[F1Data matchingN.I.

Disclosure of results of data matching etc N.I.

4D—(1) This Article applies to the following information—

(a)information relating to a particular body or person obtained by or on behalf of the Comptroller and Auditor General for the purpose of conducting a data matching exercise;

(b)the results of any such exercise.

(2) Information to which this Article applies may be disclosed by or on behalf of the Comptroller and Auditor General if the disclosure is—

(a)for or in connection with a purpose for which the data matching exercise is conducted;

(b)to a body [F2or person] mentioned in paragraph (3) (or a related party) for or in connection with a function of that body [F2or person] corresponding or similar to the audit functions of the Comptroller and Auditor General or a local government auditor under any statutory provision or the data matching functions of the Comptroller and Auditor General under Article 4A; or

(c)in pursuance of a duty imposed by or under a statutory provision.

(3) The bodies [F3and persons] are—

[F4(a)the Secretary of State,

(aa)the Minister for the Cabinet Office,

(ab)a local auditor within the meaning of the Local Audit and Accountability Act 2014,]

(b)the Auditor General for Wales;

(c)the Auditor General for Scotland;

(d)the Accounts Commission for Scotland;

(e)Audit Scotland.

(4)  “ Related party ”, in relation to a body [F5 or person ] mentioned in paragraph (3), means—

(a)a body or person acting on its behalf;

(b)a body whose accounts are required to be audited by it or by a person appointed by it;

(c)a person appointed by it to audit those accounts.

(5) If the data used for a data matching exercise include patient data—

(a) paragraph (2)(a) applies only so far as the purpose for which the disclosure is made relates to a relevant NHS body;

(b)paragraph (2)(b) applies only so far as the function for or in connection with which the disclosure is made relates to such a body.

(6) In paragraph (5)—

(a) “ patient data ” has the same meaning as in Article 4C;

(b) “ relevant NHS body ” means—

[F6(i)a health and social care body mentioned in paragraphs (a) to (e) of section 1(5) of the Health and Social Care (Reform) Act (Northern Ireland) 2009;]

[F7(ii) a body mentioned in paragraph (a), (b) or (c) of paragraph 4(12) of Schedule 9 to the Local Audit and Accountability Act 2014 (“relevant NHS body”); ]

(iii) a Welsh NHS body as defined in section 60 of the Public Audit (Wales) Act 2004 (c. 23);

(iv) an NHS body as defined in section 22(1) of the Community Care and Health (Scotland) Act 2002 (asp 5).

(7) Information disclosed under paragraph (2) may not be further disclosed except—

(a)for or in connection with the purpose for which it was disclosed under sub-paragraph (a) or the function for which it was disclosed under sub-paragraph (b) of that paragraph;

(b)for the investigation or prosecution of an offence (so far as the disclosure does not fall within sub-paragraph (a)); or

(c)in pursuance of a duty imposed by or under a statutory provision.

(8) Except as authorised by paragraphs (2) and (7), a person who discloses information to which this Article applies is guilty of an offence and liable—

(a)on conviction on indictment, to imprisonment for a term not exceeding two years, to a fine or to both; or

(b)on summary conviction, to imprisonment for a term not exceeding 6 months, to a fine not exceeding the statutory maximum or to both.

(9)  Article 27 of the Local Government (Northern Ireland) Order 2005 ( NI 18) does not apply to information to which this Article applies.

(10)  In this Article “ body ” includes office. ]