The Identity Cards Act 2006 (Provision of Information without Consent) Regulations 2009

EXPLANATORY NOTE

(This note is not part of the Regulations)

Section 17(1) of the Identity Cards Act 2006 (“the 2006 Act”) provides that Secretary of State may, without the individual’s consent, provide a person with information recorded in an individual’s entry in the Register if—

(a) the provision of the information is authorised by this section; and

(b) there is compliance with any requirements imposed by or under section 21 of the 2006 Act in relation to the provision of the information.

Section 17(5) of the 2006 Act provides that the provision of information not falling within paragraph 9 of Schedule 1 to the 2006 Act (records of provision of information) is authorised by this section, where the information is provided to a prescribed government department or to a prescribed Northern Ireland department for purposes connected with the carrying out of any prescribed functions of that department or Minister in charge of it.

Regulation 2 prescribes such departments and functions in respect of those departments for the purposes of section 17(5) of the 2006 Act.

Regulation 3 provides that information that may be provided to a person (P) under any of sections 17 to 20 of the 2006 Act may be provided instead to another person who—

(c) is authorised by P to be the recipient of information provided under that section;

(d) holds the rank or position which is specified in paragraph (3) or (4) in respect of that person; and

(e) is under the direction or control of P, or is otherwise answerable or subordinate to P, in respect of any of that other person’s duties as a person holding that rank or position.

Regulation 4 provides that it is a condition of providing information to a person under any of sections 17 to 20 of the 2006 Act that that person (where not specified in those sections) is approved by the Secretary of State in writing.

Regulation 5 imposes requirements that must be satisfied before information is provided under any of sections 17 to 20 of the 2006 Act. These are that the Secretary of State must be satisfied (a) that the relevant person specified in sections 17 to 20 of that Act must carry out the activities set out in paragraph (3) and (b) that the data controller who receives the information under any of those sections must comply with the Data Protection Act 1988 when processing any of the information which constitutes personal data.