13.—(1) This regulation applies to a person in Scotland (“P”) who holds relevant information, including where P holds that information as a result of disclosure made in accordance with paragraph (4).
(2) For the purposes of this regulation, “relevant information” is—
(a)information provided in accordance with regulation 3, or
(b)passenger information from elsewhere in the UK.
(3) P may only use the relevant information where it is necessary for the purpose of—
(a)carrying out a function under these Regulations,
(b)preventing danger to public health as a result of the spread of infection or contamination with coronavirus,
(c)monitoring the spread of infection or contamination with coronavirus or the incidence of coronavirus disease,
(d)giving effect to any international agreement or arrangement relating to the spread of infection or contamination with coronavirus or the incidence of coronavirus disease, or
(e)for a purpose connected with, or otherwise incidental to a purpose described in sub-paragraph (a) to (d).
(4) Subject to paragraph (6), P may only disclose relevant information to another person (the “recipient”) where it is necessary for the recipient to have the information—
(a)for the purpose of carrying out a function of the recipient under—
(i)these Regulations, or
(ii)regulations made as respects England, Wales or Northern Ireland (as the case may be) that is equivalent to provision made under these Regulations,
(b)for the purpose of—
(i)preventing danger to public health as a result of the spread of infection or contamination with coronavirus,
(ii)monitoring the spread of infection or contamination with coronavirus or the incidence of coronavirus disease,
(iii)giving effect to any international agreement or arrangement relating to the spread of infection or contamination with coronavirus or the incidence of coronavirus disease, or
(c)a purpose connected with, or otherwise incidental to, a purpose described in paragraph (a) or (b).
(5) Subject to paragraph (7), disclosure which is authorised by this regulation does not breach an obligation of confidence owed by the person making the disclosure.
(6) Despite paragraphs (3), (4) and (5), this regulation does not limit the circumstances in which information may otherwise lawfully be disclosed under any other enactment or rule of law.
(7) Nothing in this regulation authorises the use or disclosure of personal data where doing so contravenes the data protection legislation.
(8) For the purposes of this regulation—
(a)“data protection legislation” and “personal data” have the same meanings as in section 3 of the Data Protection Act 2018 M1, and
(b)“passenger information from elsewhere in the UK” means information provided to a person in accordance with provision in regulations made as respects England, Wales or Northern Ireland (as the case may be) that is equivalent to provision made under these Regulations.