(1)Subject to this section, the Board may disclose information held by the Board in connection with the exercise of any of its functions to a devolved authority.
(2)In this section “devolved authority” means—
(a)a person who is a part of the Scottish Administration,
(b)the Welsh Ministers,
(c)the Department of Finance in Northern Ireland, or
(d)the Registrar General for Northern Ireland.
(3)Information may only be disclosed under this section for the purposes of any or all of the statistical functions of a devolved authority.
(4)Information may only be disclosed under this section in response to a request in writing by a devolved authority which specifies—
(a)the information which is sought, and
(b)the purposes for which it is sought.
(5)A request under subsection (4) may request information to be disclosed on more than one date specified in the notice within a period specified in the notice.
(6)Information may be disclosed under this section only if—
(a)the Board is satisfied that the information is required for the purposes of the statistical functions of the devolved authority which are specified in the request,
(b)the Board is satisfied that the information will not be used for any other purpose, and
(c)if the information was obtained by the Board from a public authority, the authority consents to the disclosure.
(7)The Board may—
(a)disclose information under this section subject to conditions to be met by the devolved authority;
(b)from time to time modify conditions subject to which information has been disclosed;
(c)in the case of information which it is disclosing in response to a request to which subsection (5) applies, cease to disclose information in response to the request if any of the conditions are breached.
(8)A devolved authority may only use information disclosed under this section for the purposes for which it was disclosed.
(9)In disclosing information under subsection (1), the Board must have regard to the following codes of practice issued by the Information Commissioner under section 51(3) of the Data Protection Act 1998, so far as they apply to the information in question—
(a)any code which makes provision about the identification and reduction of the risks to privacy of a proposal to disclose information;
(b)any code which makes provision about the information to be provided to data subjects (within the meaning of that Act) about the use to be made of information collected from them.
(10)The duty in subsection (9) to have regard to a code of practice does not affect any other requirement for the Board to have regard to a code of practice under the Data Protection Act 1998 in disclosing the information.
(11)In the application of section 39 to personal information which has been disclosed to a devolved authority under this section, paragraphs (c) and (i) of subsection (4) of that section do not apply.
(12)This section does not authorise the making of a disclosure which would—
(a)breach any obligation of confidence owed by the Board,
(b)contravene the Data Protection Act 1998,
(c)be prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016, or
(d)breach any other restriction on the disclosure of information (however imposed).
(13)Until the repeal of Part 1 of the Regulation of Investigatory Powers Act 2000 by paragraphs 45 and 54 of Schedule 10 to the Investigatory Powers Act 2016 is fully in force, subsection (12)(c) has effect as if it included a reference to that Part.
(14)Nothing in this section affects the scope of the powers in sections 51 to 53.]
Textual Amendments
F1S. 53A inserted (31.7.2017 for E.W.S., 1.5.2018 in so far as not already in force) by Digital Economy Act 2017 (c. 30), ss. 81, 118(4); S.I. 2017/765, reg. 2(v); S.I. 2018/382, reg. 3(mm)