Statistics and Registration Service Act 2007

39Confidentiality of personal informationU.K.

(1)Subject to this section, personal information held by the Board in relation to the exercise of any of its functions must not be disclosed by—

(a)any member or employee of the Board,

(b)a member of any committee of the Board, or

(c)any other person who has received it directly or indirectly from the Board.

(2)In this Part “personal information” means information which relates to and identifies a particular person (including a body corporate); but it does not include information about the internal administrative arrangements of the Board (whether relating to its members, employees or other persons).

(3)For the purposes of subsection (2) information identifies a particular person if the identity of that person—

(a)is specified in the information,

(b)can be deduced from the information, or

(c)can be deduced from the information taken together with any other published information.

(4)Subsection (1) does not apply to a disclosure which—

(a)is required or permitted by any enactment,

(b)is required by [F1an assimilated] obligation,

(c)is necessary for the purpose of enabling or assisting the Board to exercise any of its functions,

(d)has already lawfully been made available to the public,

(e)is made in pursuance of an order of a court,

(f)is made for the purposes of a criminal investigation or criminal proceedings (whether or not in the United Kingdom),

F2(g). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(h)is made with the consent of the person to whom it relates, or

(i)is made to an approved researcher.

(5)For the purposes of subsection (4)(i), “approved researcher” means an individual to whom the Board has granted access, for the purposes of statistical research, to personal information held by it.

(6)The Board is from time to time to publish criteria by reference to which it will determine whether to grant access as specified in subsection (5).

(7)Those criteria must require the Board to consider—

(a)whether the individual is a fit and proper person, and

(b)the purpose for which access is requested.

(8)The Board may not grant access to an individual as specified in subsection (5) unless he has first signed a declaration, in such form as the Board may determine, that he understands the requirements of this section.

(9)A person who contravenes subsection (1) is guilty of an offence and liable—

(a)on conviction on indictment, to imprisonment for a term not exceeding two years, or to a fine, or both;

(b)on summary conviction, to imprisonment for a term not exceeding twelve months, or to a fine not exceeding the statutory maximum, or both.

[F3(9A)In the application of this section in England and Wales the reference in subsection (9)(b) is to be read as a reference to the general limit in a magistrates’ court (but this is subject to subsection (11)).]

(10)Subsection (9) does not apply where the individual making the disclosure reasonably believes—

(a)in the case of information which is personal information by virtue of subsection (3)(a), that the identity of the person to whom it relates is not specified in the information,

(b)in the case of information which is personal information by virtue of subsection (3)(b), that the identity of that person cannot be deduced from the information, or

(c)in the case of information which is personal information by virtue of subsection (3)(c), that the identity of that person cannot be deduced from the information taken together with any other published information.

(11)In the application of this section —

(a)in England and Wales, in relation to an offence committed before [F42 May 2022],

(b)in Scotland, until the commencement of section 45(1) of the Criminal Proceedings etc. (Reform) (Scotland) Act 2007 (asp 6), or

(c)in Northern Ireland,

the reference in subsection (9)(b) to twelve months is to be read as a reference to three months.