force when consultation of the kind
mentioned in subsection (5) took place is to be disregarded in determining
whether there has been compliance with that subsection.

(7) As soon as is reasonably practicable after issuing or reissuing the code of
25practice the relevant Minister must lay, or arrange for the laying of, a copy of
it before—

(a) Parliament,

(b) the Scottish Parliament,

(c) the National Assembly for Wales, and

(d) 30the Northern Ireland Assembly.

45 Duty to review operation of Chapter

(1) As soon as is reasonably practicable after the end of three years beginning with
the day on which this Chapter comes into force, the relevant Minister must
review its operation for the purposes of deciding whether it should be
35amended or repealed.

(2) Before carrying out the review the relevant Minister must publish the criteria
by reference to which that determination will be made.

(3) In carrying out the review the relevant Minister must consult—

(a) the Information Commissioner,

(b) 40the Scottish Ministers,

(c) the Welsh Ministers,

(d) the Department of Finance in Northern Ireland, and

(e) such other persons as the relevant Minister thinks appropriate.

Digital Economy BillPage 44

(4) Once the review is completed the relevant Minister must—

(a) publish a report on its outcome, and

(b) lay, or arrange for the laying of, a copy of the report before—

(i) Parliament,

(ii) 5the Scottish Parliament,

(iii) the National Assembly for Wales, and

(iv) the Northern Ireland Assembly.

(5) If as a result of the review the relevant Minister decides that this Chapter
should be amended or repealed, the relevant Minister may by regulations
10amend or repeal it (as the case may be).

(6) The relevant Minister may only make regulations under subsection (5) with the
consent of the Treasury in a case where the regulations could affect the
disclosure of information by the Revenue and Customs.

(7) Anything required to be published by this section is to be published in such
15manner as the relevant Minister thinks fit.

46 Regulations under this Chapter

(1) Any power to make regulations under this Chapter is exercisable—

(a) in the case of regulations made by the relevant Minister or the Welsh
Ministers, by statutory instrument, and

(b) 20in the case of regulations made by the Department of Finance in
Northern Ireland, by statutory rule for the purposes of the Statutory
Rules (Northern Ireland) Order 1979 (SI 1979/1573 (NI 12)SI 1979/1573 (NI 12)).

(2) Regulations under this Chapter—

(a) may make different provision for different purposes;

(b) 25may contain consequential, supplementary, transitional or transitory
provision or savings.

(3) The provision that may be made by virtue of subsection (2)(b) includes—

(a) provision amending this Chapter or repealing or revoking any
provision of this Chapter;

(b) 30provision amending, repealing or revoking an enactment passed or
made before or in the same session as this Act.

(4) In the case of regulations under section 40(4) which specify a person or
description of person, this includes provision amending this Chapter so as to
make provision in relation to information disclosed by that person or a person
35of that description which is similar to that made by section 43 in relation to
information disclosed by the Revenue and Customs.

(5) A statutory instrument containing regulations made under this Chapter by the
relevant Minister may not be made unless a draft of the instrument has been
laid before, and approved by a resolution of, each House of Parliament.

(6) 40Regulations made under section 40(4) by the Scottish Ministers are subject to
the affirmative procedure.

(7) A statutory instrument containing regulations made under section 40(4) by the
Welsh Ministers may not be made unless a draft of the instrument has been laid
before, and approved by a resolution of, the National Assembly for Wales.

Digital Economy BillPage 45

(8) Regulations under section 40(4) may not be made by the Department of
Finance in Northern Ireland unless a draft of the regulations has been laid
before, and approved by a resolution of, the Northern Ireland Assembly.

(9) If a draft of a statutory instrument containing regulations under section 40(4)
5would, apart from this subsection, be treated for the purposes of the standing
orders of either House of Parliament as a hybrid instrument, it is to proceed in
that House as if it were not such an instrument.

47 Interpretation of this Chapter

(1) In this Chapter—

  • 10“the appropriate national authority” means the relevant Minister, subject
    to subsections (2) to (7);

  • “enactment” includes—

    (a)

    an enactment contained in, or in an instrument made under, an
    Act of the Scottish Parliament;

    (b)

    15an enactment contained in, or in an instrument made under, a
    Measure or Act of the National Assembly for Wales;

    (c)

    an enactment contained in, or in an instrument made under,
    Northern Ireland legislation;

    (d)

    an enactment contained in subordinate legislation within the
    20meaning of the Interpretation Act 1978;

  • “functions” means functions of a public nature;

  • “personal information” has the meaning given by section 41(4);

  • “public authority” means—

    (a)

    a person or body exercising functions of a public nature in the
    25United Kingdom,

    (b)

    a person or body entirely or substantially funded from public
    money,

    (c)

    an office-holder appointed by a person or body falling within
    paragraph (a), or

    (d)

    30a body more than half of whose governing body or members are
    appointed by a person or body falling within paragraph (a);

  • “relevant Minister” means the Secretary of State or the Minister for the
    Cabinet Office;

  • “the Revenue and Customs” has the meaning given by section 17(3) of the
    35Commissioners for Revenue and Customs Act 2005;

  • “specified person” has the meaning given by section 40(4).

(2) The Scottish Ministers are the appropriate national authority in relation to
regulations under section 40(4) which specify a person who is, or a description
of persons each of whom is, a Scottish body.

(3) 40In subsection (2) “Scottish body” means—

(a) a person who is a part of the Scottish Administration,

(b) a Scottish public authority with mixed functions or no reserved
functions (within the meaning of the Scotland Act 1998), or

(c) a person providing services to a person within paragraph (a) or (b).

(4) 45The Welsh Ministers are the appropriate national authority in relation to
regulations under section 40(4) which specify a person who is, or a description
of persons each of whom is, a Welsh body.

Digital Economy BillPage 46

(5) In subsection (4) “Welsh body” means—

(a) a person who wholly or mainly exercises functions which could be
conferred on the person by provision which falls within the legislative
competence of the National Assembly for Wales, or

(b) 5a person providing services to a person within paragraph (a).

(6) The Department of Finance in Northern Ireland is the appropriate national
authority in relation to regulations under section 40(4) which specify a person
who is, or a description of persons each of whom is, a Northern Ireland body.

(7) In subsection (6) “Northern Ireland body” means—

(a) 10a Minister within the meaning of the Northern Ireland Act 1998,

(b) a Northern Ireland department,

(c) a Northern Ireland public authority within the meaning of the Statistics
and Registration Service Act 2007, or

(d) a person providing services to a person within paragraph (a), (b) or (c).

CHAPTER 4 15Fraud against the public sector

48 Disclosure of information to combat fraud against the public sector

(1) A specified person may disclose information held by the person in connection
with any of the person’s functions to another specified person for the purposes
of the taking of action in connection with fraud against a public authority.

(2) 20In this section “fraud against a public authority” means a fraud offence which
involves—

(a) loss to a public authority, or

(b) the exposure of a public authority to a risk of loss.

(3) In subsection (2)

(a) 25“fraud offence” means an offence under section 1 of the Fraud Act 2006
or, in relation to Scotland, an offence of fraud, and

(b) “loss”, as it applies in relation to an offence under section 1 of the Fraud
Act 2006, has the meaning given by section 5 of that Act.

(4) The reference in subsection (1) to taking action in connection with fraud
30against a public authority includes any of the following—

(a) preventing fraud of that kind;

(b) detecting fraud of that kind;

(c) investigating fraud of that kind;

(d) prosecuting fraud of that kind;

(e) 35bringing civil proceedings as a result of fraud of that kind;

(f) taking administrative action as a result of fraud of that kind.

(5) In this Chapter “specified person” means a person specified, or of a description
specified, in regulations made by the appropriate national authority.

(6) A person specified in regulations under subsection (5) must be—

(a) 40a public authority, or

(b) a person providing services to a public authority.

Digital Economy BillPage 47

(7) In the case of a person (“P”) who is a specified person merely because of
providing services to a public authority, the reference in subsection (1) to the
functions of a specified person is limited to the functions P exercises for that
purpose.

(8) 5In determining whether to make regulations under subsection (5) in relation to
a person or description of person the appropriate national authority must have
regard, in particular, to—

(a) the systems and procedures for the secure handling of information by
that person or persons of that description, and

(b) 10in the case of regulations which amend or revoke previous regulations
so that the person ceases to be a specified person, whether that person,
or any person providing services to that person, has had regard to the
code of practice under section 52 as required by that section.

(9) Before making regulations under subsection (5) the appropriate national
15authority must consult—

(a) the Information Commissioner,

(b) the Commissioners for Her Majesty’s Revenue and Customs,

(c) each other person who is the appropriate national authority in relation
to regulations under subsection (5),

(d) 20where the appropriate national authority is not the relevant Minister,
the Minister for the Cabinet Office, and

(e) such other persons as the appropriate national authority thinks
appropriate.

(10) The fact this section was not in force when consultation of the kind mentioned
25in subsection (9) took place is to be disregarded in determining whether there
has been compliance with that subsection.

(11) In this Chapter “public authority” means—

(a) a person or body exercising functions of a public nature in the United
Kingdom,

(b) 30a person or body entirely or substantially funded from public money,

(c) an office-holder appointed by a person or body falling within
paragraph (a), or

(d) a body more than half of whose governing body or members are
appointed by a person or body falling within paragraph (a).

49 35Further provisions about power in section 48

(1) Personal information disclosed under section 48 may only be used by the
person to whom it is disclosed for the purposes for which it was disclosed,
subject to subsection (2).

(2) Subsection (1) does not prevent the use of information by a person—

(a) 40if the information has already lawfully been made available to the
public,

(b) if the person to whom the information relates consents to its use for
another purpose,

(c) for the prevention or detection of crime or the prevention of anti-social
45behaviour,

(d) for the purposes of a criminal investigation,

(e) for the purposes of legal proceedings (whether civil or criminal), or

Digital Economy BillPage 48

(f) for the purposes of—

(i) preventing serious physical harm to a person,

(ii) preventing loss of human life,

(iii) safeguarding vulnerable adults or children,

(iv) 5responding to an emergency, or

(v) protecting national security.

(3) In subsection (2)(c) “anti-social behaviour” has the same meaning as in Part 1
of the Anti-social Behaviour, Crime and Policing Act 2014 (see section 2 of that
Act).

(4) 10Subsection (2) does not apply to information disclosed to a person under
section 48 by the Revenue and Customs; but such information may be used by
that person for purposes other than those for which it was disclosed with the
consent of the Commissioners for Her Majesty’s Revenue and Customs (which
may be general or specific).

(5) 15For the purposes of this Chapter information is “personal information” if—

(a) it relates to and identifies a particular person (including a body
corporate), but

(b) it is not information about the internal administrative arrangements of
a specified person.

(6) 20For the purposes of subsection (1) information identifies a particular person if
the identity of that person—

(a) is specified in the information,

(b) can be deduced from the information, or

(c) can be deduced from the information taken together with any other
25information.

(7) A disclosure under section 48 does not breach—

(a) any obligation of confidence owed by the person making the
disclosure, or

(b) any other restriction on the disclosure of information (however
30imposed).

(8) But nothing in section 48 authorises the making of a disclosure which—

(a) contravenes the Data Protection Act 1998, or

(b) is prohibited by Part 1 of the Regulation of Investigatory Powers Act
2000.

(9) 35Section 48 does not limit the circumstances in which information may be
disclosed apart from that section.

50 Confidentiality of personal information

(1) Personal information received by a person (“P”) under section 48 may not be
disclosed—

(a) 40by P, or

(b) by any other person who has received it directly or indirectly from P.

(2) Subsection (1) does not apply to a disclosure—

(a) which is required or permitted by any enactment (including section 48),

(b) which is required by an EU obligation,

Digital Economy BillPage 49

(c) which is made in pursuance of an order of the court,

(d) of information which has already lawfully been made available to the
public,

(e) for the prevention or detection of crime or the prevention of anti-social
5behaviour,

(f) which is made for the purposes of a criminal investigation,

(g) which is made for the purposes of legal proceedings (whether civil or
criminal),

(h) which is made with the consent of the person to whom it relates, or

(i) 10which is made for the purposes of—

(i) preventing serious physical harm to a person,

(ii) preventing loss of human life,

(iii) safeguarding vulnerable adults or children,

(iv) responding to an emergency, or

(v) 15protecting national security.

(3) In subsection (2)(e) “anti-social behaviour” has the same meaning as in Part 1
of the Anti-social Behaviour, Crime and Policing Act 2014 (see section 2 of that
Act).

(4) A person commits an offence if—

(a) 20the person discloses personal information in contravention of
subsection (1), and

(b) at the time that the person makes the disclosure, the person knows that
the disclosure contravenes that subsection or is reckless as to whether
the disclosure does so.

(5) 25A person who is guilty of an offence under subsection (4) is liable on conviction
on indictment to imprisonment for a term not exceeding two years, to a fine or
to both.

(6) A person who is guilty of an offence under subsection (4) is liable on summary
conviction—

(a) 30in England and Wales, to imprisonment for a term not exceeding 12
months, to a fine or to both;

(b) in Scotland, to imprisonment for a term not exceeding 12 months, to a
fine not exceeding the statutory maximum or to both;

(c) in Northern Ireland, to imprisonment for a term not exceeding 6
35months, to a fine not exceeding the statutory maximum or to both.

(7) In the application of subsection (6)(a) to an offence committed before the
coming into force of section 154(1) of the Criminal Justice Act 2003 the
reference to 12 months is to be read as a reference to 6 months.

(8) This section does not apply to personal information disclosed under section 48
40by the Revenue and Customs.

51 Information disclosed by the Revenue and Customs

(1) Personal information disclosed by the Revenue and Customs under section 48
and received by a person (“P”) may not be disclosed—

(a) by P, or

(b) 45by any other person who has received it directly or indirectly from P.