F1Arts. 4A-4H and preceding cross-heading inserted (1.3.2008 for preceding cross-heading and Art. 4G(1)(3)(4) otherwise 6.4.2008) by Serious Crime Act 2007 (c. 27), ss. 73, 94(1), Sch. 7 para. 6; S.I. 2008/219, art. 3(j); S.I. 2008/755, art. 16(a)
4D—(1) This Article applies to the following information—
(a)information relating to a particular body or person obtained by or on behalf of the Comptroller and Auditor General for the purpose of conducting a data matching exercise;
(b)the results of any such exercise.
(2) Information to which this Article applies may be disclosed by or on behalf of the Comptroller and Auditor General if the disclosure is—
(a)for or in connection with a purpose for which the data matching exercise is conducted;
(b)to a body mentioned in paragraph (3) (or a related party) for or in connection with a function of that body corresponding or similar to the audit functions of the Comptroller and Auditor General or a local government auditor under any statutory provision or the data matching functions of the Comptroller and Auditor General under Article 4A; or
(c)in pursuance of a duty imposed by or under a statutory provision.
(3) The bodies are—
(a)the Audit Commission for Local Authorities and the National Health Service in England;
(b)the Auditor General for Wales;
(c)the Auditor General for Scotland;
(d)the Accounts Commission for Scotland;
(e)Audit Scotland.
(4) “”, in relation to a body mentioned in paragraph (3), means—
(a)a body or person acting on its behalf;
(b)a body whose accounts are required to be audited by it or by a person appointed by it;
(c)a person appointed by it to audit those accounts.
(5) If the data used for a data matching exercise include patient data—
(a)paragraph (2)(a) applies only so far as the purpose for which the disclosure is made relates to a relevant NHS body;
(b)paragraph (2)(b) applies only so far as the function for or in connection with which the disclosure is made relates to such a body.
(6) In paragraph (5)—
(a)“patient data” has the same meaning as in Article 4C;
(b)“relevant NHS body” means—
(i)a body to which Article 90 of the Health and Personal Social Services (Northern Ireland) Order 1972 (NI 14) applies;
(ii)a health service body as defined in section 53(1) of the Audit Commission Act 1998 (c. 18);
(iii)a Welsh NHS body as defined in section 60 of the Public Audit (Wales) Act 2004 (c. 23);
(iv)an NHS body as defined in section 22(1) of the Community Care and Health (Scotland) Act 2002 (asp 5).
(7) Information disclosed under paragraph (2) may not be further disclosed except—
(a)for or in connection with the purpose for which it was disclosed under sub-paragraph (a) or the function for which it was disclosed under sub-paragraph (b) of that paragraph;
(b)for the investigation or prosecution of an offence (so far as the disclosure does not fall within sub-paragraph (a)); or
(c)in pursuance of a duty imposed by or under a statutory provision.
(8) Except as authorised by paragraphs (2) and (7), a person who discloses information to which this Article applies is guilty of an offence and liable—
(a)on conviction on indictment, to imprisonment for a term not exceeding two years, to a fine or to both; or
(b)on summary conviction, to imprisonment for a term not exceeding 6 months, to a fine not exceeding the statutory maximum or to both.
(9) Article 27 of the Local Government (Northern Ireland) Order 2005 (NI 18) does not apply to information to which this Article applies.
(10) In this Article “body” includes office.]