Economic Crime and Corporate Transparency Act 2023

189 Indirect disclosure of information: restrictions on civil liability U.K.

(1) The protections set out in subsection (2) apply in relation to a disclosure made by a person (“A”) to another person (“B”) if—

(a) A is carrying on business in circumstances where subsection (3) applies,

(b) the information relates to a person who is a customer or former customer of A (“the customer”),

(c) due to concerns about the risk of economic crime, A has decided to—

(i) terminate a business relationship with the customer,

(ii) refuse the customer a product or service, or

(iii) restrict the customer’s access to elements of a product or service which are available to other customers,

(d) A is satisfied that the information disclosed to B, if it is disclosed by B to one or more persons carrying on business in circumstances where subsection (3) applies, will or may assist those persons in carrying out their relevant actions,

(e) to the extent that the information is personal data, the UK GDPR applies to the disclosure of the information by A,

(f) A and B are parties to an agreement the terms of which provide that, to the extent that the information is personal data, B will only disclose or otherwise process it in circumstances where the UK GDPR applies to the disclosure or other processing, and

(g) the disclosure is not a privileged disclosure.

(2) The protections are that, subject to subsection (10), the disclosure does not—

(a) give rise to a breach of any obligation of confidence owed by A, or

(b) give rise to any civil liability, on the part of A, to the person to whom the disclosed information relates.

(3) This subsection applies—

(a) where the business carried on is business in the regulated sector as—

(i) a deposit-taking body,

(ii) an electronic money institution,

(iii) a payment institution,

(iv) a cryptoasset exchange provider, or

(v) a custodian wallet provider,

(b) where—

(i) the business carried on is business in the regulated sector within paragraph 1(1)(j) to (n) of Schedule 9 to the Proceeds of Crime Act 2002 (audit, insolvency, accountancy, tax or legal services), and

(ii) the UK revenue of the person carrying on the business is large or very large for the relevant financial year (see subsection (11)), and

(c) in circumstances prescribed, in relation to the business or the person carrying it on, by regulations made by the Secretary of State for the purposes of this paragraph.

(4) Where subsection (1) applies to a disclosure of information made by A to B, the protections set out in subsection (5) apply in relation to a further disclosure of that information made by B to another person (“C”) if—

(a) C is carrying on business in circumstances where subsection (3) applies, and

(b) to the extent that the information is personal data, the UK GDPR applies to all processing of the information by B, up to and including the disclosure of the information to C.

(5) The protections are that, subject to subsection (10), the disclosure does not—

(a) give rise to a breach of any obligation of confidence owed by B, or

(b) give rise to any civil liability, on the part of B, to the person to whom the disclosed information relates.

(6) Where a disclosure is made to which subsection (4) applies, C’s use of the disclosed information, for the purposes of any of C’s relevant actions, does not breach any obligation of confidence owed by C.

(7) The protections set out in subsection (8) apply in relation to a disclosure made by a person (“R”), who is carrying on business in circumstances where subsection (3) applies, to another person, for the purposes of making a request for a disclosure of information to be made to R by that other person if, at the time the request is made, R has reason to believe that the disclosure of information to which the request relates would be one to which subsection (4) applies.

(8) The protections are that, subject to subsection (10), the disclosure does not—

(a) give rise to a breach of any obligation of confidence owed by R, or

(b) give rise to any civil liability, on the part of R, to the person to whom the disclosed information relates.

(9) Where a disclosure is made to which subsection (7) applies, the use by that other person, of the disclosed information, for the purposes of enabling a disclosure to be made by them to which subsection (4) applies, does not—

(a) give rise to a breach of any obligation of confidence owed by them, or

(b) give rise to any civil liability, on their part, to the person to whom the disclosed information relates.

This is subject to subsection (10).

(10) Nothing in this section authorises a disclosure of information that would contravene, or prevents any civil liability arising under, the data protection legislation.

(11) In subsection (3)(b) “relevant financial year”—

(a) for the purposes of subsection (1)(a), means the financial year immediately preceding that in which the disclosure by A is made;

(b) for the purposes of subsection (4)(a), means the financial year immediately preceding that in which the disclosure to C is made.

And, for the purposes of subsection (3)(b), the question of whether a person’s UK revenue is large or very large for a particular financial year is to be determined in accordance with sections 55 to 57 of the Finance Act 2022 (calculation of UK revenue for the economic crime (anti-money laundering) levy).

Commencement Information

I1 S. 189 in force at Royal Assent for specified purposes, see s. 219(1)(2)(b)

I2 S. 189 in force at 15.1.2024 in so far as not already in force by S.I. 2023/1206, reg. 3(h)