Digital Economy Act 2017

41 Confidentiality of personal information

(1) Personal information disclosed under any of sections 35 to 39 and received by a person (“P”) may not be disclosed—

(a) by P, or

(b) by any other person who has received it directly or indirectly from P.

(2) Subsection (1) does not apply to a disclosure—

(a) which is required or permitted by any enactment (including any of sections 35 to 39),

(b) which is required by an EU obligation,

(c) which is made in pursuance of an order of the court,

(d) of information which has already lawfully been made available to the public,

(e) which is made for the prevention or detection of crime or the prevention of anti-social behaviour,

(f) which is made for the purposes of a criminal investigation,

(g) which is made for the purposes of legal proceedings (whether civil or criminal),

(h) which is a protected disclosure for any of the purposes of the Employment Rights Act 1996 or the Employment Rights (Northern Ireland) Order 1996 (SI 1996/1919 (NI 16)),

(i) consisting of the publication of information for the purposes of journalism, where the publication of the information is in the public interest,

(j) which is made with the consent of the person to whom it relates, or

(k) which is made for the purposes of—

(i) preventing serious physical harm to a person,

(ii) preventing loss of human life,

(iii) safeguarding vulnerable adults or children,

(iv) responding to an emergency, or

(v) protecting national security.

(3) In subsection (2)(e) “anti-social behaviour” means conduct that—

(a) is likely to cause harassment, alarm or distress to any person, or

(b) is capable of causing nuisance or annoyance to a person in relation to that person’s occupation of residential premises.

(4) A person commits an offence if—

(a) the person discloses personal information in contravention of subsection (1), and

(b) at the time that the person makes the disclosure, the person knows that the disclosure contravenes that subsection or is reckless as to whether the disclosure does so.

(5) A person who is guilty of an offence under subsection (4) is liable on conviction on indictment to imprisonment for a term not exceeding two years, to a fine or to both.

(6) A person who is guilty of an offence under subsection (4) is liable on summary conviction—

(a) in England and Wales, to imprisonment for a term not exceeding 12 months, to a fine or to both;

(b) in Scotland, to imprisonment for a term not exceeding 12 months, to a fine not exceeding the statutory maximum or to both;

(c) in Northern Ireland, to imprisonment for a term not exceeding 6 months, to a fine not exceeding the statutory maximum or to both.

(7) In the application of subsection (6)(a) to an offence committed before the coming into force of section 154(1) of the Criminal Justice Act 2003 the reference to 12 months is to be read as a reference to 6 months.

(8) This section does not apply to personal information disclosed under section 35, 36 or 38 by the Revenue and Customs.