Health and Social Care Act 2008

Information

76 Disclosure of confidential personal information: offence

(1) This section applies to information which—

(a) has been obtained by the Commission on terms or in circumstances requiring it to be held in confidence, and

(b) relates to and identifies an individual.

(2) A person is guilty of an offence if the person knowingly or recklessly discloses information to which this section applies during the lifetime of the individual.

(3) A person guilty of an offence under this section is liable—

(a) on summary conviction, to imprisonment for a term not exceeding 12 months, or to a fine not exceeding the statutory maximum, or to both;

(b) on conviction on indictment, to imprisonment for a term not exceeding two years, or to a fine, or to both.

(4) In relation to an offence committed before the commencement of section 154(1) of the Criminal Justice Act 2003 (c. 44), the reference in subsection (3)(a) to 12 months is to be read as a reference to 6 months.

(5) For the purposes of subsection (1)(b), information obtained by the Commission is to be treated as identifying an individual if the individual can be identified from a combination of—

(a) that information, and

(b) other information obtained by the Commission.

(6) Reference in this section and in sections 77 to 80 to information obtained or disclosed by the Commission includes information obtained or disclosed by a person authorised by the Commission.

77 Defence

(1) It is a defence for a person charged with an offence under section 76 to prove that at the time of the alleged offence—

(a) any of the circumstances in subsection (2) applied in relation to the disclosure, or

(b) the person reasonably believed that any of them so applied.

(2) The circumstances are—

(a) that the disclosure was made in a form in which the individual to whom the information relates is not identified;

(b) that the disclosure was made with the consent of that individual;

(c) that the information disclosed had previously been lawfully disclosed to the public;

(d) that the disclosure was made under or pursuant to regulations under section 113 or 114 of the Health and Social Care (Community Health and Standards) Act 2003 (c. 43) (complaints about health care or social services);

(e) that the disclosure was made in accordance with any enactment or court order;

(f) that the disclosure was necessary or expedient for the purposes of protecting the welfare of any individual;

(g) that the disclosure was made to any person or body in circumstances where it was necessary or expedient for the person or body to have the information for the purpose of exercising functions of that person or body under any enactment.

(3) It is also a defence for a person charged with an offence under section 76 to prove that the disclosure was made—

(a) for the purpose of facilitating the exercise of any of the Commission’s functions,

(b) in connection with the investigation of a criminal offence (whether or not in the United Kingdom), or

(c) for the purpose of criminal proceedings (whether or not in the United Kingdom).

(4) If a person charged with an offence under section 76 relies on a defence in subsection (1) or (3), and evidence is adduced which is sufficient to raise an issue with respect to that defence, the court must assume that the defence is satisfied unless the prosecution proves beyond reasonable doubt that it is not.

(5) For the purposes of subsection (2)(a), information disclosed by a person is to be treated as being in a form in which an individual is identified if the individual can be identified from a combination of—

(a) the information, and

(b) other information disclosed by the person or by the Commission.

78 Use of information etc.

Information obtained by, or documents or records produced to, the Commission in connection with any of its functions may be used by the Commission in connection with any of its other functions.

79 Permitted disclosures

(1) Subsections (2) and (3) apply to any information obtained by the Commission in the course of exercising any of its functions.

(2) In the case of information relating to an individual, the Commission may disclose the information if—

(a) the disclosure is made in a form in which the individual is not identified, or

(b) the disclosure is made with the consent of the individual.

(3) In all cases (whether or not relating to an individual), the Commission may disclose the information if—

(a) the information has previously been lawfully disclosed to the public,

(b) the disclosure is made under or pursuant to regulations under section 113 or 114 of the Health and Social Care (Community Health and Standards) Act 2003 (c. 43) (complaints about health care or social services),

(c) the disclosure is made in accordance with any enactment or court order,

(d) the disclosure is necessary or expedient for the purposes of protecting the welfare of any individual,

(e) the disclosure is made to any person or body in circumstances where it is necessary or expedient for the person or body to have the information for the purpose of exercising functions of that person or body under any enactment,

(f) the disclosure is made for the purpose of facilitating the exercise of any of the Commission’s functions,

(g) the disclosure is made in connection with the investigation of a criminal offence (whether or not in the United Kingdom), or

(h) the disclosure is made for the purpose of criminal proceedings (whether or not in the United Kingdom).

(4) Subsections (2) and (3) have effect notwithstanding any rule of common law which would otherwise prohibit or restrict the disclosure.

(5) For the purposes of subsection (2)(a), information disclosed by the Commission is to be treated as being in a form in which an individual is identified if the individual can be identified from a combination of—

(a) the information, and

(b) other information disclosed by the Commission.

80 Code of practice on confidential personal information

(1) The Commission must prepare and publish a code in respect of the practice it proposes to follow in relation to confidential personal information.

(2) The code must in particular make provision—

(a) about the obtaining by the Commission of information which, once obtained, will be confidential personal information, and

(b) about the handling, use and disclosure by the Commission of confidential personal information.

(3) Before publishing the code, the Commission must consult—

(a) the National Information Governance Board for Health and Social Care, and

(b) such other persons as it considers appropriate.

(4) The Commission must keep the code under review and, if it considers it appropriate, from time to time publish a revised code (and references in this section to the code include any revised code).

(5) In this section “confidential personal information” means information which—

(a) is obtained by the Commission on terms or in circumstances requiring it to be held in confidence, and

(b) relates to and identifies an individual.

(6) For the purposes of subsection (5)(b), information obtained by the Commission is to be treated as identifying an individual if the individual can be identified from a combination of—

(a) the information, and

(b) other information obtained by the Commission.