Digital Economy Act 2017

CHAPTER 5 U.K. Sharing for research purposes

64 Disclosure of information for research purposes U.K.

(1) Information held by a public authority in connection with the authority's functions may be disclosed to another person for the purposes of research which is being or is to be carried out.

(2) If the information is personal information it may not be disclosed under subsection (1) unless the following conditions are met.

(3) The first condition is that, if the information identifies a particular person, it is processed before it is disclosed so that—

(a) the person's identity is not specified in the information, and

(b) it is not reasonably likely that the person's identity will be deduced from the information (whether by itself or taken together with other information).

(4) For the purposes of the first condition the information may be processed by—

(a) the public authority,

(b) a person other than the public authority, or

(c) both the public authority and a person other than the public authority,

(subject to the following provisions of this Chapter).

(5) Personal information may be disclosed for the purpose of processing it for disclosure under subsection (1)—

(a) by a public authority to a person involved in processing the information for that purpose;

(b) subject to sections 67(5), 68(5) and 69(5) (information disclosed by revenue authorities), by one such person to another such person.

(6) The second condition is that each person who is involved in processing the information for disclosure takes reasonable steps to—

(a) minimise the risk of the accidental disclosure of information which identifies a particular person, and

(b) prevent the deliberate disclosure of such information (otherwise than in accordance with this Chapter).

(7) The third condition is that the disclosure is made by the public authority or by a person, other than the public authority, who is involved in processing the information for disclosure under subsection (1).

(8) The fourth condition is that the research for the purposes of which the information is disclosed is accredited under section 71.

(9) The fifth condition is that the following are accredited under section 71—

(a) any person (including the public authority) who is involved in processing the information for disclosure under subsection (1);

(b) any person to whom information is disclosed under subsection (1);

(c) any person by whom such information is used for research purposes.

(10) The sixth condition is that each person who discloses the information or is involved in processing it for disclosure under subsection (1) has regard to the code of practice under section 70 in doing so.

(11) For the purposes of this Chapter information is “personal information” if—

(a) it relates to a particular person (including a body corporate), but

(b) it is not information about the internal administrative arrangements of a public authority.

(12) For the purposes of this Chapter information identifies a particular person if the identity of that person—

(a) is specified in the information,

(b) can be deduced from the information, or

(c) can be deduced from the information taken together with any other information.

(13) This section is subject to section 65.

Commencement Information

I1 S. 64 in force at 1.4.2018 for specified purposes by S.I. 2018/342, reg. 3(2)

65 Provisions supplementary to section 64 U.K.

(1) A disclosure under section 64 does not breach—

(a) any obligation of confidence owed by the person making the disclosure, or

(b) any other restriction on the disclosure of information (however imposed).

(2) But nothing in section 64 authorises information to be disclosed if to do so would—

(a) contravene the Data Protection Act 1998, or

(b) be prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016.

(3) Until the repeal of Part 1 of the Regulation of Investigatory Powers Act 2000 by paragraphs 45 and 54 of Schedule 10 to the Investigatory Powers Act 2016 is fully in force, subsection (2)(b) has effect as if it included a reference to that Part.

(4) In its application to a public authority with functions relating to the provision of health services or adult social care, section 64 does not authorise the disclosure of information held by the authority in connection with such functions.

(5) Section 64 does not limit the circumstances in which information may be disclosed apart from that section.

(6) A person within subsection (7) may charge a person who requests information to be disclosed under section 64(1) a fee for work done in response to the request.

(7) The persons mentioned in subsection (6) are—

(a) the public authority to whom the request is made, and

(b) a person who is involved in processing the information for disclosure.

(8) A fee charged under subsection (6) by a public authority (including a person within subsection (7)(b) who is a public authority) must not exceed the cost to the person of doing the work for which the fee is charged.

Commencement Information

I2 S. 65 in force at 1.4.2018 for specified purposes by S.I. 2018/342, reg. 3(2)

66 Bar on further disclosure of personal information U.K.

(1) Subsection (2) applies to personal information—

(a) in which the identity of a particular person is specified or from which the identity of a particular person can be deduced, whether from the information itself or from that information taken together with any other published information, and

(b) which is received by a person (“P”) under section 64(1) (disclosure for research purposes).

(2) Personal information to which this subsection applies may not be disclosed—

(a) by P, or

(b) by any other person who has received it directly or indirectly from P.

(3) Subsection (2) does not apply to a disclosure—

(a) to a person by whom the research referred to in section 64(1) is being or is to be carried out, or

(b) for the purposes of enabling anything that is to be published as a result of the research to be reviewed before publication, where the disclosure is made to a person who is accredited under section 71 as a person to whom such information may be disclosed for that purpose.

(4) Subsection (5) applies to personal information which—

(a) identifies a particular person, and

(b) is received by a person (“P”) under section 64(5) (disclosure for processing).

(5) Personal information to which this subsection applies may not be disclosed—

(a) by P, or

(b) by any other person who has received it directly or indirectly from P.

(6) Subsection (5) does not apply to a disclosure—

(a) under section 64(1) or (5), or

(b) of information previously disclosed under section 64(1), where the disclosure is made by—

(i) the person to whom the information was disclosed under that provision, or

(ii) any person who has received the information directly or indirectly from the person mentioned in sub-paragraph (i),

(but subsection (2) may apply to such a disclosure).

(7) Subsection (2) or (5) does not apply to a disclosure—

(a) which is required or permitted by any enactment,

(b) which is required by an EU obligation,

(c) which is made in pursuance of an order of the court,

(d) of information which has already lawfully been made available to the public,

(e) which is made for the prevention or detection of crime or the prevention of anti-social behaviour,

(f) which is made for the purposes of a criminal investigation,

(g) which is made for the purposes of legal proceedings (whether civil or criminal),

(h) which is a protected disclosure for any of the purposes of the Employment Rights Act 1996 or the Employment Rights (Northern Ireland) Order 1996 (SI 1996/1919 (NI 16)),

(i) consisting of the publication of information for the purposes of journalism, where the publication of the information is in the public interest, or

(j) which is made with the consent of the person to whom it relates.

(8) In subsection (7)(a) “enactment” includes—

(a) an enactment contained in, or in an instrument made under, an Act of the Scottish Parliament;

(b) an enactment contained in, or in an instrument made under, a Measure or Act of the National Assembly for Wales;

(c) an enactment contained in, or in an instrument made under, Northern Ireland legislation;

(d) an enactment contained in subordinate legislation within the meaning of the Interpretation Act 1978.

(9) In subsection (7)(e) “anti-social behaviour” means conduct that—

(a) is likely to cause harassment, alarm or distress to any person, or

(b) is capable of causing nuisance or annoyance to a person in relation to that person's occupation of residential premises.

(10) A person commits an offence if—

(a) the person discloses personal information in contravention of subsection (2) or (5), and

(b) at the time that the person makes the disclosure, the person knows that the disclosure contravenes that subsection or is reckless as to whether the disclosure does so.

(11) A person who is guilty of an offence under subsection (10) is liable on conviction on indictment to imprisonment for a term not exceeding two years, to a fine or to both.

(12) A person who is guilty of an offence under subsection (10) is liable on summary conviction—

(a) in England and Wales, to imprisonment for a term not exceeding 12 months, to a fine or to both;

(b) in Scotland, to imprisonment for a term not exceeding 12 months, to a fine not exceeding the statutory maximum or to both;

(c) in Northern Ireland, to imprisonment for a term not exceeding 6 months, to a fine not exceeding the statutory maximum or to both.

(13) In the application of subsection (12)(a) to an offence committed before the coming into force of section 154(1) of the Criminal Justice Act 2003 the reference to 12 months is to be read as a reference to 6 months.

(14) This section does not apply to personal information disclosed under section 64(1) or (5) by the Revenue and Customs, the Welsh Revenue Authority or Revenue Scotland.

Commencement Information

I3 S. 66 in force at 1.4.2018 for specified purposes by S.I. 2018/342, reg. 3(2)

67 Information disclosed by the Revenue and Customs U.K.

(1) Subsection (2) applies to personal information—

(a) in which the identity of a particular person is specified or from which the identity of a particular person can be deduced, whether from the information itself or from that information taken together with any other published information, and

(b) which—

(i) is disclosed under section 64(1) (disclosure for research purposes) by the Revenue and Customs, or

(ii) is disclosed under section 64(1) by a person other than the Revenue and Customs and is derived from information disclosed under section 64(5) by the Revenue and Customs,

and is received by a person (“P”) under section 64(1).

(2) Personal information to which this subsection applies may not be disclosed—

(a) by P, or

(b) by a person to whom the information is disclosed by virtue of subsection (3).

(3) Subsection (2) does not apply to a disclosure—

(a) to a person by whom the research referred to in section 64(1) is being or is to be carried out, or

(b) for the purposes of enabling anything that is to be published as a result of the research to be reviewed before publication, where the disclosure is made to a person who is accredited under section 71 as a person to whom such information may be disclosed for that purpose.

(4) Subsection (5) applies to personal information which—

(a) identifies a particular person, and

(b) is disclosed by the Revenue and Customs under section 64(5) (disclosure for processing) and received by a person (“P”).

(5) Personal information to which this subsection applies may not be disclosed—

(a) by P, or

(b) by any other person who has received it under section 64(5).

(6) Subsection (5) does not apply to a disclosure under section 64(1).

(7) Subsection (2) or (5) does not apply to a disclosure which is made with the consent of the Commissioners for Her Majesty's Revenue and Customs (which may be general or specific).

(8) A person who contravenes subsection (2) or (5) is guilty of an offence.

(9) It is a defence for a person charged with an offence under subsection (8) to prove that the person reasonably believed—

(a) that the disclosure was lawful, or

(b) that the information had already and lawfully been made available to the public.

(10) Subsections (4) to (7) of section 19 of the Commissioners for Revenue and Customs Act 2005 apply to an offence under subsection (8) as they apply to an offence under that section.

Commencement Information

I4 S. 67 in force at 1.4.2018 for specified purposes by S.I. 2018/342, reg. 3(2)

68 Information disclosed by the Welsh Revenue Authority U.K.

(1) Subsection (2) applies to personal information—

(a) in which the identity of a particular person is specified or from which the identity of a particular person can be deduced, whether from the information itself or from that information taken together with any other published information, and

(b) which—

(i) is disclosed under section 64(1) (disclosure for research purposes) by the Welsh Revenue Authority, or

(ii) is disclosed under section 64(1) by a person other than the Welsh Revenue Authority and is derived from information disclosed under section 64(5) by the Welsh Revenue Authority,

and is received by a person (“P”) under section 64(1).

(2) Personal information to which this subsection applies may not be disclosed—

(a) by P, or

(b) by a person to whom the information is disclosed by virtue of subsection (3).

(3) Subsection (2) does not apply to a disclosure—

(a) to a person by whom the research referred to in section 64(1) is being or is to be carried out, or

(b) for the purposes of enabling anything that is to be published as a result of the research to be reviewed before publication, where the disclosure is made to a person who is accredited under section 71 as a person to whom such information may be disclosed for that purpose.

(4) Subsection (5) applies to personal information which—

(a) identifies a particular person, and

(b) is disclosed by the Welsh Revenue Authority under section 64(5) (disclosure for processing) and received by a person (“P”).

(5) Personal information to which this subsection applies may not be disclosed—

(a) by P, or

(b) by any other person who has received it under section 64(5).

(6) Subsection (5) does not apply to a disclosure under section 64(1).

(7) Subsection (2) or (5) does not apply to a disclosure which is made with the consent of the Welsh Revenue Authority (which may be general or specific).

(8) A person who contravenes subsection (2) or (5) is guilty of an offence.

(9) It is a defence for a person charged with an offence under subsection (8) to prove that the person reasonably believed—

(a) that the disclosure was lawful, or

(b) that the information had already and lawfully been made available to the public.

(10) A person who is guilty of an offence under subsection (8) is liable—

(a) on summary conviction, to imprisonment for a term not exceeding 12 months, to a fine, or to both;

(b) on conviction on indictment to imprisonment for a term not exceeding two years, to a fine or to both.

(11) In the application of subsection (10)(a) to an offence committed before the coming into force of section 154(1) of the Criminal Justice Act 2003 the reference to 12 months is to be read as a reference to 6 months.

Commencement Information

I5 S. 68 in force at 1.4.2018 for specified purposes by S.I. 2018/342, reg. 3(2)

69 Information disclosed by Revenue Scotland U.K.

(1) Subsection (2) applies to personal information—

(a) in which the identity of a particular person is specified or from which the identity of a particular person can be deduced, whether from the information itself or from that information taken together with any other published information, and

(b) which—

(i) is disclosed under section 64(1) (disclosure for research purposes) by Revenue Scotland, or

(ii) is disclosed under section 64(1) by a person other than Revenue Scotland and is derived from information disclosed under section 64(5) by Revenue Scotland,

and is received by a person (“P”) under section 64(1).

(2) Personal information to which this subsection applies may not be disclosed—

(a) by P, or

(b) by a person to whom the information is disclosed by virtue of subsection (3).

(3) Subsection (2) does not apply to a disclosure—

(a) to a person by whom the research referred to in section 64(1) is being or is to be carried out, or

(b) for the purposes of enabling anything that is to be published as a result of the research to be reviewed before publication, where the disclosure is made to a person who is accredited under section 71 as a person to whom such information may be disclosed for that purpose.

(4) Subsection (5) applies to personal information which—

(a) identifies a particular person, and

(b) is disclosed by Revenue Scotland under section 64(5) (disclosure for processing) and received by a person (“P”).

(5) Personal information to which this subsection applies may not be disclosed—

(a) by P, or

(b) by any other person who has received it under section 64(5).

(6) Subsection (5) does not apply to a disclosure under section 64(1).

(7) Subsection (2) or (5) does not apply to a disclosure which is made with the consent of Revenue Scotland (which may be general or specific).

(8) A person who contravenes subsection (2) or (5) is guilty of an offence.

(9) It is a defence for a person charged with an offence under subsection (8) to prove that the person reasonably believed—

(a) that the disclosure was lawful, or

(b) that the information had already and lawfully been made available to the public.

(10) A person who is guilty of an offence under subsection (8) is liable—

(a) on summary conviction, to imprisonment for a term not exceeding 12 months, to a fine not exceeding the statutory maximum or to both;

(b) on conviction on indictment to imprisonment for a term not exceeding two years, to a fine or to both.

Commencement Information

I6 S. 69 in force at 1.4.2018 for specified purposes by S.I. 2018/342, reg. 3(2)

70 Code of practice U.K.

(1) The Statistics Board must issue a code of practice about—

(a) the disclosure of personal information under section 64,

(b) the processing of information under that section, and

(c) the holding or use of personal information disclosed under that section.

(2) The code of practice must be consistent with the code of practice issued under section 52B (data-sharing code) of the Data Protection Act 1998 (as altered or replaced from time to time).

(3) A public authority must have regard to the code of practice in disclosing personal information or participating in the processing of information under section 64.

(4) A person who is accredited under section 71(1)(a) must have regard to the code of practice in participating in the processing of information for disclosure under section 64(1).

(5) A person who is accredited under section 71(1)(b), (c) or (d) must have regard to the code of practice in holding or using personal information disclosed under section 64.

(6) The Statistics Board may from time to time revise and re-issue the code of practice.

(7) Before issuing or reissuing the code of practice the Statistics Board must consult—

(a) the Minister for the Cabinet Office,

(b) the Information Commissioner,

(c) the Commissioners for Her Majesty's Revenue and Customs,

(d) the Scottish Ministers,

(e) the Welsh Ministers,

(f) the Department of Finance in Northern Ireland, and

(g) such other persons as the Statistics Board thinks appropriate.

(8) The fact that this section was not in force when consultation of the kind mentioned in subsection (7) took place is to be disregarded in determining whether there has been compliance with that subsection.

(9) The Statistics Board may not issue the code of practice unless a draft of the code has been laid before, and approved by a resolution of, each House of Parliament.

(10) Before reissuing the code the Statistics Board must lay a draft of the code as proposed to be reissued before Parliament.

(11) The Statistics Board may not reissue the code if, within the 40-day period, either House of Parliament resolves not to approve it.

(12) In subsection (11) “the 40 day period” means—

(a) the period of 40 days beginning with the day on which the draft is laid before Parliament, or

(b) if the draft is not laid before each House on the same day, the period of 40 days beginning with the later of the days on which it is laid before Parliament.

(13) For the purposes of subsection (12) no account is to be taken of any period during which Parliament is dissolved or prorogued or during which both Houses are adjourned for more than four days.

(14) As soon as is reasonably practicable after issuing or reissuing the code of practice the Statistics Board must lay a copy of it before—

(a) the Scottish Parliament,

(b) the National Assembly for Wales, and

(c) the Northern Ireland Assembly.

(15) In disclosing information under section 64, a person must have regard to the following codes of practice issued by the Information Commissioner under section 51(3) of the Data Protection Act 1998, so far as they apply to the information in question—

(a) any code which makes provision about the identification and reduction of the risks to privacy of a proposal to disclose information;

(b) any code which makes provision about the information to be provided to data subjects (within the meaning of that Act) about the use to be made of information collected from them.

(16) The duty in subsection (15) does not affect any other requirement for the person to have regard to a code of practice in disclosing the information.

Commencement Information

I7 S. 70 in force at 1.10.2017 for specified purposes for E.W.S. by S.I. 2017/765, reg. 3(m)

I8 S. 70 in force at 1.4.2018 for specified purposes by S.I. 2018/342, reg. 3(2)

71 Accreditation for the purposes of this Chapter U.K.

(1) The Statistics Board—

(a) may accredit a person as a person who may be involved in the processing of information for disclosure under subsection (1) of section 64,

(b) may accredit a person as a person to whom information may be disclosed under that subsection,

(c) may accredit a person as a person by whom information disclosed under that subsection may be used for research purposes,

(d) may accredit a person as a person to whom such information may be disclosed for the purposes of a review of the kind mentioned in section 66(3)(b), 67(3)(b), 68(3)(b) or 69(3)(b),

(e) may accredit research for the purposes of section 64, and

(f) may withdraw accreditation given under any of paragraphs (a) to (e).

(2) The Statistics Board—

(a) must establish and publish conditions to be met by a person for accreditation under subsection (1)(a), (b), (c) or (d),

(b) must establish and publish conditions to be met by research for accreditation under subsection (1)(e), and

(c) must establish and publish grounds for the withdrawal of accreditation under subsection (1)(f).

(3) The conditions established and published under subsection (2)(a) must, in the case of a person seeking accreditation to be involved in the processing of information for disclosure under section 64(1), include a condition that the person is a fit and proper person to be involved in such processing.

(4) The conditions established and published under subsection (2)(b) must include a condition that the research is in the public interest.

(5) The grounds established and published under subsection (2)(c) must, in the case of a person accredited under this section, include the ground that the person has failed to have regard to the code of practice under section 70.

(6) Before publishing conditions under subsection (2)(a) or (b) or grounds under subsection (2)(c), the Statistics Board must consult—

(a) the Minister for the Cabinet Office,

(b) the Information Commissioner,

(c) the Commissioners for Her Majesty's Revenue and Customs,

(d) the Scottish Ministers,

(e) the Welsh Ministers,

(f) the Department of Finance in Northern Ireland, and

(g) such other persons as the Statistics Board thinks appropriate.

(7) The Statistics Board—

(a) may from time to time revise conditions or grounds published under this section, and

(b) if it does so, must publish the conditions or grounds as revised.

(8) Subsection (6) applies in relation to the publication of conditions or grounds under subsection (7) as it applies in relation to the publication of conditions or grounds under subsection (2).

(9) The Statistics Board must maintain and publish—

(a) a register of persons who are accredited under subsection (1)(a),

(b) a register of persons who are accredited under subsection (1)(b),

(c) a register of persons who are accredited under subsection (1)(c), and

(d) a register of persons who are accredited under subsection (1)(d).

(10) A register under any of the paragraphs of subsection (9) may be combined with a register under any of the other paragraphs of that subsection.

(11) Anything required by this section to be published must be published in such manner as the Statistics Board thinks appropriate for bringing it to the attention of persons likely to be affected by it.

Commencement Information

I9 S. 71 in force at 1.4.2018 for specified purposes by S.I. 2018/342, reg. 3(2)

72 Delegation of functions of the Statistics Board U.K.

(1) The Statistics Board may delegate any of its functions under section 71 to another person if the Board thinks that the person—

(a) is a fit and proper person to exercise the function in question, and

(b) has expertise in statistical research and analysis.

(2) Subsection (1) does not affect the operation of section 36 of the Statistics and Registration Service Act 2007 (delegation of Board's functions).

Commencement Information

I10 S. 72 in force at 1.4.2018 for specified purposes by S.I. 2018/342, reg. 3(2)

73 Interpretation of this Chapter U.K.

(1) In this Chapter—

• “personal information” has the meaning given by section 64(11);

• “public authority” means a person with functions of a public nature, subject to subsection (2);

• “the Revenue and Customs” has the meaning given by section 17(3) of the Commissioners for Revenue and Customs Act 2005.

(2) A person is not a public authority for the purposes of this Chapter if the person—

(a) only has functions relating to the provision of health services,

(b) only has functions relating to the provision of adult social care, or

(c) only has functions within paragraph (a) and paragraph (b).

(3) The following are to be disregarded in determining whether subsection (2) applies to a person—

(a) any power (however expressed) to do things which are incidental to the carrying out of another function of that person;

(b) any function which the person exercises or may exercise on behalf of another person.

(4) In this Chapter “health services” means—

(a) services which must or may be provided as part of the health service as defined by section 275(1) of the National Health Service Act 2006 or section 206(1) of the National Health Service (Wales) Act 2006,

(b) services which must or may be provided as part of the health service as defined by section 108(1) of the National Health Service (Scotland) Act 1978, or

(c) services designed to secure any of the objects of section 2(1)(a) of the Health and Social Care (Reform) Act (Northern Ireland) 2009.

(5) In this Chapter “adult social care” includes all forms of personal care and other practical assistance provided for individuals aged 18 or over who, by reason of age, illness, disability, pregnancy, childbirth, dependence on alcohol or drugs, or any other similar circumstances, are in need of such care or assistance.

(6) References in this Chapter to information which identifies a particular person are to be read in accordance with section 64(12).

Commencement Information

I11 S. 73 in force at 1.4.2018 for specified purposes by S.I. 2018/342, reg. 3(2)