31.—(1) Personal data provided to the Board by an applicant, or disclosed pursuant to a notice under regulation 29, may not be disclosed—
(a)by the Board, or
(b)by any other person who has received it directly or indirectly from the Board.
(2) In the case of personal data which is not HMRC information or social security information, paragraph (1) does not apply to a disclosure—
(a)which is required or permitted by any enactment (including these Regulations);
(b)which is required by a retained EU obligation;
(c)which is made in pursuance of an order of the court;
(d)of information which has already lawfully been made available to the public;
(e)which is made for the prevention or detection of crime;
(f)which is made for the purposes of a criminal investigation,
(g)which is made for the purposes of legal proceedings (whether civil or criminal);
(h)which is a protected disclosure for any of the purposes of the Employment Rights Act 1996 M1 or the Employment Rights (Northern Ireland) Order 1996) M2;
(i)consisting of the publication of information for the purposes of journalism, where the publication of the information is in the public interest;
(j)which is made with the consent of the person to whom it relates, or
(k)which is made for the purposes of—
(i)preventing serious physical harm to a person;
(ii)preventing loss of human life;
(iii)safeguarding vulnerable adults or children;
(iv)responding to an emergency, or
(v)protecting national security.
(3) In the case of HMRC information or social security information, paragraph (1) does not apply to a disclosure made with the consent of the relevant authority.
(4) The duty imposed by paragraph (1) is enforceable by civil proceedings by the President of the Board for an injunction or any other appropriate relief.
(5) In this regulation “HMRC information”, “social security information” and “the relevant authority” have the same meaning as in regulation 31.
Commencement Information
I1Reg. 31 in force at 29.5.2020, see reg. 1(3)
Marginal Citations