267.Section 76 makes it a criminal offence for any person, including a member or employee of the Commission, knowingly or recklessly to disclose confidential information which has been obtained by the Commission and which identifies an individual, during the lifetime of the individual. The penalty on summary conviction is imprisonment of up to 12 months, or a fine not exceeding the statutory maximum, or both. The penalty on conviction on indictment is imprisonment of up to 2 years, or an unlimited fine, or both. The section applies to all of the Commission’s functions, whereas under the existing law a similar provision only applies to CHAI as the regulator of health services.
268.Subsections (1) to (3) of section 77 set out defences to a charge under section 76. It is a defence to prove that any of the circumstances listed in subsection (2) (for example, that the form of disclosure meant that the individual was not identified or the individual concerned had given their consent to the information being made available) applied or that the person charged reasonably believed they applied. It is also a defence to prove that the disclosure was made for a purpose in subsection (3), for example, in connection with a criminal investigation. Subsection (4) requires that, where someone offers one of these defences in response to a charge brought under section 76 and evidence is adduced which is sufficient to raise an issue with respect to the defence, the defence is to be regarded as satisfied unless the prosecution proves beyond reasonable doubt that it is not.
269.Section 78 provides that the Commission may use information, documents or records obtained or produced in carrying out any of its functions for any of its other functions (subject to the limitations in relation to the disclosure of confidential personal information under section 76).
270.The Commission may disclose any information it obtains in the course of carrying out its functions where any of the circumstances set out in subsection (3) apply (for example, where the information has already been lawfully disclosed to the public, or where the disclosure is necessary to protect the welfare of any individual). Where none of those circumstances applies, the Commission may disclose information that relates to an individual if that individual has consented to the disclosure, or the form of disclosure means that the individual is not identified.
271.Section 80 places the Commission under a statutory duty to publish a code of practice in relation to how it will obtain, use, handle and disclose confidential personal information (defined as information which is obtained by the Commission in confidence and which identifies an individual). The Commission must consult the National Information Governance Board and anyone else it considers appropriate before publishing a code under this section.