(1)Any information obtained by the Board in relation to the exercise of any of its functions may be used by it in relation to the exercise of any of its other functions.
(2)Subsection (1) does not apply to information obtained by the Board in relation to the exercise of its functions under sections 12(1) and 14(1).
(3)Subsection (1) does not apply to information obtained by the Board in relation to the exercise of its functions under section 22, unless the person from whom the Board receives the information consents to its use as specified in that subsection.
(4)Subsection (1) is subject to any enactment which restricts or prohibits the use or disclosure of information.
(1)Subject to this section, personal information held by the Board in relation to the exercise of any of its functions must not be disclosed by—
(a)any member or employee of the Board,
(b)a member of any committee of the Board, or
(c)any other person who has received it directly or indirectly from the Board.
(2)In this Part “personal information” means information which relates to and identifies a particular person (including a body corporate); but it does not include information about the internal administrative arrangements of the Board (whether relating to its members, employees or other persons).
(3)For the purposes of subsection (2) information identifies a particular person if the identity of that person—
(a)is specified in the information,
(b)can be deduced from the information, or
(c)can be deduced from the information taken together with any other published information.
(4)Subsection (1) does not apply to a disclosure which—
(a)is required or permitted by any enactment,
(b)is required by a Community obligation,
(c)is necessary for the purpose of enabling or assisting the Board to exercise any of its functions,
(d)has already lawfully been made available to the public,
(e)is made in pursuance of an order of a court,
(f)is made for the purposes of a criminal investigation or criminal proceedings (whether or not in the United Kingdom),
(g)is made, in the interests of national security, to an Intelligence Service,
(h)is made with the consent of the person to whom it relates, or
(i)is made to an approved researcher.
(5)For the purposes of subsection (4)(i), “approved researcher” means an individual to whom the Board has granted access, for the purposes of statistical research, to personal information held by it.
(6)The Board is from time to time to publish criteria by reference to which it will determine whether to grant access as specified in subsection (5).
(7)Those criteria must require the Board to consider—
(a)whether the individual is a fit and proper person, and
(b)the purpose for which access is requested.
(8)The Board may not grant access to an individual as specified in subsection (5) unless he has first signed a declaration, in such form as the Board may determine, that he understands the requirements of this section.
(9)A person who contravenes subsection (1) is guilty of an offence and liable—
(a)on conviction on indictment, to imprisonment for a term not exceeding two years, or to a fine, or both;
(b)on summary conviction, to imprisonment for a term not exceeding twelve months, or to a fine not exceeding the statutory maximum, or both.
(10)Subsection (9) does not apply where the individual making the disclosure reasonably believes—
(a)in the case of information which is personal information by virtue of subsection (3)(a), that the identity of the person to whom it relates is not specified in the information,
(b)in the case of information which is personal information by virtue of subsection (3)(b), that the identity of that person cannot be deduced from the information, or
(c)in the case of information which is personal information by virtue of subsection (3)(c), that the identity of that person cannot be deduced from the information taken together with any other published information.
(11)In the application of this section —
(a)in England and Wales, in relation to an offence committed before the commencement of section 154(1) of the Criminal Justice Act 2003 (c. 44),
(b)in Scotland, until the commencement of section 45(1) of the Criminal Proceedings etc. (Reform) (Scotland) Act 2007 (asp 6), or
(c)in Northern Ireland,
the reference in subsection (9)(b) to twelve months is to be read as a reference to three months.
(1)Section 44 of the Freedom of Information Act 2000 (c. 36) (prohibitions on disclosure) does not, by virtue of section 39 above, apply to personal information which—
(a)is held by a public authority who has received it directly or indirectly from the Board, and
(b)is not held by that authority on behalf of the Board.
(2)In subsection (1) “public authority” has the same meaning as in the Freedom of Information Act 2000.
(3)Section 26 of the Freedom of Information (Scotland) Act 2002 (asp 13) (prohibitions on disclosure) does not, by virtue of section 39 above, apply to personal information which—
(a)is held by a Scottish public authority who has received it directly or indirectly from the Board, and
(b)is not held by that authority on behalf of the Board.
(4)In subsection (3) “Scottish public authority” has the same meaning as in the Freedom of Information (Scotland) Act 2002.
The Board may disclose any information obtained by it in connection with any function exercised by it to any person providing services to the Board, if the Board considers it necessary or appropriate to do so for the purpose of the provision of those services.