Section 39 Confidentiality of personal information
157.This section specifies that personal information (as described in subsections (2) and (3)), whether held by the Board or disclosed by the Board to others, is confidential.
158.Subsection (1) states that personal information held by the Board should not be disclosed by anyone, whether a member of the Board (or one of its committees), an employee of the Board or anyone who has received it from the Board (directly or indirectly). Subsection (9) makes such disclosure a criminal offence, punishable by a fine or imprisonment. This is a similar penalty to that provided for unlawful disclosure of HM Revenue and Customs (HMRC) information in the Commissioners for Revenue and Customs Act 2005.
159.Subsection (2) explains that ‘personal information’ is information that relates to and identifies a particular person. This would include information that could identify a business, even where that business had since changed form due to a merger. The meaning of personal information does not include administrative information held by the Board, such as records relating to the Board’s employees (which may, however, be protected under the Data Protection Act 1998).
160.Subsection (3) provides that information falls within the definition of ‘personal information’ at subsection (2) if the information in question either specifies the identity of the person, or could allow it to be deduced.
161.Subsection (4) lists the categories of disclosure that are not restricted by the confidentiality obligation in subsection (1):
paragraph (a), where other legislation explicitly requires or permits disclosure of personal information. For example section 58(4) of the Finance Act 1969 permits the Board to disclose certain information it has received from HMRC to another department for the purpose of a statistical survey;
paragraph (b), where a European Community obligation requires disclosure, for example Council Regulation EC 184/2005 concerning balance of payments, international trade in services and foreign direct investment, requires submission and transmission of information, including confidential information, to the Community authority (Eurostat);
paragraph (c), where it is necessary for the purpose of enabling or assisting the Board to exercise any of its functions, for example the Board’s function in section 5 of the Census Act 1920 of preparing statistics in respect of periods between one census and another;
paragraph (d), where information has already been lawfully made public;
paragraph (e), where information is disclosed following a court order;
paragraph (f), where information is disclosed as part of a criminal investigation or proceedings;
paragraph (g), where information is disclosed to the Intelligence Services – as defined in section 67 – in the interests of national security; and
paragraph (h), where the person to whom the personal information relates has consented to disclosure. For example, where the Board conducts a voluntary survey, which contains a confidentiality pledge that makes clear to the respondent how the information they provide will be used, and setting out any onward disclosures that might be made, for example to other government departments for statistical purposes. In such cases, by returning the survey, the respondent consents to the terms of the confidentiality pledge and to the disclosure of information for statistical purposes in the way described.
162.Subsection (4)(i) states that the confidentiality obligation does not apply where the Board discloses information to an ‘approved researcher’. Subsection (5) sets out that the term ‘approved researcher’ means an individual to whom the Board has granted access – for the purposes of statistical research – to personal information it holds. The Board may extend access to researchers from various organisations, including academic institutions, public bodies (including both local and regional bodies) and non-governmental organisations.
163.Subsection (6) states that the Board must publish the criteria by which it will decide whether to grant access to approved researchers. As set out in subsection (7), these criteria must require the Board to consider whether the researcher is a fit and proper person and the purpose of the research. Any researcher must also sign a declaration that they understand the confidentiality obligation placed on them (subsection (8)).
164.The combination of this section and section 23 (on statistical research) is intended to replicate the access ONS provided to researchers and academics (seconded into ONS), usually through a secure environment physically located in ONS. Researchers were not generally allowed to take information away from ONS and were required to sign strict confidentiality agreements.
165.Subsection (9) provides that anyone who contravenes subsection (1) shall be guilty of a criminal offence. Subsection (10) sets out that the offence in subsection (9) does not apply where the individual making the disclosure reasonably believes that the identity of the person to whom the information relates is not specified in the information, could not be deduced from it (taken on its own or with any other published information (subsection (10)).
