Statistics and Registration Service Act 2007

Information sharing U.K.

42 Information relating to births and deaths etc U.K.

(1) The Registrar General for England and Wales may, for the purpose of the exercise by the Board of any function, disclose to the Board any information to which this section applies.

(2) This section applies to—

(a) any information entered in any register kept under the Births and Deaths Registration Act 1953 (c. 20);

(b) any other information received by the Registrar General in relation to any birth or death;

(c) any information entered in the Adopted Children Register maintained by the Registrar General under section 77 of the Adoption and Children Act 2002 (c. 38);

(d) any information entered in any marriage register book kept under Part 4 of the Marriage Act 1949 (c. 76);

(e) any information relating to a civil partnership which is recorded under the Civil Partnership Act 2004 (c. 33) at the time of the formation of the civil partnership.

[F1 (ea) any information recorded under section 9 of the Marriage (Same Sex Couples) Act 2013 and regulations made under that section on the conversion of a civil partnership into a marriage;]

[F2 (f) any other information received by the Registrar General in relation to any marriage or civil partnership.]

(3) In subsection (2)(b) “birth” has the same meaning as in the Births and Deaths Registration Act 1953.

[F3 (4) The Board may disclose to a person mentioned in subsection (4A) any information referred to in subsection (2)(a) to (c) which is received by the Board under this section, or any information which is produced by the Board by analysing any such information, if—

(a) the information consists of statistics and is disclosed for the purpose of assisting the person in the performance of functions exercisable by it in relation to the health service, or

(b) the information is disclosed for the purpose of assisting the person to produce or to analyse statistics for the purpose of assisting the person, or any other person mentioned in subsection (4A), in the performance of functions exercisable by it in relation to the health service.

(4A) Those persons are—

(a) the Secretary of State,

(b) the Welsh Ministers,

(c) the National Health Service Commissioning Board,

(d) a clinical commissioning group,

(e) a local authority,

(f) a Local Health Board,

(g) an NHS trust established under section 18 of the National Health Service (Wales) Act 2006,

(h) the National Institute for Health and Care Excellence,

(i) the Health and Social Care Information Centre,

(j) a Special Health Authority,

(k) the Care Quality Commission, and

(l) such other persons as the appropriate authority may specify in a direction given for the purposes of this section.

(4B) For the purposes of subsection (4A)(l), the appropriate authority is—

(a) in relation to a direction to be given for purposes relating only to Wales, the Welsh Ministers, and

(b) in any other case, the Secretary of State.]

(5) Any information disclosed under subsection (4) may be disclosed in such form as the Board considers appropriate for the purpose specified in that subsection.

[F4 (5A) A direction under subsection (4A)(l) must be given by an instrument in writing.

(5B) Sections 272(7) and 273(1) of the National Health Service Act 2006 apply in relation to the power of the Secretary of State to give a direction under subsection (4A)(l) as they apply in relation to powers to give a direction under that Act.

(5C) Sections 203(9) and 204(1) of the National Health Service (Wales) Act 2006 apply in relation to the power of the Welsh Ministers to give a direction under subsection (4A)(l) as they apply in relation to powers to give a direction under that Act.]

(6) In subsection (4) “health service” has the same meaning as in the National Health Service Act 2006 (c. 41).

[F5 (7) In subsection (4A)—

• “ clinical commissioning group ” and “ Special Health Authority ” have the same meaning as in the National Health Service Act 2006;

• “ local authority ” has the same meaning as in section 2B of that Act of 2006. ]

Textual Amendments

F1 S. 42(2)(ea) inserted (E.W.) (10.12.2014) by The Marriage (Same Sex Couples) Act 2013 (Consequential and Contrary Provisions and Scotland) and Marriage and Civil Partnership (Scotland) Act 2014 (Consequential Provisions) Order 2014 (S.I. 2014/3168), art. 1(2)(3), Sch. para. 13

F2 S. 42(2)(f) inserted (E.W.) (13.3.2014) by The Marriage (Same Sex Couples) Act 2013 (Consequential and Contrary Provisions and Scotland) Order 2014 (S.I. 2014/560), art. 1(2), Sch. 1 para. 33

F3 S. 42(4)-(4B) substituted for s. 42(4) (27.3.2012 for specified purposes, 1.4.2013 in so far as not already in force) by Health and Social Care Act 2012 (c. 7), ss. 287(2), 306(1)(d), 306(4); S.I. 2013/160, art. 2(2) (with arts. 7-9)

F4 S. 42(5A)-(5C) inserted (27.3.2012 for specified purposes, 1.4.2013 in so far as not already in force) by Health and Social Care Act 2012 (c. 7), ss. 287(3), 306(1)(d), 306(4); S.I. 2013/160, art. 2(2) (with arts. 7-9)

F5 S. 42(7) inserted (27.3.2012 for specified purposes, 1.4.2013 in so far as not already in force) by Health and Social Care Act 2012 (c. 7), ss. 287(4), 306(1)(d), 306(4); S.I. 2013/160, art. 2(2) (with arts. 7-9)

Commencement Information

I1 S. 42 in force at 1.4.2008 by S.I. 2008/839, art. 2

43 Information relating to NHS registration U.K.

(1) The Secretary of State or other public authority may, subject to this section, disclose patient registration information to the Board.

(2) In subsection (1) “patient registration information” means information about the persons who are or have been registered in any place in England or Wales as persons to whom primary medical services are or may be provided.

(3) That information includes in particular, in relation to any person who is or has been registered as such a person—

(a) their address and any previous address,

(b) their date of birth and sex,

(c) their patient identification number, and

(d) their history of registration as such a person (including reasons for any periods of non-registration or for any cancellation of registration).

(4) The information disclosed under this section may not include any information about the health or condition of, or the care or treatment provided to, any person.

(5) Information disclosed under this section may only be used by the Board for the production of population statistics.

(6) In the application of section 39 to the disclosure by a member, employee or committee member of the Board of information received by the Board under this section, paragraphs (c) and (i) of subsection (4) of that section only have effect if the disclosure is made with the consent of the Secretary of State.

(7) In subsection (2) “primary medical services” means services which are primary medical services for the purposes of the National Health Service Act 2006 or the National Health Service (Wales) Act 2006 (c. 42).

Commencement Information

I2 S. 43 in force at 1.4.2008 by S.I. 2008/839, art. 2

44 Information relating to NHS registration: Wales U.K.

(1) The Welsh Ministers may, subject to this section, disclose patient registration information to the Board.

(2) In subsection (1) “patient registration information” means information about the persons who are or have been registered in any place in Wales as persons to whom primary medical services are or may be provided.

(3) That information includes in particular, in relation to any person who is or has been registered as such a person—

(a) their address and any previous address,

(b) their date of birth and sex,

(c) their patient identification number, and

(d) their history of registration as such a person (including reasons for any periods of non-registration or for any cancellation of registration).

(4) Information disclosed under this section may not include any information about the health or condition of, or the care or treatment provided to, any person.

(5) Information disclosed under this section may only be used by the Board for the production of population statistics.

(6) In the application of section 39 to the disclosure by a member, employee or committee member of the Board of information received by the Board under this section, paragraphs (c) and (i) of subsection (4) of that section only have effect if the disclosure is made with the consent of the Welsh Ministers.

(7) In subsection (2) “primary medical services” means services which are primary medical services for the purposes of the National Health Service (Wales) Act 2006 (c. 42).

Commencement Information

I3 S. 44 in force at 1.4.2008 by S.I. 2008/839, art. 2

45 Information held by HMRC U.K.

(1) The Commissioners for Her Majesty's Revenue and Customs or an officer of Revenue and Customs may, subject to this section, disclose to the Board any information held by the Revenue and Customs in connection with any function of the Revenue and Customs.

(2) Information may only be disclosed under subsection (1) if the Commissioners are satisfied that the Board requires it to enable it to exercise one or more of its functions F6 ....

[F7 (2A) In determining whether the condition in subsection (2) is met the Commissioners must have regard to any views of the Board which have been communicated to them.]

(3) Information disclosed under subsection (1) may only be used by the Board for the purposes of any one or more of its functions F8 ....

[F9 (3A) Information disclosed under subsection (1) may not be used by the Board for the purposes of its function under section 22 (statistical services) except with the consent of the Commissioners.]

(4) Information disclosed under subsection (1) may not be disclosed by the Board to any person except with the consent of the Commissioners.

[F10 (4A) In disclosing information under subsection (1), the Commissioners or an officer of Revenue and Customs must have regard to the following codes of practice issued by the Information Commissioner under [F11 section 128 of the Data Protection Act 2018], so far as they apply to the information in question—

(a) any code which makes provision about the identification and reduction of the risks to privacy of a proposal to disclose information;

(b) any code which makes provision about the information to be provided to data subjects (within the meaning of that Act) about the use to be made of information collected from them.

(4B) The duty in subsection (4A) to have regard to a code of practice does not affect any other requirement for the Commissioners or an officer of Revenue and Customs to have regard to a code of practice under [F12 the Data Protection Act 2018] in disclosing the information.

(4C) In determining how to comply with the duty in subsection (4A) the Commissioners or the officer of Revenue and Customs must have regard to any views of the Board which are communicated to the Commissioners or the officer.]

F13 (5) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(6) In subsection (1) the references to “the Revenue and Customs” are to either or both of—

(a) the Commissioners;

(b) officers of Revenue and Customs.

Textual Amendments

F6 Words in s. 45(2) omitted (31.7.2017) by virtue of Digital Economy Act 2017 (c. 30), ss. 78(2), 118(4); S.I. 2017/765, reg. 2(t)

F7 S. 45(2A) inserted (31.7.2017) by Digital Economy Act 2017 (c. 30), ss. 78(3), 118(4); S.I. 2017/765, reg. 2(t)

F8 Words in s. 45(3) omitted (31.7.2017) by virtue of Digital Economy Act 2017 (c. 30), ss. 78(4), 118(4); S.I. 2017/765, reg. 2(t)

F9 S. 45(3A) inserted (31.7.2017) by Digital Economy Act 2017 (c. 30), ss. 78(5), 118(4); S.I. 2017/765, reg. 2(t)

F10 S. 45(4A)-(4C) inserted (31.7.2017) by Digital Economy Act 2017 (c. 30), ss. 78(6), 118(4); S.I. 2017/765, reg. 2(t)

F11 Words in s. 45(4A) substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 134(2) (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g)

F12 Words in s. 45(4B) substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 134(3) (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g)

F13 S. 45(5) omitted (31.7.2017) by virtue of Digital Economy Act 2017 (c. 30), ss. 78(7), 118(4); S.I. 2017/765, reg. 2(t)

Commencement Information

I4 S. 45 in force at 1.4.2008 by S.I. 2008/839, art. 2

[F14 45A Information held by other public authorities U.K.

(1) A public authority to which this section applies may, subject to this section, disclose to the Board any information held by the authority in connection with its functions.

(2) This section applies to a public authority other than—

(a) the Commissioners for Her Majesty's Revenue and Customs, or

(b) an officer of Revenue and Customs.

(3) A public authority may disclose information under subsection (1) only if it is satisfied that the Board requires the information to enable it to exercise one or more of its functions.

(4) In determining whether the condition in subsection (3) is met the public authority must have regard to any views of the Board which have been communicated to the authority.

(5) Information disclosed under subsection (1) may only be used by the Board for the purposes of any one or more of its functions.

(6) Information disclosed under subsection (1) may not be used by the Board for the purposes of its function under section 22 (statistical services) except with the consent of the public authority which disclosed the information.

(7) Where personal information is disclosed by a public authority to the Board under subsection (1), the Board may not disclose the information to an approved researcher under section 39(4)(i) except with the consent of the public authority.

(8) In disclosing information under subsection (1), a public authority must have regard to the following codes of practice issued by the Information Commissioner under [F15 section 128 of the Data Protection Act 2018], so far as they apply to the information in question—

(a) any code which makes provision about the identification and reduction of the risks to privacy of a proposal to disclose information;

(b) any code which makes provision about the information to be provided to data subjects (within the meaning of that Act) about the use to be made of information collected from them.

(9) The duty in subsection (8) to have regard to a code of practice does not affect any other requirement for the public authority to have regard to a code of practice under [F16 the data protection legislation] in disclosing the information.

(10) In determining how to comply with the duty in subsection (8) the public authority must have regard to any views of the Board which are communicated to the authority.

(11) A disclosure under subsection (1) does not breach—

(a) any obligation of confidence owed by the public authority making the disclosure, or

(b) any other restriction on the disclosure of information (however imposed).

(12) But subsection (1) does not authorise the making of a disclosure which—

(a) contravenes [F17 the data protection legislation],

(b) is prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016, or

(c) contravenes [F18 retained direct EU legislation] [F19 (which is not part of the data protection legislation)] or [F20 anything that is EU-derived domestic legislation by virtue of section 2(2)(a) or (b) of the European Union (Withdrawal) Act 2018].

(13) Until the repeal of Part 1 of the Regulation of Investigatory Powers Act 2000 by paragraphs 45 and 54 of Schedule 10 to the Investigatory Powers Act 2016 is fully in force, subsection (12)(b) has effect as if it included a reference to that Part.

(14) This section does not limit the circumstances in which information may be disclosed apart from this section.]

Textual Amendments

F14 S. 45A inserted (31.7.2017 for E.W.S., 1.5.2018 in so far as not already in force) by Digital Economy Act 2017 (c. 30), ss. 79(2), 118(4); S.I. 2017/765, reg. 2(u); S.I. 2018/382, reg. 3(kk)

F15 Words in s. 45A(8) substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 135(2) (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g)

F16 Words in s. 45A(9) substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 135(3) (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g)

F17 Words in s. 45A(12)(a) substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 135(4) (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g)

F18 Words in s. 45A(12)(c) substituted (31.1.2020) by The UK Statistics (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/489), regs. 1, 2(4)(a); 2020 c. 1, Sch. 5 para. 1(1)

F19 Words in s. 45A(12)(c) inserted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 135(5) (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g)

F20 Words in s. 45A(12)(c) substituted (31.1.2020) by The UK Statistics (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/489), regs. 1, 2(4)(b); 2020 c. 1, Sch. 5 para. 1(1)

[F21 45B Access to information held by Crown bodies etc U.K.

(1) This section applies to—

(a) a public authority which is an emanation of the Crown or a servant or agent of the Crown,

(b) the Bank of England (including in the exercise of its functions as the Prudential Regulation Authority),

(c) a subsidiary undertaking of the Bank of England within the meaning of the Companies Acts (see sections 1161 and 1162 of the Companies Act 2006),

(d) the Financial Conduct Authority, and

(e) the Payment Systems Regulator established under section 40 of the Financial Services (Banking Reform) Act 2013.

(2) Subject to this section and section 45E, the Board has a right of access to information which—

(a) is held by a public authority to which this section applies in connection with its functions, and

(b) is required by the Board to enable it to exercise one or more of its functions.

(3) Subsection (2) does not apply to information if the disclosure of that information—

(a) would contravene [F22 the data protection legislation],

(b) would be prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016, or

(c) would contravene [F23 retained direct EU legislation] [F24 (which is not part of the data protection legislation)] or [F25 anything that is EU-derived domestic legislation by virtue of section 2(2)(a) or (b) of the European Union (Withdrawal) Act 2018].

(4) Until the repeal of Part 1 of the Regulation of Investigatory Powers Act 2000 by paragraphs 45 and 54 of Schedule 10 to the Investigatory Powers Act 2016 is fully in force, subsection (3)(b) has effect as if it included a reference to that Part.

(5) The right of access in subsection (2) is to be exercised in accordance with the following provisions of this section.

(6) The Board may, by notice in writing to the public authority, request the authority to disclose the information to the Board.

(7) A notice under subsection (6) must—

(a) set out the Board's reasons for requesting the information to be disclosed, and

(b) specify the date by which or the period within which the public authority must respond to the request.

(8) The public authority must, by that date or within that period, provide a response in writing to the Board which—

(a) indicates that it is willing to provide the information and gives the date by which it will be provided, or

(b) indicates that it is not willing to provide the information and gives reasons for not providing it.

(9) Subsection (10) applies if—

(a) the public authority fails to respond to the request in accordance with subsection (8),

(b) the public authority indicates that it is not willing to provide the information requested, or

(c) the public authority has indicated that it is willing to provide the information requested, but the Board considers that the public authority is failing to take reasonable steps to comply with that request.

(10) The Board may lay the request and any response by the public authority before the relevant legislature.

(11) In subsection (10) “the relevant legislature” means Parliament, subject as follows.

(12) The Scottish Parliament is the relevant legislature if the public authority—

(a) is a part of the Scottish Administration, or

(b) is a Scottish public authority with mixed functions or no reserved functions (within the meaning of the Scotland Act 1998).

(13) The National Assembly for Wales is the relevant legislature if the public authority is a devolved Welsh authority as defined by section 157A of the Government of Wales Act 2006.

(14) The Northern Ireland Assembly is the relevant legislature if—

(a) the public authority exercises functions only as regards Northern Ireland, and

(b) its functions are wholly or mainly functions which relate to transferred matters (within the meaning of the Northern Ireland Act 1998).

(15) This section does not apply to—

(a) Her Majesty in Her private capacity,

(b) Her Majesty in right of the Duchy of Lancaster, or

(c) the Duke of Cornwall.

(16) Until the coming into force of section 12 of the Bank of England and Financial Services Act 2016 subsection (1)(b) has effect as if the words in brackets were omitted.

Textual Amendments

F21 Ss. 45B-45G inserted (1.10.2017 for E.W.S. for specified purposes, 1.5.2018 in so far as not already in force) by Digital Economy Act 2017 (c. 30), ss. 80, 118(4); S.I. 2017/765, reg. 3(n); S.I. 2018/382, reg. 3(ll)

F22 Words in s. 45B(3)(a) substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 136(2) (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g)

F23 Words in s. 45B(3)(c) substituted (31.1.2020) by The UK Statistics (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/489), regs. 1, 2(5)(a); 2020 c. 1, Sch. 5 para. 1(1)

F24 Words in s. 45B(3)(c) inserted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 136(3) (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g)

F25 Words in s. 45B(3)(c) substituted (31.1.2020) by The UK Statistics (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/489), regs. 1, 2(5)(b); 2020 c. 1, Sch. 5 para. 1(1)

45C Power to require disclosures by other public authorities U.K.

(1) This section applies to a public authority to which section 45B does not apply (other than one within subsection (15) of that section).

(2) Subject to this section and section 45E, the Board may, by notice in writing to a public authority to which this section applies, require the authority to disclose to the Board information which—

(a) is held by the authority in connection with its functions, and

(b) is specified, or is of a kind specified, in the notice.

(3) A notice under subsection (2) may require information to be disclosed on more than one date specified in the notice within a period specified in the notice.

(4) A notice under subsection (2) other than one within subsection (3) must specify the date by which or the period within which the information must be disclosed.

(5) A notice under subsection (2) may specify the form or manner in which the information to which it relates must be disclosed.

(6) A notice under subsection (2) may require the public authority to consult the Board before making changes to—

(a) its processes for collecting, organising, storing or retrieving the information to which the notice relates, or

(b) its processes for supplying such information to the Board.

(7) The reference in subsection (6) to making changes to a process includes introducing or removing a process.

(8) The Board may give a notice under subsection (2) only if the Board requires the information to which the notice relates to enable it to exercise one or more of its functions.

(9) The Board must obtain the consent of the Scottish Ministers before giving a notice under subsection (2) to a public authority which is a Scottish public authority with mixed functions or no reserved functions (within the meaning of the Scotland Act 1998).

(10) The Board must obtain the consent of the Welsh Ministers before giving a notice under subsection (2) to a public authority which is a devolved Welsh authority as defined by section 157A of the Government of Wales Act 2006.

(11) The Board must obtain the consent of the Department of Finance in Northern Ireland before giving a notice under subsection (2) to a public authority if—

(a) the public authority exercises functions only as regards Northern Ireland, and

(b) its functions are wholly or mainly functions which relate to transferred matters (within the meaning of the Northern Ireland Act 1998).

(12) A public authority to which a notice under subsection (2) is given must comply with it.

(13) But the public authority need not comply with the notice if compliance—

(a) might prejudice national security,

(b) would contravene [F26 the data protection legislation],

(c) would be prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016, or

(d) would contravene [F27 retained direct EU legislation] [F28 (which is not part of the data protection legislation)] or [F29 anything that is EU-derived domestic legislation by virtue of section 2(2)(a) or (b) of the European Union (Withdrawal) Act 2018].

(14) Until the repeal of Part 1 of the Regulation of Investigatory Powers Act 2000 by paragraphs 45 and 54 of Schedule 10 to the Investigatory Powers Act 2016 is fully in force, subsection (13)(c) has effect as if it included a reference to that Part.

Textual Amendments

F21 Ss. 45B-45G inserted (1.10.2017 for E.W.S. for specified purposes, 1.5.2018 in so far as not already in force) by Digital Economy Act 2017 (c. 30), ss. 80, 118(4); S.I. 2017/765, reg. 3(n); S.I. 2018/382, reg. 3(ll)

F26 Words in s. 45C(13)(b) substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 137(2) (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g)

F27 Words in s. 45C(13)(d) substituted (31.1.2020) by The UK Statistics (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/489), regs. 1, 2(6)(a); 2020 c. 1, Sch. 5 para. 1(1)

F28 Words in s. 45C(13)(d) inserted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 137(3) (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g)

F29 Words in s. 45C(13)(d) substituted (31.1.2020) by The UK Statistics (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/489), regs. 1, 2(6)(b); 2020 c. 1, Sch. 5 para. 1(1)

45D Power to require disclosure by undertakings U.K.

(1) Subject to this section and section 45E, the Board may, by notice in writing to an undertaking, require the undertaking to disclose to the Board information which—

(a) is held by the undertaking, and

(b) is specified, or is of a kind specified, in the notice.

(2) A notice under subsection (1) may require information to be disclosed on more than one date specified in the notice within a period specified in the notice.

(3) A notice under subsection (1) other than one within subsection (2) must specify the date by which or the period within which the information must be disclosed.

(4) A notice under subsection (1) may specify the form or manner in which the information to which it relates must be disclosed.

(5) A notice under subsection (1) may require the undertaking to consult the Board before making changes to—

(a) its processes for collecting, organising, storing or retrieving the information to which the notice relates, or

(b) its processes for supplying such information to the Board.

(6) The reference in subsection (5) to making changes to a process includes introducing or removing a process.

(7) The Board may give a notice under subsection (1) only if the Board requires the information to which the notice relates to enable it to exercise one or more of its functions.

(8) An undertaking to which a notice under subsection (1) is given must comply with it.

(9) But the undertaking need not comply with the notice if compliance—

(a) might prejudice national security,

(b) would contravene [F30 the data protection legislation], or

(c) would be prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016.

(10) Until the repeal of Part 1 of the Regulation of Investigatory Powers Act 2000 by paragraphs 45 and 54 of Schedule 10 to the Investigatory Powers Act 2016 is fully in force, subsection (9)(c) has effect as if it included a reference to that Part.

(11) Subject to subsection (13), in this section “undertaking” means—

(a) any person carrying on a trade or business, whether or not with a view to profit, or

(b) any charity.

(12) In subsection (11) “charity” means a body, or the trustees of a trust, established for charitable purposes only.

(13) The following are not undertakings for the purposes of this section—

(a) a public authority;

(b) a micro business;

(c) a small business.

(14) Section 33 of the Small Business, Enterprise and Employment Act 2015 (definitions of small and micro business) and regulations made under that section apply in relation to subsection (13) as they apply in relation to subordinate legislation within subsection (1) of that section.

Textual Amendments

F21 Ss. 45B-45G inserted (1.10.2017 for E.W.S. for specified purposes, 1.5.2018 in so far as not already in force) by Digital Economy Act 2017 (c. 30), ss. 80, 118(4); S.I. 2017/765, reg. 3(n); S.I. 2018/382, reg. 3(ll)

F30 Words in s. 45D(9)(b) substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 138 (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g)

45E Further provisions about powers in sections 45B, 45C and 45D U.K.

(1) Information disclosed under section 45B, 45C or 45D may only be used by the Board for the purposes of any one or more of its functions.

(2) Information disclosed under section 45B, 45C or 45D may not be used by the Board for the purposes of its function under section 22 (statistical services) except with the consent of the person who disclosed the information.

(3) Where personal information is disclosed under section 45B, 45C or 45D, the Board may not disclose the information to an approved researcher under section 39(4)(i) except with the consent of the person who disclosed the information.

(4) A disclosure pursuant to section 45B, 45C or 45D does not breach—

(a) any obligation of confidence owed by the person making the disclosure, or

(b) any other restriction on the disclosure of information (however imposed).

(5) The Board must prepare and publish a statement of—

(a) the principles to which it will have regard in exercising its functions under sections 45B, 45C and 45D, and

(b) the procedures which it will adopt in exercising those functions.

(6) The statement must be consistent with the code of practice [F31 prepared under section 121 of the Data Protection Act 2018 (data-sharing code) and issued under section 125(4) of that Act] (as altered or replaced from time to time).

(7) The Board may at any time revise the statement and, if it decides to do so, must publish the statement as revised.

(8) In preparing or revising the statement the Board must consult—

(a) the Minister for the Cabinet Office,

(b) the Information Commissioner,

(c) the Scottish Ministers,

(d) the Welsh Ministers,

(e) the Department of Finance in Northern Ireland, and

(f) such other persons as the Board thinks fit.

(9) The fact that this section was not in force when consultation of the kind mentioned in subsection (8) took place is to be disregarded in determining whether there has been compliance with that subsection.

(10) The Board may not publish the original statement under this section unless a draft of the statement has been laid before, and approved by a resolution of, each House of Parliament.

(11) Before publishing a revised statement under this section the Board must lay a draft of the statement as proposed to be published before Parliament.

(12) The Board may not publish the revised statement if, within the 40-day period, either House of Parliament resolves not to approve it.

(13) In subsection (12) “the 40 day period” means—

(a) the period of 40 days beginning with the day on which the draft is laid before Parliament, or

(b) if the draft is not laid before each House on the same day, the period of 40 days beginning with the later of the days on which it is laid before Parliament.

(14) For the purposes of subsection (13) no account is to be taken of any period during which Parliament is dissolved or prorogued or during which both Houses are adjourned for more than four days.

(15) After preparing or revising a statement the Board must lay the statement, or the statement as revised, before—

(a) the Scottish Parliament,

(b) the National Assembly for Wales, and

(c) the Northern Ireland Assembly.

(16) In exercising any of its functions under section 45B, 45C or 45D to require the disclosure of information, the Board must have regard to any code of practice issued by the Information Commissioner under [F32 section 128 of the Data Protection Act 2018] which makes provision about the identification and reduction of the risks to privacy of a proposal to disclose information, so far as the code applies to the information in question.

(17) The duty in subsection (16) to have regard to a code of practice does not affect any other requirement for the Board to have regard to a code of practice under [F33 the data protection legislation] in exercising the function.

Textual Amendments

F21 Ss. 45B-45G inserted (1.10.2017 for E.W.S. for specified purposes, 1.5.2018 in so far as not already in force) by Digital Economy Act 2017 (c. 30), ss. 80, 118(4); S.I. 2017/765, reg. 3(n); S.I. 2018/382, reg. 3(ll)

F31 Words in s. 45E(6) substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 139(2) (with ss. 117, 209, 210, Sch. 20 para. 49); S.I. 2018/625, reg. 2(1)(g)

F32 Words in s. 45E(16) substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 139(3) (with ss. 117, 209, 210, Sch. 20 para. 49); S.I. 2018/625, reg. 2(1)(g)

F33 Words in s. 45E(17) substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 139(4) (with ss. 117, 209, 210, Sch. 20 para. 49); S.I. 2018/625, reg. 2(1)(g)

45F Offences relating to notices under section 45C or 45D U.K.

(1) A person is guilty of an offence if—

(a) the person is given a notice under section 45C or 45D,

(b) the person is required to comply with the notice,

(c) the person fails to do so, and

(d) the person does not have a reasonable excuse for that failure.

(2) A person is guilty of an offence if, in purporting to comply with a notice under section 45C or 45D, the person—

(a) provides information which is false in a material respect, and

(b) knows that the information is false in that respect or is reckless as to whether it is false in that respect.

(3) A person who is guilty of an offence under subsection (1) or (2) is liable on summary conviction—

(a) in England and Wales, to a fine, and

(b) in Scotland or Northern Ireland, to a fine not exceeding level 5 on the standard scale.

(4) If an offence under this section is committed by a body corporate with the consent or connivance of an officer of the body, the officer, as well as the body, is to be treated as having committed the offence.

(5) In subsection (4) a reference to an officer of a body includes a reference to—

(a) a director, manager or secretary,

(b) a person purporting to act as a director, manager or secretary, and

(c) if the affairs of the body are managed by its members, a member.

(6) Where an offence under this section is committed by a partnership (whether or not a limited partnership) subsection (4) has effect, but as if a reference to an officer of the body were a reference to—

(a) a partner, and

(b) a person purporting to act as a partner.

Textual Amendments

F21 Ss. 45B-45G inserted (1.10.2017 for E.W.S. for specified purposes, 1.5.2018 in so far as not already in force) by Digital Economy Act 2017 (c. 30), ss. 80, 118(4); S.I. 2017/765, reg. 3(n); S.I. 2018/382, reg. 3(ll)

45G Code of practice on changes to data systems U.K.

(1) The Board must prepare, adopt and publish a code of practice containing guidance on the matters to be taken into account by a public authority in making changes to—

(a) its processes for collecting, organising, storing or retrieving information, or

(b) its processes (if any) for supplying information to the Board.

(2) A public authority must have regard to any code of practice under this section in making such changes.

(3) The Board may at any time revise a code of practice under this section and, if it decides to do so, must publish the code as revised.

(4) In preparing or revising a code of practice under this section, the Board must consult—

(a) the Minister for the Cabinet Office,

(b) the Scottish Ministers,

(c) the Welsh Ministers,

(d) the Department of Finance in Northern Ireland, and

(e) such other persons as the Board thinks fit.

(5) The fact that this section was not in force when consultation of the kind mentioned in subsection (4) took place is to be disregarded in determining whether there has been compliance with that subsection.

(6) The Board may not publish the original code of practice under this section unless a draft of the code has been laid before, and approved by a resolution of, each House of Parliament

(7) Before publishing a revised code of practice under this section the Board must lay a draft of the code as proposed to be published before Parliament.

(8) The Board may not publish the revised code of practice if, within the 40-day period, either House of Parliament resolves not to approve it.

(9) In subsection (8) “the 40 day period” means—

(a) the period of 40 days beginning with the day on which the draft is laid before Parliament, or

(b) if the draft is not laid before each House on the same day, the period of 40 days beginning with the later of the days on which it is laid before Parliament.

(10) For the purposes of subsection (9) no account is to be taken of any period during which Parliament is dissolved or prorogued or during which both Houses are adjourned for more than four days.

(11) After preparing or revising a code of practice under this section the Board must lay the code, or the code as revised, before—

(a) the Scottish Parliament,

(b) the National Assembly for Wales, and

(c) the Northern Ireland Assembly.

(12) The reference in subsection (1) to making changes to a process includes introducing or removing a process.

(13) This section binds the Crown.

(14) The reference to the Crown in subsection (13) does not include—

(a) Her Majesty in Her private capacity,

(b) Her Majesty in right of the Duchy of Lancaster, or

(c) the Duke of Cornwall.]

Textual Amendments

F21 Ss. 45B-45G inserted (1.10.2017 for E.W.S. for specified purposes, 1.5.2018 in so far as not already in force) by Digital Economy Act 2017 (c. 30), ss. 80, 118(4); S.I. 2017/765, reg. 3(n); S.I. 2018/382, reg. 3(ll)

46 Information sharing: supplementary amendments U.K.

Schedule 2 (which makes further provision relating to the disclosure of information to or by the Board) has effect.

Commencement Information

I5 S. 46 in force at 1.4.2008 by S.I. 2008/839, art. 2