Digital Economy Bill (HL Bill 80)

Digital Economy BillPage 50

(11) In this Chapter “public authority” means—

(a) a person or body exercising functions of a public nature in the United
Kingdom,

(b) a person or body entirely or substantially funded from public money,

(c) 5an office-holder appointed by a person or body falling within
paragraph (a), or

(d) a body more than half of whose governing body or members are
appointed by a person or body falling within paragraph (a).

50 Further provisions about power in section 49

(1) 10Personal information disclosed under section 49 may only be used by the
person to whom it is disclosed for the purposes for which it was disclosed,
subject to subsection (2).

(2) Subsection (1) does not prevent the use of information by a person—

(a) if the information has already lawfully been made available to the
15public,

(b) if the person to whom the information relates consents to its use for
another purpose,

(c) for the prevention or detection of crime or the prevention of anti-social
behaviour,

(d) 20for the purposes of a criminal investigation,

(e) for the purposes of legal proceedings (whether civil or criminal), or

(f) for the purposes of—

(i) preventing serious physical harm to a person,

(ii) preventing loss of human life,

(iii) 25safeguarding vulnerable adults or children,

(iv) responding to an emergency, or

(v) protecting national security.

(3) In subsection (2)(c) “anti-social behaviour” has the same meaning as in Part 1
of the Anti-social Behaviour, Crime and Policing Act 2014 (see section 2 of that
30Act).

(4) Subsection (2) does not apply to information disclosed to a person under
section 49 by the Revenue and Customs; but such information may be used by
that person for purposes other than those for which it was disclosed with the
consent of the Commissioners for Her Majesty’s Revenue and Customs (which
35may be general or specific).

(5) For the purposes of this Chapter information is “personal information” if—

(a) it relates to and identifies a particular person (including a body
corporate), but

(b) it is not information about the internal administrative arrangements of
40a specified person.

(6) For the purposes of subsection (1) information identifies a particular person if
the identity of that person—

(a) is specified in the information,

(b) can be deduced from the information, or

(c) 45can be deduced from the information taken together with any other
information.

Digital Economy BillPage 51

(7) A disclosure under section 49 does not breach—

(a) any obligation of confidence owed by the person making the
disclosure, or

(b) any other restriction on the disclosure of information (however
5imposed).

(8) But nothing in section 49 authorises the making of a disclosure which—

(a) contravenes the Data Protection Act 1998, or

(b) is prohibited by Part 1 of the Regulation of Investigatory Powers Act
2000.

(9) 10Section 49 does not limit the circumstances in which information may be
disclosed apart from that section.

51 Confidentiality of personal information

(1) Personal information received by a person (“P”) under section 49 may not be
disclosed—

(a) 15by P, or

(b) by any other person who has received it directly or indirectly from P.

(2) Subsection (1) does not apply to a disclosure—

(a) which is required or permitted by any enactment (including section 49),

(b) which is required by an EU obligation,

(c) 20which is made in pursuance of an order of the court,

(d) of information which has already lawfully been made available to the
public,

(e) which is made for the prevention or detection of crime or the
prevention of anti-social behaviour,

(f) 25which is made for the purposes of a criminal investigation,

(g) which is made for the purposes of legal proceedings (whether civil or
criminal),

(h) which is made with the consent of the person to whom it relates, or

(i) which is made for the purposes of—

(i) 30preventing serious physical harm to a person,

(ii) preventing loss of human life,

(iii) safeguarding vulnerable adults or children,

(iv) responding to an emergency, or

(v) protecting national security.

(3) 35In subsection (2)(e) “anti-social behaviour” has the same meaning as in Part 1
of the Anti-social Behaviour, Crime and Policing Act 2014 (see section 2 of that
Act).

(4) A person commits an offence if—

(a) the person discloses personal information in contravention of
40subsection (1), and

(b) at the time that the person makes the disclosure, the person knows that
the disclosure contravenes that subsection or is reckless as to whether
the disclosure does so.

Digital Economy BillPage 52

(5) A person who is guilty of an offence under subsection (4) is liable on conviction
on indictment to imprisonment for a term not exceeding two years, to a fine or
to both.

(6) A person who is guilty of an offence under subsection (4) is liable on summary
5conviction—

(a) in England and Wales, to imprisonment for a term not exceeding 12
months, to a fine or to both;

(b) in Scotland, to imprisonment for a term not exceeding 12 months, to a
fine not exceeding the statutory maximum or to both;

(c) 10in Northern Ireland, to imprisonment for a term not exceeding 6
months, to a fine not exceeding the statutory maximum or to both.

(7) In the application of subsection (6)(a) to an offence committed before the
coming into force of section 154(1) of the Criminal Justice Act 2003 the
reference to 12 months is to be read as a reference to 6 months.

(8) 15This section does not apply to personal information disclosed under section 49
by the Revenue and Customs.

52 Information disclosed by the Revenue and Customs

(1) Personal information disclosed by the Revenue and Customs under section 49
and received by a person (“P”) may not be disclosed—

(a) 20by P, or

(b) by any other person who has received it directly or indirectly from P.

(2) Subsection (1) does not apply to a disclosure which is made with the consent
of the Commissioners for Her Majesty’s Revenue and Customs (which may be
general or specific).

(3) 25A person who contravenes subsection (1) is guilty of an offence.

(4) It is a defence for a person charged with an offence under subsection (3) to
prove that the person reasonably believed—

(a) that the disclosure was lawful, or

(b) that the information had already and lawfully been made available to
30the public.

(5) Subsections (4) to (7) of section 19 of the Commissioners for Revenue and
Customs Act 2005 apply to an offence under subsection (3) as they apply to an
offence under that section.

53 Code of practice

(1) 35The relevant Minister must issue a code of practice about—

(a) the disclosure of information under section 49, and

(b) the use of information disclosed under that section.

(2) The code of practice must be consistent with the code of practice issued under
section 52B (data-sharing code) of the Data Protection Act 1998 (as altered or
40replaced from time to time).

(3) A specified person must have regard to the code of practice in—

(a) disclosing information under section 49, and

(b) using information disclosed under that section.

Digital Economy BillPage 53

(4) The relevant Minister may from time to time revise and re-issue the code of
practice.

(5) Before issuing or reissuing the code of practice the relevant Minister must
consult—

(a) 5the Information Commissioner,

(b) the Commissioners for Her Majesty’s Revenue and Customs,

(c) the Scottish Ministers,

(d) the Welsh Ministers,

(e) the Department of Finance in Northern Ireland, and

(f) 10such other persons as the relevant Minister thinks appropriate.

(6) The fact that this section was not in force when consultation of the kind
mentioned in subsection (5) took place is to be disregarded in determining
whether there has been compliance with that subsection.

(7) As soon as is reasonably practicable after issuing or reissuing the code of
15practice the relevant Minister must lay, or arrange for the laying of, a copy of
it before—

(a) Parliament,

(b) the Scottish Parliament,

(c) the National Assembly for Wales, and

(d) 20the Northern Ireland Assembly.

54 Duty to review operation of Chapter

(1) As soon as is reasonably practicable after the end of three years beginning with
the day on which this Chapter comes into force, the relevant Minister must
review its operation for the purposes of deciding whether it should be
25amended or repealed.

(2) Before carrying out the review the relevant Minister must publish the criteria
by reference to which that determination will be made.

(3) In carrying out the review the relevant Minister must consult—

(a) the Information Commissioner,

(b) 30the Scottish Ministers,

(c) the Welsh Ministers,

(d) the Department of Finance in Northern Ireland, and

(e) such other persons as the relevant Minister thinks appropriate.

(4) Once the review is completed the relevant Minister must—

(a) 35publish a report on its outcome, and

(b) lay, or arrange for the laying of, a copy of the report before—

(i) Parliament,

(ii) the Scottish Parliament,

(iii) the National Assembly for Wales, and

(iv) 40the Northern Ireland Assembly.

(5) If as a result of the review the relevant Minister decides that this Chapter
should be amended or repealed, the relevant Minister may by regulations
amend or repeal it (as the case may be).

Digital Economy BillPage 54

(6) The relevant Minister may only make regulations under subsection (5) with the
consent of the Scottish Ministers if the regulations—

(a) repeal this Chapter,

(b) amend or remove the power of the Scottish Ministers to make
5regulations under section 49(5),

(c) affect the disclosure of information under section 49 by a Scottish body
to another such body,

(d) affect the use by a Scottish body of information disclosed under that
section by such a body, or

(e) 10affect the further disclosure to a Scottish body by such a body, or by a
member, officer or employee of such a body, of information disclosed
under this Chapter by a Scottish body.

(7) The relevant Minister may only make regulations under subsection (5) with the
consent of the Welsh Ministers if the regulations—

(a) 15repeal this Chapter,

(b) amend or remove the power of the Welsh Ministers to make
regulations under section 49(5),

(c) affect the disclosure of information under section 49 by a Welsh body
to another such body,

(d) 20affect the use by a Welsh body of information disclosed under that
section by such a body, or

(e) affect the further disclosure to a Welsh body by such a body, or by a
member, officer or employee of such a body, of information disclosed
under this Chapter by a Welsh body.

(8) 25The relevant Minister may only make regulations under subsection (5) with the
consent of the Department of Finance in Northern Ireland if the regulations—

(a) repeal this Chapter,

(b) amend or remove the power of the Department to make regulations
under section 49(5),

(c) 30affect the disclosure of information under section 49 by a Northern
Ireland body to another such body,

(d) affect the use by a Northern Ireland body of information disclosed
under that section by such a body, or

(e) affect the further disclosure to a Northern Ireland body by such a body,
35or by a member, officer or employee of such a body, of information
disclosed under this Chapter by a Northern Ireland body.

(9) The relevant Minister may only make regulations under subsection (5) with the
consent of the Treasury in a case where the regulations could affect the
disclosure of information by the Revenue and Customs.

(10) 40Anything required to be published by this section is to be published in such
manner as the relevant Minister thinks fit.

55 Regulations under this Chapter

(1) Any power to make regulations under this Chapter is exercisable—

(a) in the case of regulations made by the relevant Minister or the Welsh
45Ministers, by statutory instrument, and

Digital Economy BillPage 55

(b) in the case of regulations made by the Department of Finance in
Northern Ireland, by statutory rule for the purposes of the Statutory
Rules (Northern Ireland) Order 1979 (SI 1979/1573 (NI 12)).

(2) Regulations under this Chapter—

(a) 5may make different provision for different purposes;

(b) may contain consequential, supplementary, transitional or transitory
provision or savings.

(3) The provision that may be made by virtue of subsection (2)(b) includes—

(a) provision amending this Chapter or repealing or revoking any
10provision of this Chapter;

(b) provision amending, repealing or revoking an enactment passed or
made before or in the same session as this Act.

(4) In the case of regulations under section 49(5) which specify a person or
description of person, this includes provision amending this Chapter so as to
15make provision in relation to information disclosed by that person or a person
of that description which is similar to that made by section 52 in relation to
information disclosed by the Revenue and Customs.

(5) A statutory instrument containing regulations made under this Chapter by the
relevant Minister may not be made unless a draft of the instrument has been
20laid before, and approved by a resolution of, each House of Parliament.

(6) Regulations made under section 49(5) by the Scottish Ministers are subject to
the affirmative procedure.

(7) A statutory instrument containing regulations made under section 49(5) by the
Welsh Ministers may not be made unless a draft of the instrument has been laid
25before, and approved by a resolution of, the National Assembly for Wales.

(8) Regulations under section 49(5) may not be made by the Department of
Finance in Northern Ireland unless a draft of the regulations has been laid
before, and approved by a resolution of, the Northern Ireland Assembly.

(9) If a draft of a statutory instrument containing regulations under section 49(5)
30would, apart from this subsection, be treated for the purposes of the standing
orders of either House of Parliament as a hybrid instrument, it is to proceed in
that House as if it were not such an instrument.

56 Interpretation of this Chapter

(1) In this Chapter—

  • 35“the appropriate national authority” means the relevant Minister, subject
    to subsections (2) to (4);

  • “enactment” includes—

    (a)

    an enactment contained in, or in an instrument made under, an
    Act of the Scottish Parliament;

    (b)

    40an enactment contained in, or in an instrument made under, a
    Measure or Act of the National Assembly for Wales;

    (c)

    an enactment contained in, or in an instrument made under,
    Northern Ireland legislation;

    (d)

    an enactment contained in subordinate legislation within the
    45meaning of the Interpretation Act 1978;

  • “functions” means functions of a public nature;

  • Digital Economy BillPage 56

  • “Northern Ireland body” means—

    (a)

    a Minister within the meaning of the Northern Ireland Act 1998,

    (b)

    a Northern Ireland department,

    (c)

    a Northern Ireland public authority within the meaning of the
    5Statistics and Registration Service Act 2007, or

    (d)

    a person providing services to a person within paragraph (a),
    (b) or (c);

  • “personal information” has the meaning given by section 50(5);

  • “public authority” has the meaning given by section 49(11);

  • 10“relevant Minister” means the Secretary of State or the Minister for the
    Cabinet Office;

  • “the Revenue and Customs” has the meaning given by section 17(3) of the
    Commissioners for Revenue and Customs Act 2005;

  • “Scottish body” means—

    (a)

    15a person who is a part of the Scottish Administration,

    (b)

    a Scottish public authority with mixed functions or no reserved
    functions (within the meaning of the Scotland Act 1998), or

    (c)

    a person providing services to a person within paragraph (a) or
    (b);

  • 20“specified person” has the meaning given by section 49(5);

  • “Welsh body” means—

    (a)

    a person who wholly or mainly exercises functions which could
    be conferred on the person by provision which falls within the
    legislative competence of the National Assembly for Wales, or

    (b)

    25a person providing services to a person within paragraph (a).

(2) The Scottish Ministers are the appropriate national authority in relation to
regulations under section 49(5) which specify a person who is, or a description
of persons each of whom is, a Scottish body.

(3) The Welsh Ministers are the appropriate national authority in relation to
30regulations under section 49(5) which specify a person who is, or a description
of persons each of whom is, a Welsh body.

(4) The Department of Finance in Northern Ireland is the appropriate national
authority in relation to regulations under section 49(5) which specify a person
who is, or a description of persons each of whom is, a Northern Ireland body.

35CHAPTER 5 Sharing for research purposes

57 Disclosure of information for research purposes

(1) Information held by a public authority in connection with the authority’s
functions may be disclosed to another person for the purposes of research
40which is being or is to be carried out.

(2) If the information is personal information it may not be disclosed under
subsection (1) unless the following conditions are met.

(3) The first condition is that, if the information identifies a particular person, it is
processed before it is disclosed so that—

Digital Economy BillPage 57

(a) the person’s identity is not specified in the information, and

(b) it is not reasonably likely that the person’s identity will be deduced
from the information (whether by itself or taken together with other
information).

(4) 5For the purposes of the first condition the information may be processed by—

(a) the public authority,

(b) a person other than the public authority, or

(c) both the public authority and a person other than the public authority,

(subject to the following provisions of this Part).

(5) 10Personal information may be disclosed for the purpose of processing it for
disclosure under subsection (1)—

(a) by a public authority to a person involved in processing the
information for that purpose;

(b) by one such person to another such person.

(6) 15The second condition is that each person who is involved in processing the
information for disclosure takes reasonable steps to—

(a) minimise the risk of the accidental disclosure of information which
identifies a particular person, and

(b) prevent the deliberate disclosure of such information (otherwise than
20in accordance with this Chapter).

(7) The third condition is that the disclosure is made by the public authority or by
a person, other than the public authority, who is involved in processing the
information for disclosure under subsection (1).

(8) The fourth condition is that the research for the purposes of which the
25information is disclosed is accredited under section 62.

(9) The fifth condition is that the following are accredited under section 62—

(a) the public authority, if the public authority is involved in processing
the information for disclosure under subsection (1);

(b) any person, other than the public authority, who is involved in
30processing the information for disclosure under subsection (1);

(c) any person to whom information is disclosed under subsection (1);

(d) any person by whom such information is used for research purposes.

(10) The sixth condition is that each person who discloses the information or is
involved in processing it for disclosure under subsection (1) has regard to the
35code of practice under section 61 in doing so.

(11) For the purposes of this Chapter information is “personal information” if—

(a) it relates to a particular person (including a body corporate), but

(b) it is not information about the internal administrative arrangements of
a public authority.

(12) 40For the purposes of this Chapter information identifies a particular person if
the identity of that person—

(a) is specified in the information,

(b) can be deduced from the information, or

(c) can be deduced from the information taken together with any other
45information.

Digital Economy BillPage 58

(13) This section is subject to section 58.

58 Provisions supplementary to section 57

(1) A disclosure under section 57 does not breach—

(a) any obligation of confidence owed by the person making the
5disclosure, or

(b) any other restriction on the disclosure of information (however
imposed).

(2) But nothing in section 57 authorises information to be disclosed if to do so
would—

(a) 10contravene the Data Protection Act 1998, or

(b) be prohibited by Part 1 of the Regulation of Investigatory Powers Act
2000.

(3) In its application to a public authority with functions relating to the provision
of health services or adult social care, section 57 does not authorise the
15disclosure of information held by the authority in connection with such
functions.

(4) Section 57 does not limit the circumstances in which information may be
disclosed apart from that section.

(5) A person within subsection (6) may charge a person who requests information
20to be disclosed under section 57(1) a fee for work done in response to the
request.

(6) The persons mentioned in subsection (5) are—

(a) the public authority to whom the request is made, and

(b) a person who is involved in processing the information for disclosure.

(7) 25A fee charged under subsection (5) by a public authority (including a person
within subsection (6)(b) who is a public authority) must not exceed the cost to
the person of doing the work for which the fee is charged.

59 Bar on further disclosure of personal information

(1) This section applies to personal information which—

(a) 30identifies a particular person, and

(b) is received by a person (“P”) under section 57(5) (disclosure for
processing).

(2) Personal information to which this section applies may not be disclosed—

(a) by P, or

(b) 35by any other person who has received it directly or indirectly from P.

(3) Subsection (2) does not apply to a disclosure—

(a) which is required or permitted by any enactment (including section
57(5)),

(b) which is required by an EU obligation,

(c) 40which is made in pursuance of an order of the court,

(d) of information which has already lawfully been made available to the
public,

Digital Economy BillPage 59

(e) which is made for the prevention or detection of crime or the
prevention of anti-social behaviour,

(f) which is made for the purposes of a criminal investigation,

(g) which is made for the purposes of legal proceedings (whether civil or
5criminal), or

(h) which is made with the consent of the person to whom it relates.

(4) In subsection (3)(a) “enactment” includes—

(a) an enactment contained in, or in an instrument made under, an Act of
the Scottish Parliament;

(b) 10an enactment contained in, or in an instrument made under, a Measure
or Act of the National Assembly for Wales;

(c) an enactment contained in, or in an instrument made under, Northern
Ireland legislation;

(d) an enactment contained in subordinate legislation within the meaning
15of the Interpretation Act 1978.

(5) In subsection (3)(e) “anti-social behaviour” has the same meaning as in Part 1
of the Anti-social Behaviour, Crime and Policing Act 2014 (see section 2 of that
Act).

(6) A person commits an offence if—

(a) 20the person discloses personal information in contravention of
subsection (2), and

(b) at the time that the person makes the disclosure, the person knows that
the disclosure contravenes that subsection or is reckless as to whether
the disclosure does so.

(7) 25A person who is guilty of an offence under subsection (6) is liable on conviction
on indictment to imprisonment for a term not exceeding two years, to a fine or
to both.

(8) A person who is guilty of an offence under subsection (6) is liable on summary
conviction—

(a) 30in England and Wales, to imprisonment for a term not exceeding 12
months, to a fine or to both;

(b) in Scotland, to imprisonment for a term not exceeding 12 months, to a
fine not exceeding the statutory maximum or to both;

(c) in Northern Ireland, to imprisonment for a term not exceeding 6
35months, to a fine not exceeding the statutory maximum or to both.

(9) In the application of subsection (8)(a) to an offence committed before the
coming into force of section 154(1) of the Criminal Justice Act 2003 the
reference to 12 months is to be read as a reference to 6 months.

(10) This section does not apply to personal information disclosed under section
4057(5) by the Revenue and Customs.

60 Information disclosed by the Revenue and Customs

(1) This section applies to personal information which—

(a) identifies a particular person, and

(b) is disclosed by the Revenue and Customs under section 57(5)
45(disclosure for processing) and received by a person (“P”).