Digital Economy Bill (HC Bill 87)

Digital Economy BillPage 60

CHAPTER 6 Her Majesty's Revenue and Customs

64 Disclosure of non-identifying information by HMRC

(1) A Revenue and Customs official may disclose to any person information held
by the Revenue and Customs in connection with a function of the Revenue and
5Customs if—

(a) the information is non-identifying information, and

(b) the official thinks that the disclosure would be in the public interest.

(2) Information is non-identifying information for the purposes of this section if—

(a) it is not, and has never been, identifying information, or

(b) 10it has been created by combining identifying information, but is not
itself identifying information.

(3) Information is identifying information for the purposes of this section if it
relates to a person whose identity—

(a) is specified in the information,

(b) 15can be deduced from the information, or

(c) can be deduced from the information taken together with any other
information.

(4) In this section—

(a) “Revenue and Customs official” has the meaning given by section
2018(4)(a) of the Commissioners for Revenue and Customs Act 2005,

(b) “the Revenue and Customs” has the meaning given by section 17(3) of
that Act, and

(c) “function of the Revenue and Customs” has the meaning given by
section 18(4)(c) of that Act.

CHAPTER 7 25Statistics

65 Disclosure of information by HMRC to the Statistics Board

(1) Section 45 of the Statistics and Registration Service Act 2007 (disclosure of
HMRC information to the Statistics Board) is amended as follows.

(2) In subsection (2) omit “, other than its function under section 22 (statistical
30services)”.

(3) After subsection (2) insert—

(2A) In determining whether the condition in subsection (2) is met the
Commissioners must have regard to any views of the Board which have
been communicated to them.”

(4) 35In subsection (3) omit “, other than its function under section 22”.

Digital Economy BillPage 61

(5) After that subsection insert—

(3A) Information disclosed under subsection (1) may not be used by the
Board for the purposes of its function under section 22 (statistical
services) except with the consent of the Commissioners.”

(6) 5Omit subsection (5) (which prevents the disclosure of personal information not
relating to imports or exports).

66 Disclosure of information by public authorities to the Statistics Board

(1) The Statistics and Registration Service Act 2007 is amended as follows.

(2) After section 45 insert—

45A 10Information held by other public authorities

(1) A public authority to which this section applies may, subject to this
section, disclose to the Board any information held by the authority in
connection with its functions.

(2) This section applies to a public authority other than—

(a) 15the Commissioners for Her Majesty’s Revenue and Customs, or

(b) an officer of Revenue and Customs.

(3) A public authority may disclose information under subsection (1) only
if it is satisfied that the Board requires the information to enable it to
exercise one or more of its functions.

(4) 20In determining whether the condition in subsection (3) is met the public
authority must have regard to any views of the Board which have been
communicated to the authority.

(5) Information disclosed under subsection (1) may only be used by the
Board for the purposes of any one or more of its functions.

(6) 25Information disclosed under subsection (1) may not be used by the
Board for the purposes of its function under section 22 (statistical
services) except with the consent of the public authority which
disclosed the information.

(7) Where personal information is disclosed by a public authority to the
30Board under subsection (1), the Board may not disclose the information
to an approved researcher under section 39(4)(i) except with the
consent of the public authority.

(8) A disclosure under subsection (1) does not breach—

(a) any obligation of confidence owed by the public authority
35making the disclosure, or

(b) any other restriction on the disclosure of information (however
imposed).

(9) But subsection (1) does not authorise the making of a disclosure
which—

(a) 40contravenes the Data Protection Act 1998,

(b) is prohibited by Part 1 of the Regulation of Investigatory Powers
Act 2000, or

Digital Economy BillPage 62

(c) contravenes directly applicable EU legislation or any enactment
to the extent that it implements EU legislation.

(10) This section does not limit the circumstances in which information may
be disclosed apart from this section.”

(3) 5Omit—

(a) section 47 (power to authorise disclosure to the Board);

(b) section 48 (power to authorise disclosure to the Board: Scotland);

(c) section 49 (power to authorise disclosure to the Board: Northern
Ireland).

(4) 10In section 54 (Data Protection Act 1998 and Human Rights Act 1998) for “47”
substitute “50”.

(5) In section 65 (orders and regulations)—

(a) in subsection (4) omit “47(11),”,

(b) in subsection (5)(b) omit “47,”,

(c) 15in subsection (6)(b) omit “48 or”, and

(d) in subsection (9)(c) omit “49 or”.

(6) In section 67 (general interpretation) for the definition of “enactment”
substitute—

  • ““enactment” includes—

    (a)

    20an enactment contained in subordinate legislation
    within the meaning of the Interpretation Act 1978;

    (b)

    an enactment contained in, or in an instrument made
    under, an Act of the Scottish Parliament;

    (c)

    an enactment contained in, or in an instrument made
    25under, a Measure or Act of the National Assembly for
    Wales;

    (d)

    an enactment contained in, or in an instrument made
    under, Northern Ireland legislation;”.

67 Access to information by Statistics Board

30After section 45A of the Statistics and Registration Service Act 2007  (inserted
by section 66) insert—

45B Access to information held by Crown bodies etc

(1) This section applies to—

(a) a public authority which is an emanation of the Crown or a
35servant or agent of the Crown,

(b) the Bank of England (including in the exercise of its functions as
the Prudential Regulation Authority),

(c) a subsidiary undertaking of the Bank of England within the
meaning of the Companies Acts (see sections 1161 and 1162 of
40the Companies Act 2006),

(d) the Financial Conduct Authority, and

(e) the Payment Systems Regulator established under section 40 of
the Financial Services (Banking Reform) Act 2013.

(2) Subject to this section and section 45E, the Board has a right of access to
45information which—

Digital Economy BillPage 63

(a) is held by a public authority to which this section applies in
connection with its functions, and

(b) is required by the Board to enable it to exercise one or more of
its functions.

(3) 5Subsection (2) does not apply to information if the disclosure of that
information—

(a) would contravene the Data Protection Act 1998,

(b) would be prohibited by Part 1 of the Regulation of Investigatory
Powers Act 2000, or

(c) 10would contravene directly applicable EU legislation or any
enactment to the extent that it implements EU legislation.

(4) The right of access in subsection (2) is to be exercised in accordance
with the following provisions of this section.

(5) The Board may, by notice in writing to the public authority, request the
15authority to disclose the information to the Board.

(6) A notice under subsection (5) must—

(a) set out the Board’s reasons for requesting the information to be
disclosed, and

(b) specify the date by which or the period within which the public
20authority must respond to the request.

(7) The public authority must, by that date or within that period, provide
a response in writing to the Board which—

(a) indicates that it is willing to provide the information and gives
the date by which it will be provided, or

(b) 25indicates that it is not willing to provide the information and
gives reasons for not providing it.

(8) Subsection (9) applies if—

(a) the public authority fails to respond to the request in
accordance with subsection (7),

(b) 30the public authority indicates that it is not willing to provide the
information requested, or

(c) the public authority has indicated that it is willing to provide
the information requested, but the Board considers that the
public authority is failing to take reasonable steps to comply
35with that request.

(9) The Board may lay the request and any response by the public
authority before the relevant legislature.

(10) In subsection (9) “the relevant legislature” means Parliament, subject as
follows.

(11) 40The Scottish Parliament is the relevant legislature if the public
authority—

(a) is a part of the Scottish Administration, or

(b) is a Scottish public authority with mixed functions or no
reserved functions (within the meaning of the Scotland Act
451998).

Digital Economy BillPage 64

(12) The National Assembly for Wales is the relevant legislature if the public
authority is a Wales public authority as defined by section 157A of the
Government of Wales Act 2006.

(13) The Northern Ireland Assembly is the relevant legislature if—

(a) 5the public authority exercises functions only as regards
Northern Ireland, and

(b) its functions are wholly or mainly functions which relate to
transferred matters (within the meaning of the Northern Ireland
Act 1998).

(14) 10This section does not apply to—

(a) Her Majesty in Her private capacity,

(b) Her Majesty in right of the Duchy of Lancaster, or

(c) the Duke of Cornwall.

(15) Until the coming into force of section 12 of the Bank of England and
15Financial Services Act 2016 subsection (1)(b) has effect as if the words
in brackets were omitted.

45C Power to require disclosures by other public authorities

(1) This section applies to a public authority to which section 45B does not
apply (other than one within subsection (14) of that section).

(2) 20Subject to this section and section 45E, the Board may, by notice in
writing to a public authority to which this section applies, require the
authority to disclose to the Board information which—

(a) is held by the authority in connection with its functions, and

(b) is specified, or is of a kind specified, in the notice.

(3) 25A notice under subsection (2) may require information to be disclosed
on more than one date specified in the notice within a period specified
in the notice.

(4) A notice under subsection (2) other than one within subsection (3) must
specify the date by which or the period within which the information
30must be disclosed.

(5) A notice under subsection (2) may specify the form or manner in which
the information to which it relates must be disclosed.

(6) A notice under subsection (2) may require the public authority to
consult the Board before making changes to—

(a) 35its processes for collecting, organising, storing or retrieving the
information to which the notice relates, or

(b) its processes for supplying such information to the Board.

(7) The reference in subsection (6) to making changes to a process includes
introducing or removing a process.

(8) 40The Board may give a notice under subsection (2) only if the Board
requires the information to which the notice relates to enable it to
exercise one or more of its functions.

(9) The Board must obtain the consent of the Scottish Ministers before
giving a notice under subsection (2) to a public authority which is a

Digital Economy BillPage 65

Scottish public authority with mixed functions or no reserved functions
(within the meaning of the Scotland Act 1998).

(10) The Board must obtain the consent of the Welsh Ministers before giving
a notice under subsection (2) to a public authority which is a Wales
5public authority as defined by section 157A of the Government of
Wales Act 2006.

(11) The Board must obtain the consent of the Department of Finance in
Northern Ireland before giving a notice under subsection (2) to a public
authority if—

(a) 10the public authority exercises functions only as regards
Northern Ireland, and

(b) its functions are wholly or mainly functions which relate to
transferred matters (within the meaning of the Northern Ireland
Act 1998).

(12) 15A public authority to which a notice under subsection (2) is given must
comply with it.

(13) But the public authority need not comply with the notice if
compliance—

(a) might prejudice national security,

(b) 20would contravene the Data Protection Act 1998,

(c) would be prohibited by Part 1 of the Regulation of Investigatory
Powers Act 2000, or

(d) would contravene directly applicable EU legislation or any
enactment to the extent that it implements EU legislation.

45D 25Power to require disclosure by undertakings

(1) Subject to this section and section 45E, the Board may, by notice in
writing to an undertaking, require the undertaking to disclose to the
Board information which—

(a) is held by the undertaking, and

(b) 30is specified, or is of a kind specified, in the notice.

(2) A notice under subsection (1) may require information to be disclosed
on more than one date specified in the notice within a period specified
in the notice.

(3) A notice under subsection (1) other than one within subsection (2) must
35specify the date by which or the period within which the information
must be disclosed.

(4) A notice under subsection (1) may specify the form or manner in which
the information to which it relates must be disclosed.

(5) A notice under subsection (1) may require the undertaking to consult
40the Board before making changes to—

(a) its processes for collecting, organising, storing or retrieving the
information to which the notice relates, or

(b) its processes for supplying such information to the Board.

(6) The reference in subsection (5) to making changes to a process includes
45introducing or removing a process.

Digital Economy BillPage 66

(7) The Board may give a notice under subsection (1) only if the Board
requires the information to which the notice relates to enable it to
exercise one or more of its functions.

(8) An undertaking to which a notice under subsection (1) is given must
5comply with it.

(9) But the undertaking need not comply with the notice if compliance—

(a) might prejudice national security,

(b) would contravene the Data Protection Act 1998, or

(c) would be prohibited by Part 1 of the Regulation of Investigatory
10Powers Act 2000.

(10) Subject to subsection (12), in this section “undertaking” means—

(a) any person carrying on a trade or business, whether or not with
a view to profit, or

(b) any charity.

(11) 15In subsection (10) “charity” means a body, or the trustees of a trust,
established for charitable purposes only.

(12) The following are not undertakings for the purposes of this section—

(a) a public authority;

(b) a micro business;

(c) 20a small business.

(13) Section 33 of the Small Business, Enterprise and Employment Act 2015
(definitions of small and micro business) and regulations made under
that section apply in relation to subsection (12) as they apply in relation
to subordinate legislation within subsection (1) of that section.

45E 25Further provisions about powers in sections 45B, 45C and 45D

(1) Information disclosed under section 45B, 45C or 45D may only be used
by the Board for the purposes of any one or more of its functions.

(2) Information disclosed under section 45B, 45C or 45D may not be used
by the Board for the purposes of its function under section 22 (statistical
30services) except with the consent of the person who disclosed the
information.

(3) Where personal information is disclosed under section 45B, 45C or 45D,
the Board may not disclose the information to an approved researcher
under section 39(4)(i) except with the consent of the person who
35disclosed the information.

(4) A disclosure pursuant to section 45B, 45C or 45D does not breach—

(a) any obligation of confidence owed by the person making the
disclosure, or

(b) any other restriction on the disclosure of information (however
40imposed).

(5) The Board must prepare and publish a statement of—

(a) the principles to which it will have regard in exercising its
functions under sections 45B, 45C and 45D, and

(b) the procedures which it will adopt in exercising those functions.

Digital Economy BillPage 67

(6) The statement must be consistent with the code of practice issued under
section 52B (data-sharing code) of the Data Protection Act 1998 (as
altered or replaced from time to time).

(7) The Board may at any time revise the statement and, if it decides to do
5so, must publish the statement as revised.

(8) In preparing or revising the statement the Board must consult—

(a) the Minister for the Cabinet Office,

(b) the Information Commissioner,

(c) the Scottish Ministers,

(d) 10the Welsh Ministers,

(e) the Department of Finance in Northern Ireland, and

(f) such other persons as the Board thinks fit.

(9) The fact that this section was not in force when consultation of the kind
mentioned in subsection (8) took place is to be disregarded in
15determining whether there has been compliance with that subsection.

(10) After preparing or revising a statement the Board must lay the
statement, or the statement as revised, before—

(a) Parliament,

(b) the Scottish Parliament,

(c) 20the National Assembly for Wales, and

(d) the Northern Ireland Assembly.

45F Offences relating to notices under section 45C or 45D

(1) A person is guilty of an offence if—

(a) the person is given a notice under section 45C or 45D,

(b) 25the person is required to comply with the notice,

(c) the person fails to do so, and

(d) the person does not have a reasonable excuse for that failure.

(2) A person is guilty of an offence if, in purporting to comply with a notice
under section 45C or 45D, the person—

(a) 30provides information which is false in a material respect, and

(b) knows that the information is false in that respect or is reckless
as to whether it is false in that respect.

(3) A person who is guilty of an offence under subsection (1) or (2) is liable
on summary conviction—

(a) 35in England and Wales, to a fine, and

(b) in Scotland or Northern Ireland, to a fine not exceeding level 5
on the standard scale.

(4) If an offence under this section is committed by a body corporate with
the consent or connivance of an officer of the body, the officer, as well
40as the body, is to be treated as having committed the offence.

(5) In subsection (4) a reference to an officer of a body includes a reference
to—

(a) a director, manager or secretary,

(b) a person purporting to act as a director, manager or secretary,
45and

Digital Economy BillPage 68

(c) if the affairs of the body are managed by its members, a
member.

(6) Where an offence under this section is committed by a partnership
(whether or not a limited partnership) subsection (4) has effect, but as
5if a reference to an officer of the body were a reference to—

(a) a partner, and

(b) a person purporting to act as a partner.

45G Code of practice on changes to data systems

(1) The Board must prepare, adopt and publish a code of practice
10containing guidance on the matters to be taken into account by a public
authority in making changes to—

(a) its processes for collecting, organising, storing or retrieving
information, or

(b) its processes (if any) for supplying information to the Board.

(2) 15A public authority must have regard to any code of practice under this
section in making such changes.

(3) The Board may at any time revise a code of practice under this section
and, if it decides to do so, must publish the code as revised.

(4) In preparing or revising a code of practice under this section, the Board
20must consult—

(a) the Minister for the Cabinet Office,

(b) the Scottish Ministers,

(c) the Welsh Ministers,

(d) the Department of Finance in Northern Ireland, and

(e) 25such other persons as the Board thinks fit.

(5) The fact that this section was not in force when consultation of the kind
mentioned in subsection (4) took place is to be disregarded in
determining whether there has been compliance with that subsection.

(6) After preparing or revising a code of practice under this section the
30Board must lay the code, or the code as revised, before—

(a) Parliament,

(b) the Scottish Parliament,

(c) the National Assembly for Wales, and

(d) the Northern Ireland Assembly.

(7) 35The reference in subsection (1) to making changes to a process includes
introducing or removing a process.

(8) This section binds the Crown.

(9) The reference to the Crown in subsection (8) does not include—

(a) Her Majesty in Her private capacity,

(b) 40Her Majesty in right of the Duchy of Lancaster, or

(c) the Duke of Cornwall.”

Digital Economy BillPage 69

68 Disclosure by the Statistics Board to devolved administrations

After section 53 of the Statistics and Registration Service Act 2007 insert—

53A Disclosure by the Board to devolved administrations

(1) Subject to this section, the Board may disclose information held by the
5Board in connection with the exercise of any of its functions to a
devolved authority.

(2) In this section “devolved authority” means—

(a) a person who is a part of the Scottish Administration,

(b) the Welsh Ministers, or

(c) 10the Department of Finance in Northern Ireland.

(3) Information may only be disclosed under this section for the purposes
of any or all of the statistical functions of a devolved authority.

(4) Information may only be disclosed under this section in response to a
request in writing by a devolved authority which specifies—

(a) 15the information which is sought, and

(b) the purposes for which it is sought.

(5) A request under subsection (4) may request information to be disclosed
on more than one date specified in the notice within a period specified
in the notice.

(6) 20Information may be disclosed under this section only if—

(a) the Board is satisfied that the information is required for the
purposes of the statistical functions of the devolved authority
which are specified in the request,

(b) the Board is satisfied that the information will not be used for
25any other purpose, and

(c) if the information was obtained by the Board from a public
authority, the authority consents to the disclosure.

(7) The Board may—

(a) disclose information under this section subject to conditions to
30be met by the devolved authority;

(b) from time to time modify conditions subject to which
information has been disclosed;

(c) in the case of information which it is disclosing in response to a
request to which subsection (5) applies, cease to disclose
35information in response to the request if any of the conditions
are breached.

(8) A devolved authority may only use information disclosed under this
section for the purposes for which it was disclosed.

(9) In the application of section 39 to personal information which has been
40disclosed to a devolved authority under this section, paragraphs (c)
and (i) of subsection (4) of that section do not apply.

(10) This section does not authorise the making of a disclosure which
would—

(a) breach any obligation of confidence owed by the Board,

(b) 45contravene the Data Protection Act 1998,