Digital Economy Bill (HL Bill 122)

(4) For the purposes of the first condition the information may be processed by—

(a) the public authority,

(b) a person other than the public authority, or

(c) both the public authority and a person other than the public authority,

5(subject to the following provisions of this Chapter).

(5) Personal information may be disclosed for the purpose of processing it for
disclosure under subsection (1)—

(a) by a public authority to a person involved in processing the
information for that purpose;

(b) 10subject to sections 70(5), 71(5) and 72(5) (information disclosed by tax
authorities), by one such person to another such person.

(6) The second condition is that each person who is involved in processing the
information for disclosure takes reasonable steps to—

(a) minimise the risk of the accidental disclosure of information which
15identifies a particular person, and

(b) prevent the deliberate disclosure of such information (otherwise than
in accordance with this Chapter).

(7) The third condition is that the disclosure is made by the public authority or by
a person, other than the public authority, who is involved in processing the
20information for disclosure under subsection (1).

(8) The fourth condition is that the research for the purposes of which the
information is disclosed is accredited under section 74.

(9) The fifth condition is that the following are accredited under section 74—

(a) any person (including the public authority) who is involved in
25processing the information for disclosure under subsection (1);

(b) any person to whom information is disclosed under subsection (1);

(c) any person by whom such information is used for research purposes.

(10) The sixth condition is that each person who discloses the information or is
involved in processing it for disclosure under subsection (1) has regard to the
30code of practice under section 73 in doing so.

(11) For the purposes of this Chapter information is “personal information” if—

(a) it relates to a particular person (including a body corporate), but

(b) it is not information about the internal administrative arrangements of
a public authority.

(12) 35For the purposes of this Chapter information identifies a particular person if
the identity of that person—

(a) is specified in the information,

(b) can be deduced from the information, or

(c) can be deduced from the information taken together with any other
40information.

(13) This section is subject to section 68.

68 Provisions supplementary to section 67

(1) A disclosure under section 67 does not breach—

(a) any obligation of confidence owed by the person making the
disclosure, or

(b) any other restriction on the disclosure of information (however
imposed).

(2) 5But nothing in section 67 authorises information to be disclosed if to do so
would—

(a) contravene the Data Protection Act 1998, or

(b) be prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the
Investigatory Powers Act 2016.

(3) 10Until the repeal of Part 1 of the Regulation of Investigatory Powers Act 2000 by
paragraphs 45 and 54 of Schedule 10 to the Investigatory Powers Act 2016 is
fully in force, subsection (2)(b) has effect as if it included a reference to that
Part.

(4) In its application to a public authority with functions relating to the provision
15of health services or adult social care, section 67 does not authorise the
disclosure of information held by the authority in connection with such
functions.

(5) Section 67 does not limit the circumstances in which information may be
disclosed apart from that section.

(6) 20A person within subsection (7) may charge a person who requests information
to be disclosed under section 67(1) a fee for work done in response to the
request.

(7) The persons mentioned in subsection (6) are—

(a) the public authority to whom the request is made, and

(b) 25a person who is involved in processing the information for disclosure.

(8) A fee charged under subsection (6) by a public authority (including a person
within subsection (7)(b) who is a public authority) must not exceed the cost to
the person of doing the work for which the fee is charged.

69 Bar on further disclosure of personal information

(1) 30Subsection (2) applies to personal information—

(a) in which the identity of a particular person is specified or from which
the identity of a particular person can be deduced, whether from the
information itself or from that information taken together with any
other published information, and

(b) 35which is received by a person (“P”) under section 67(1) (disclosure for
research purposes).

(2) Personal information to which this subsection applies may not be disclosed—

(a) by P, or

(b) by any other person who has received it directly or indirectly from P.

(3) 40Subsection (2) does not apply to a disclosure—

(a) to a person by whom the research referred to in section 67(1) is being or
is to be carried out, or

(b) for the purposes of enabling anything that is to be published as a result
of the research to be reviewed before publication, where the disclosure

is made to a person who is accredited under section 74 as a person to
whom such information may be disclosed for that purpose.

(4) Subsection (5) applies to personal information which—

(a) identifies a particular person, and

(b) 5is received by a person (“P”) under section 67(5) (disclosure for
processing).

(5) Personal information to which this subsection applies may not be disclosed—

(a) by P, or

(b) by any other person who has received it directly or indirectly from P.

(6) 10Subsection (5) does not apply to a disclosure—

(a) under section 67(1) or (5), or

(b) of information previously disclosed under section 67(1), where the
disclosure is made by—

(i) the person to whom the information was disclosed under that
15provision, or

(ii) any person who has received the information directly or
indirectly from the person mentioned in sub-paragraph (i),

(but subsection (2) may apply to such a disclosure).

(7) Subsection (2) or (5) does not apply to a disclosure—

(a) 20which is required or permitted by any enactment,

(b) which is required by an EU obligation,

(c) which is made in pursuance of an order of the court,

(d) of information which has already lawfully been made available to the
public,

(e) 25which is made for the prevention or detection of crime or the
prevention of anti-social behaviour,

(f) which is made for the purposes of a criminal investigation,

(g) which is made for the purposes of legal proceedings (whether civil or
criminal),

(h) 30which is a protected disclosure for any of the purposes of the
Employment Rights Act 1996 or the Employment Rights (Northern
Ireland) Order 1996 (SI 1996/1919 (NI 16)),

(i) consisting of the publication of information for the purposes of
journalism, where the publication of the information is in the public
35interest, or

(j) which is made with the consent of the person to whom it relates.

(8) In subsection (7)(a) “enactment” includes—

(a) an enactment contained in, or in an instrument made under, an Act of
the Scottish Parliament;

(b) 40an enactment contained in, or in an instrument made under, a Measure
or Act of the National Assembly for Wales;

(c) an enactment contained in, or in an instrument made under, Northern
Ireland legislation;

(d) an enactment contained in subordinate legislation within the meaning
45of the Interpretation Act 1978.

(9) In subsection (7)(e) “anti-social behaviour” means conduct that—

(a) is likely to cause harassment, alarm or distress to any person, or

(b) is capable of causing nuisance or annoyance to a person in relation to
that person’s occupation of residential premises.

(10) A person commits an offence if—

(a) the person discloses personal information in contravention of
5subsection (2) or (5), and

(b) at the time that the person makes the disclosure, the person knows that
the disclosure contravenes that subsection or is reckless as to whether
the disclosure does so.

(11) A person who is guilty of an offence under subsection (10) is liable on
10conviction on indictment to imprisonment for a term not exceeding two years,
to a fine or to both.

(12) A person who is guilty of an offence under subsection (10) is liable on summary
conviction—

(a) in England and Wales, to imprisonment for a term not exceeding 12
15months, to a fine or to both;

(b) in Scotland, to imprisonment for a term not exceeding 12 months, to a
fine not exceeding the statutory maximum or to both;

(c) in Northern Ireland, to imprisonment for a term not exceeding 6
months, to a fine not exceeding the statutory maximum or to both.

(13) 20In the application of subsection (12)(a) to an offence committed before the
coming into force of section 154(1) of the Criminal Justice Act 2003 the
reference to 12 months is to be read as a reference to 6 months.

(14) This section does not apply to personal information disclosed under section
67(1) or (5) by the Revenue and Customs, the Welsh Revenue Authority or
25Revenue Scotland.

70 Information disclosed by the Revenue and Customs

(1) Subsection (2) applies to personal information—

(a) in which the identity of a particular person is specified or from which
the identity of a particular person can be deduced, whether from the
30information itself or from that information taken together with any
other published information, and

(b) which—

(i) is disclosed under section 67(1) (disclosure for research
purposes) by the Revenue and Customs, or

(ii) 35is disclosed under section 67(1) by a person other than the
Revenue and Customs and is derived from information
disclosed under section 67(5) by the Revenue and Customs,

and is received by a person (“P”) under section 67(1).

(2) Personal information to which this subsection applies may not be disclosed—

(a) 40by P, or

(b) by a person to whom the information is disclosed by virtue of
subsection (3).

(3) Subsection (2) does not apply to a disclosure—

(a) to a person by whom the research referred to in section 67(1) is being or
45is to be carried out, or

(b) for the purposes of enabling anything that is to be published as a result
of the research to be reviewed before publication, where the disclosure
is made to a person who is accredited under section 74 as a person to
whom such information may be disclosed for that purpose.

(4) 5Subsection (5) applies to personal information which—

(a) identifies a particular person, and

(b) is disclosed by the Revenue and Customs under section 67(5)
(disclosure for processing) and received by a person (“P”).

(5) Personal information to which this subsection applies may not be disclosed—

(a) 10by P, or

(b) by any other person who has received it under section 67(5).

(6) Subsection (5) does not apply to a disclosure under section 67(1).

(7) Subsection (2) or (5) does not apply to a disclosure which is made with the
consent of the Commissioners for Her Majesty’s Revenue and Customs (which
15may be general or specific).

(8) A person who contravenes subsection (2) or (5) is guilty of an offence.

(9) It is a defence for a person charged with an offence under subsection (8) to
prove that the person reasonably believed—

(a) that the disclosure was lawful, or

(b) 20that the information had already and lawfully been made available to
the public.

(10) Subsections (4) to (7) of section 19 of the Commissioners for Revenue and
Customs Act 2005 apply to an offence under subsection (8) as they apply to an
offence under that section.

71 25Information disclosed by the Welsh Revenue Authority

(1) Subsection (2) applies to personal information—

(a) in which the identity of a particular person is specified or from which
the identity of a particular person can be deduced, whether from the
information itself or from that information taken together with any
30other published information, and

(b) which—

(i) is disclosed under section 67(1) (disclosure for research
purposes) by the Welsh Revenue Authority, or

(ii) is disclosed under section 67(1) by a person other than the
35Welsh Revenue Authority and is derived from information
disclosed under section 67(5) by the Welsh Revenue Authority,

and is received by a person (“P”) under section 67(1).

(2) Personal information to which this subsection applies may not be disclosed—

(a) by P, or

(b) 40by a person to whom the information is disclosed by virtue of
subsection (3).

(3) Subsection (2) does not apply to a disclosure—

(a) to a person by whom the research referred to in section 67(1) is being or
is to be carried out, or

(b) for the purposes of enabling anything that is to be published as a result
of the research to be reviewed before publication, where the disclosure
is made to a person who is accredited under section 74 as a person to
whom such information may be disclosed for that purpose.

(4) 5Subsection (5) applies to personal information which—

(a) identifies a particular person, and

(b) is disclosed by the Welsh Revenue Authority under section 67(5)
(disclosure for processing) and received by a person (“P”).

(5) Personal information to which this subsection applies may not be disclosed—

(a) 10by P, or

(b) by any other person who has received it under section 67(5).

(6) Subsection (5) does not apply to a disclosure under section 67(1).

(7) Subsection (2) or (5) does not apply to a disclosure which is made with the
consent of the Welsh Revenue Authority (which may be general or specific).

(8) 15A person who contravenes subsection (2) or (5) is guilty of an offence.

(9) It is a defence for a person charged with an offence under subsection (8) to
prove that the person reasonably believed—

(a) that the disclosure was lawful, or

(b) that the information had already and lawfully been made available to
20the public.

(10) A person who is guilty of an offence under subsection (8) is liable—

(a) on summary conviction, to imprisonment for a term not exceeding 12
months, to a fine, or to both;

(b) on conviction on indictment to imprisonment for a term not exceeding
25two years, to a fine or to both.

(11) In the application of subsection (10)(a) to an offence committed before the
coming into force of section 154(1) of the Criminal Justice Act 2003 the
reference to 12 months is to be read as a reference to 6 months.

72 Information disclosed by Revenue Scotland

(1) 30Subsection (2) applies to personal information—

(a) in which the identity of a particular person is specified or from which
the identity of a particular person can be deduced, whether from the
information itself or from that information taken together with any
other published information, and

(b) 35which—

(i) is disclosed under section 67(1) (disclosure for research
purposes) by Revenue Scotland, or

(ii) is disclosed under section 67(1) by a person other than Revenue
Scotland and is derived from information disclosed under
40section 67(5) by Revenue Scotland,

and is received by a person (“P”) under section 67(1).

(2) Personal information to which this subsection applies may not be disclosed—

(a) by P, or

(b) by a person to whom the information is disclosed by virtue of
subsection (3).

(3) Subsection (2) does not apply to a disclosure—

(a) to a person by whom the research referred to in section 67(1) is being or
5is to be carried out, or

(b) for the purposes of enabling anything that is to be published as a result
of the research to be reviewed before publication, where the disclosure
is made to a person who is accredited under section 74 as a person to
whom such information may be disclosed for that purpose.

(4) 10Subsection (5) applies to personal information which—

(a) identifies a particular person, and

(b) is disclosed by Revenue Scotland under section 67(5) (disclosure for
processing) and received by a person (“P”).

(5) Personal information to which this subsection applies may not be disclosed—

(a) 15by P, or

(b) by any other person who has received it under section 67(5).

(6) Subsection (5) does not apply to a disclosure under section 67(1).

(7) Subsection (2) or (5) does not apply to a disclosure which is made with the
consent of Revenue Scotland (which may be general or specific).

(8) 20A person who contravenes subsection (2) or (5) is guilty of an offence.

(9) It is a defence for a person charged with an offence under subsection (8) to
prove that the person reasonably believed—

(a) that the disclosure was lawful, or

(b) that the information had already and lawfully been made available to
25the public.

(10) A person who is guilty of an offence under subsection (8) is liable—

(a) on summary conviction, to imprisonment for a term not exceeding 12
months, to a fine not exceeding the statutory maximum or to both;

(b) on conviction on indictment to imprisonment for a term not exceeding
30two years, to a fine or to both.

73 Code of practice

(1) The Statistics Board must issue a code of practice about—

(a) the disclosure of personal information under section 67,

(b) the processing of information under that section, and

(c) 35the holding or use of personal information disclosed under that section.

(2) The code of practice must be consistent with the code of practice issued under
section 52B (data-sharing code) of the Data Protection Act 1998 (as altered or
replaced from time to time).

(3) A public authority must have regard to the code of practice in disclosing
40personal information or participating in the processing of information under
section 67.

(4) A person who is accredited under section 74(1)(a) must have regard to the code
of practice in participating in the processing of information for disclosure
under section 67(1).

(5) A person who is accredited under section 74(1)(b), (c) or (d) must have regard
5to the code of practice in holding or using personal information disclosed
under section 67.

(6) The Statistics Board may from time to time revise and re-issue the code of
practice.

(7) Before issuing or reissuing the code of practice the Statistics Board must
10consult—

(a) the Minister for the Cabinet Office,

(b) the Information Commissioner,

(c) the Commissioners for Her Majesty’s Revenue and Customs,

(d) the Scottish Ministers,

(e) 15the Welsh Ministers,

(f) the Department of Finance in Northern Ireland, and

(g) such other persons as the Statistics Board thinks appropriate.

(8) The fact that this section was not in force when consultation of the kind
mentioned in subsection (7) took place is to be disregarded in determining
20whether there has been compliance with that subsection.

(9) The Statistics Board may not issue the code of practice unless a draft of the code
has been laid before, and approved by a resolution of, each House of
Parliament.

(10) Before reissuing the code the Statistics Board must lay a draft of the code as
25proposed to be reissued before Parliament.

(11) The Statistics Board may not reissue the code if, within the 40-day period,
either House of Parliament resolves not to approve it.

(12) In subsection (11) “the 40 day period” means—

(a) the period of 40 days beginning with the day on which the draft is laid
30before Parliament, or

(b) if the draft is not laid before each House on the same day, the period of
40 days beginning with the later of the days on which it is laid before
Parliament.

(13) For the purposes of subsection (12) no account is to be taken of any period
35during which Parliament is dissolved or prorogued or during which both
Houses are adjourned for more than four days.

(14) As soon as is reasonably practicable after issuing or reissuing the code of
practice the Statistics Board must lay a copy of it before—

(a) the Scottish Parliament,

(b) 40the National Assembly for Wales, and

(c) the Northern Ireland Assembly.

(15) In disclosing information under section 67, a person must have regard to the
following codes of practice issued by the Information Commissioner under
section 51(3) of the Data Protection Act 1998, so far as they apply to the
45information in question—

(a) any code which makes provision about the identification and reduction
of the risks to privacy of a proposal to disclose information;

(b) any code which makes provision about the information to be provided
to data subjects (within the meaning of that Act) about the use to be
5made of information collected from them.

(16) The duty in subsection (15) does not affect any other requirement for the
person to have regard to a code of practice in disclosing the information.

74 Accreditation for the purposes of this Chapter

(1) The Statistics Board—

(a) 10may accredit a person as a person who may be involved in the
processing of information for disclosure under subsection (1) of section
67,

(b) may accredit a person as a person to whom information may be
disclosed under that subsection,

(c) 15may accredit a person as a person by whom information disclosed
under that subsection may be used for research purposes,

(d) may accredit a person as a person to whom such information may be
disclosed for the purposes of a review of the kind mentioned in section
69(3)(b), 70(3)(b), 71(3)(b) or 72(3)(b),

(e) 20may accredit research for the purposes of section 67, and

(f) may withdraw accreditation given under any of paragraphs (a) to (e).

(2) The Statistics Board—

(a) must establish and publish conditions to be met by a person for
accreditation under subsection (1)(a), (b), (c) or (d),

(b) 25must establish and publish conditions to be met by research for
accreditation under subsection (1)(e), and

(c) must establish and publish grounds for the withdrawal of accreditation
under subsection (1)(f).

(3) The conditions established and published under subsection (2)(a) must, in the
30case of a person seeking accreditation to be involved in the processing of
information for disclosure under section 67(1), include a condition that the
person is a fit and proper person to be involved in such processing.

(4) The conditions established and published under subsection (2)(b) must include
a condition that the research is in the public interest.

(5) 35The grounds established and published under subsection (2)(c) must, in the
case of a person accredited under this section, include the ground that the
person has failed to have regard to the code of practice under section 73.

(6) Before publishing conditions under subsection (2)(a) or (b) or grounds under
subsection (2)(c), the Statistics Board must consult—

(a) 40the Minister for the Cabinet Office,

(b) the Information Commissioner,

(c) the Commissioners for Her Majesty’s Revenue and Customs,

(d) the Scottish Ministers,

(e) the Welsh Ministers,

(f) 45the Department of Finance in Northern Ireland, and

(g) such other persons as the Statistics Board thinks appropriate.

(7) The Statistics Board—

(a) may from time to time revise conditions or grounds published under
this section, and

(b) if it does so, must publish the conditions or grounds as revised.

(8) 5Subsection (6) applies in relation to the publication of conditions or grounds
under subsection (7) as it applies in relation to the publication of conditions or
grounds under subsection (2).

(9) The Statistics Board must maintain and publish—

(a) a register of persons who are accredited under subsection (1)(a),

(b) 10a register of persons who are accredited under subsection (1)(b),

(c) a register of persons who are accredited under subsection (1)(c), and

(d) a register of persons who are accredited under subsection (1)(d).

(10) A register under any of the paragraphs of subsection (9) may be combined with
a register under any of the other paragraph of that subsection.

(11) 15Anything required by this section to be published must be published in such
manner as the Statistics Board thinks appropriate for bringing it to the
attention of persons likely to be affected by it.

75 Delegation of functions of Statistics Board

(1) The Statistics Board may delegate any of its functions under section 74 to
20another person if the Board thinks that the person—

(a) is a fit and proper person to exercise the function in question, and

(b) has expertise in statistical research and analysis.

(2) Subsection (1) does not affect the operation of section 36 of the Statistics and
Registration Service Act 2007 (delegation of Board’s functions).

76 25Interpretation of this Chapter

(1) In this Chapter—

• “personal information” has the meaning given by section 67(11);

• “public authority” means a person with functions of a public nature,
  subject to subsection (2);

• 30“the Revenue and Customs” has the meaning given by section 17(3) of the
  Commissioners for Revenue and Customs Act 2005.

(2) A person is not a public authority for the purposes of this Chapter if the
person—

(a) only has functions relating to the provision of health services,

(b) 35only has functions relating to the provision of adult social care, or

(c) only has functions within paragraph (a) and paragraph (b).

(3) The following are to be disregarded in determining whether subsection (2)
applies to a person—

(a) any power (however expressed) to do things which are incidental to the
40carrying out of another function of that person;

(b) any function which the person exercises or may exercise on behalf of
another person.

(4) In this Chapter “health services” means—