Digital Economy Act 2017

CHAPTER 7 U.K. Statistics

78 Disclosure of information by the Revenue and Customs to the Statistics Board U.K.

(1) Section 45 of the Statistics and Registration Service Act 2007 (disclosure of HMRC information to the Statistics Board) is amended as follows.

(2) In subsection (2) omit “, other than its function under section 22 (statistical services)”.

(3) After subsection (2) insert—

“(2A) In determining whether the condition in subsection (2) is met the Commissioners must have regard to any views of the Board which have been communicated to them.”

(4) In subsection (3) omit “, other than its function under section 22”.

(5) After that subsection insert—

“(3A) Information disclosed under subsection (1) may not be used by the Board for the purposes of its function under section 22 (statistical services) except with the consent of the Commissioners.”

(6) After subsection (4) insert—

“(4A) In disclosing information under subsection (1), the Commissioners or an officer of Revenue and Customs must have regard to the following codes of practice issued by the Information Commissioner under section 51(3) of the Data Protection Act 1998, so far as they apply to the information in question—

(a) any code which makes provision about the identification and reduction of the risks to privacy of a proposal to disclose information;

(b) any code which makes provision about the information to be provided to data subjects (within the meaning of that Act) about the use to be made of information collected from them.

(4B) The duty in subsection (4A) to have regard to a code of practice does not affect any other requirement for the Commissioners or an officer of Revenue and Customs to have regard to a code of practice under the Data Protection Act 1998 in disclosing the information.

(4C) In determining how to comply with the duty in subsection (4A) the Commissioners or the officer of Revenue and Customs must have regard to any views of the Board which are communicated to the Commissioners or the officer.”

(7) Omit subsection (5) (which prevents the disclosure of personal information not relating to imports or exports).

Commencement Information

I1 S. 78 in force at 31.7.2017 by S.I. 2017/765, reg. 2(t)

79 Disclosure of information by public authorities to the Statistics Board U.K.

(1) The Statistics and Registration Service Act 2007 is amended as follows.

(2) After section 45 insert—

“45A Information held by other public authorities

(1) A public authority to which this section applies may, subject to this section, disclose to the Board any information held by the authority in connection with its functions.

(2) This section applies to a public authority other than—

(a) the Commissioners for Her Majesty's Revenue and Customs, or

(b) an officer of Revenue and Customs.

(3) A public authority may disclose information under subsection (1) only if it is satisfied that the Board requires the information to enable it to exercise one or more of its functions.

(4) In determining whether the condition in subsection (3) is met the public authority must have regard to any views of the Board which have been communicated to the authority.

(5) Information disclosed under subsection (1) may only be used by the Board for the purposes of any one or more of its functions.

(6) Information disclosed under subsection (1) may not be used by the Board for the purposes of its function under section 22 (statistical services) except with the consent of the public authority which disclosed the information.

(7) Where personal information is disclosed by a public authority to the Board under subsection (1), the Board may not disclose the information to an approved researcher under section 39(4)(i) except with the consent of the public authority.

(8) In disclosing information under subsection (1), a public authority must have regard to the following codes of practice issued by the Information Commissioner under section 51(3) of the Data Protection Act 1998, so far as they apply to the information in question—

(a) any code which makes provision about the identification and reduction of the risks to privacy of a proposal to disclose information;

(b) any code which makes provision about the information to be provided to data subjects (within the meaning of that Act) about the use to be made of information collected from them.

(9) The duty in subsection (8) to have regard to a code of practice does not affect any other requirement for the public authority to have regard to a code of practice under the Data Protection Act 1998 in disclosing the information.

(10) In determining how to comply with the duty in subsection (8) the public authority must have regard to any views of the Board which are communicated to the authority.

(11) A disclosure under subsection (1) does not breach—

(a) any obligation of confidence owed by the public authority making the disclosure, or

(b) any other restriction on the disclosure of information (however imposed).

(12) But subsection (1) does not authorise the making of a disclosure which—

(a) contravenes the Data Protection Act 1998,

(b) is prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016, or

(c) contravenes directly applicable EU legislation or any enactment to the extent that it implements EU legislation.

(13) Until the repeal of Part 1 of the Regulation of Investigatory Powers Act 2000 by paragraphs 45 and 54 of Schedule 10 to the Investigatory Powers Act 2016 is fully in force, subsection (12)(b) has effect as if it included a reference to that Part.

(14) This section does not limit the circumstances in which information may be disclosed apart from this section.”

(3) Omit—

(a) section 47 (power to authorise disclosure to the Board);

(b) section 48 (power to authorise disclosure to the Board: Scotland);

(c) section 49 (power to authorise disclosure to the Board: Northern Ireland).

(4) In section 54 (Data Protection Act 1998 and Human Rights Act 1998) for “47” substitute “ 50 ”.

(5) In section 65 (orders and regulations)—

(a) in subsection (4) omit “47(11),”,

(b) in subsection (5)(b) omit “47,”,

(c) in subsection (6)(b) omit “48 or”, and

(d) in subsection (9)(c) omit “49 or”.

(6) In section 67 (general interpretation) for the definition of “enactment” substitute—

““enactment” includes—

(a) an enactment contained in subordinate legislation within the meaning of the Interpretation Act 1978;

(b) an enactment contained in, or in an instrument made under, an Act of the Scottish Parliament;

(c) an enactment contained in, or in an instrument made under, a Measure or Act of the National Assembly for Wales;

(d) an enactment contained in, or in an instrument made under, Northern Ireland legislation;”.

Commencement Information

I2 S. 79(1)(2)(4)-(6) in force at 31.7.2017 for E.W.S. by S.I. 2017/765, reg. 2(u)

I3 S. 79(1)(2)(4)-(6) in force at 1.5.2018 in so far as not already in force by S.I. 2018/382, reg. 3(kk)

I4 S. 79(3) in force at 1.5.2018 by S.I. 2018/382, reg. 3(kk)

80 Access to information by the Statistics Board U.K.

After section 45A of the Statistics and Registration Service Act 2007 (inserted by section 79) insert—

“45B Access to information held by Crown bodies etc

(1) This section applies to—

(a) a public authority which is an emanation of the Crown or a servant or agent of the Crown,

(b) the Bank of England (including in the exercise of its functions as the Prudential Regulation Authority),

(c) a subsidiary undertaking of the Bank of England within the meaning of the Companies Acts (see sections 1161 and 1162 of the Companies Act 2006),

(d) the Financial Conduct Authority, and

(e) the Payment Systems Regulator established under section 40 of the Financial Services (Banking Reform) Act 2013.

(2) Subject to this section and section 45E, the Board has a right of access to information which—

(a) is held by a public authority to which this section applies in connection with its functions, and

(b) is required by the Board to enable it to exercise one or more of its functions.

(3) Subsection (2) does not apply to information if the disclosure of that information—

(a) would contravene the Data Protection Act 1998,

(b) would be prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016, or

(c) would contravene directly applicable EU legislation or any enactment to the extent that it implements EU legislation.

(4) Until the repeal of Part 1 of the Regulation of Investigatory Powers Act 2000 by paragraphs 45 and 54 of Schedule 10 to the Investigatory Powers Act 2016 is fully in force, subsection (3)(b) has effect as if it included a reference to that Part.

(5) The right of access in subsection (2) is to be exercised in accordance with the following provisions of this section.

(6) The Board may, by notice in writing to the public authority, request the authority to disclose the information to the Board.

(7) A notice under subsection (6) must—

(a) set out the Board's reasons for requesting the information to be disclosed, and

(b) specify the date by which or the period within which the public authority must respond to the request.

(8) The public authority must, by that date or within that period, provide a response in writing to the Board which—

(a) indicates that it is willing to provide the information and gives the date by which it will be provided, or

(b) indicates that it is not willing to provide the information and gives reasons for not providing it.

(9) Subsection (10) applies if—

(a) the public authority fails to respond to the request in accordance with subsection (8),

(b) the public authority indicates that it is not willing to provide the information requested, or

(c) the public authority has indicated that it is willing to provide the information requested, but the Board considers that the public authority is failing to take reasonable steps to comply with that request.

(10) The Board may lay the request and any response by the public authority before the relevant legislature.

(11) In subsection (10) “the relevant legislature” means Parliament, subject as follows.

(12) The Scottish Parliament is the relevant legislature if the public authority—

(a) is a part of the Scottish Administration, or

(b) is a Scottish public authority with mixed functions or no reserved functions (within the meaning of the Scotland Act 1998).

(13) The National Assembly for Wales is the relevant legislature if the public authority is a devolved Welsh authority as defined by section 157A of the Government of Wales Act 2006.

(14) The Northern Ireland Assembly is the relevant legislature if—

(a) the public authority exercises functions only as regards Northern Ireland, and

(b) its functions are wholly or mainly functions which relate to transferred matters (within the meaning of the Northern Ireland Act 1998).

(15) This section does not apply to—

(a) Her Majesty in Her private capacity,

(b) Her Majesty in right of the Duchy of Lancaster, or

(c) the Duke of Cornwall.

(16) Until the coming into force of section 12 of the Bank of England and Financial Services Act 2016 subsection (1)(b) has effect as if the words in brackets were omitted.

45C Power to require disclosures by other public authorities

(1) This section applies to a public authority to which section 45B does not apply (other than one within subsection (15) of that section).

(2) Subject to this section and section 45E, the Board may, by notice in writing to a public authority to which this section applies, require the authority to disclose to the Board information which—

(a) is held by the authority in connection with its functions, and

(b) is specified, or is of a kind specified, in the notice.

(3) A notice under subsection (2) may require information to be disclosed on more than one date specified in the notice within a period specified in the notice.

(4) A notice under subsection (2) other than one within subsection (3) must specify the date by which or the period within which the information must be disclosed.

(5) A notice under subsection (2) may specify the form or manner in which the information to which it relates must be disclosed.

(6) A notice under subsection (2) may require the public authority to consult the Board before making changes to—

(a) its processes for collecting, organising, storing or retrieving the information to which the notice relates, or

(b) its processes for supplying such information to the Board.

(7) The reference in subsection (6) to making changes to a process includes introducing or removing a process.

(8) The Board may give a notice under subsection (2) only if the Board requires the information to which the notice relates to enable it to exercise one or more of its functions.

(9) The Board must obtain the consent of the Scottish Ministers before giving a notice under subsection (2) to a public authority which is a Scottish public authority with mixed functions or no reserved functions (within the meaning of the Scotland Act 1998).

(10) The Board must obtain the consent of the Welsh Ministers before giving a notice under subsection (2) to a public authority which is a devolved Welsh authority as defined by section 157A of the Government of Wales Act 2006.

(11) The Board must obtain the consent of the Department of Finance in Northern Ireland before giving a notice under subsection (2) to a public authority if—

(a) the public authority exercises functions only as regards Northern Ireland, and

(b) its functions are wholly or mainly functions which relate to transferred matters (within the meaning of the Northern Ireland Act 1998).

(12) A public authority to which a notice under subsection (2) is given must comply with it.

(13) But the public authority need not comply with the notice if compliance—

(a) might prejudice national security,

(b) would contravene the Data Protection Act 1998,

(c) would be prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016, or

(d) would contravene directly applicable EU legislation or any enactment to the extent that it implements EU legislation.

(14) Until the repeal of Part 1 of the Regulation of Investigatory Powers Act 2000 by paragraphs 45 and 54 of Schedule 10 to the Investigatory Powers Act 2016 is fully in force, subsection (13)(c) has effect as if it included a reference to that Part.

45D Power to require disclosure by undertakings

(1) Subject to this section and section 45E, the Board may, by notice in writing to an undertaking, require the undertaking to disclose to the Board information which—

(a) is held by the undertaking, and

(b) is specified, or is of a kind specified, in the notice.

(2) A notice under subsection (1) may require information to be disclosed on more than one date specified in the notice within a period specified in the notice.

(3) A notice under subsection (1) other than one within subsection (2) must specify the date by which or the period within which the information must be disclosed.

(4) A notice under subsection (1) may specify the form or manner in which the information to which it relates must be disclosed.

(5) A notice under subsection (1) may require the undertaking to consult the Board before making changes to—

(a) its processes for collecting, organising, storing or retrieving the information to which the notice relates, or

(b) its processes for supplying such information to the Board.

(6) The reference in subsection (5) to making changes to a process includes introducing or removing a process.

(7) The Board may give a notice under subsection (1) only if the Board requires the information to which the notice relates to enable it to exercise one or more of its functions.

(8) An undertaking to which a notice under subsection (1) is given must comply with it.

(9) But the undertaking need not comply with the notice if compliance—

(a) might prejudice national security,

(b) would contravene the Data Protection Act 1998, or

(c) would be prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016.

(10) Until the repeal of Part 1 of the Regulation of Investigatory Powers Act 2000 by paragraphs 45 and 54 of Schedule 10 to the Investigatory Powers Act 2016 is fully in force, subsection (9)(c) has effect as if it included a reference to that Part.

(11) Subject to subsection (13), in this section “undertaking” means—

(a) any person carrying on a trade or business, whether or not with a view to profit, or

(b) any charity.

(12) In subsection (11) “charity” means a body, or the trustees of a trust, established for charitable purposes only.

(13) The following are not undertakings for the purposes of this section—

(a) a public authority;

(b) a micro business;

(c) a small business.

(14) Section 33 of the Small Business, Enterprise and Employment Act 2015 (definitions of small and micro business) and regulations made under that section apply in relation to subsection (13) as they apply in relation to subordinate legislation within subsection (1) of that section.

45E Further provisions about powers in sections 45B, 45C and 45D

(1) Information disclosed under section 45B, 45C or 45D may only be used by the Board for the purposes of any one or more of its functions.

(2) Information disclosed under section 45B, 45C or 45D may not be used by the Board for the purposes of its function under section 22 (statistical services) except with the consent of the person who disclosed the information.

(3) Where personal information is disclosed under section 45B, 45C or 45D, the Board may not disclose the information to an approved researcher under section 39(4)(i) except with the consent of the person who disclosed the information.

(4) A disclosure pursuant to section 45B, 45C or 45D does not breach—

(a) any obligation of confidence owed by the person making the disclosure, or

(b) any other restriction on the disclosure of information (however imposed).

(5) The Board must prepare and publish a statement of—

(a) the principles to which it will have regard in exercising its functions under sections 45B, 45C and 45D, and

(b) the procedures which it will adopt in exercising those functions.

(6) The statement must be consistent with the code of practice issued under section 52B (data-sharing code) of the Data Protection Act 1998 (as altered or replaced from time to time).

(7) The Board may at any time revise the statement and, if it decides to do so, must publish the statement as revised.

(8) In preparing or revising the statement the Board must consult—

(a) the Minister for the Cabinet Office,

(b) the Information Commissioner,

(c) the Scottish Ministers,

(d) the Welsh Ministers,

(e) the Department of Finance in Northern Ireland, and

(f) such other persons as the Board thinks fit.

(9) The fact that this section was not in force when consultation of the kind mentioned in subsection (8) took place is to be disregarded in determining whether there has been compliance with that subsection.

(10) The Board may not publish the original statement under this section unless a draft of the statement has been laid before, and approved by a resolution of, each House of Parliament.

(11) Before publishing a revised statement under this section the Board must lay a draft of the statement as proposed to be published before Parliament.

(12) The Board may not publish the revised statement if, within the 40-day period, either House of Parliament resolves not to approve it.

(13) In subsection (12) “the 40 day period” means—

(a) the period of 40 days beginning with the day on which the draft is laid before Parliament, or

(b) if the draft is not laid before each House on the same day, the period of 40 days beginning with the later of the days on which it is laid before Parliament.

(14) For the purposes of subsection (13) no account is to be taken of any period during which Parliament is dissolved or prorogued or during which both Houses are adjourned for more than four days.

(15) After preparing or revising a statement the Board must lay the statement, or the statement as revised, before—

(a) the Scottish Parliament,

(b) the National Assembly for Wales, and

(c) the Northern Ireland Assembly.

(16) In exercising any of its functions under section 45B, 45C or 45D to require the disclosure of information, the Board must have regard to any code of practice issued by the Information Commissioner under section 51(3) of the Data Protection Act 1998 which makes provision about the identification and reduction of the risks to privacy of a proposal to disclose information, so far as the code applies to the information in question.

(17) The duty in subsection (16) to have regard to a code of practice does not affect any other requirement for the Board to have regard to a code of practice under the Data Protection Act 1998 in exercising the function.

45F Offences relating to notices under section 45C or 45D

(1) A person is guilty of an offence if—

(a) the person is given a notice under section 45C or 45D,

(b) the person is required to comply with the notice,

(c) the person fails to do so, and

(d) the person does not have a reasonable excuse for that failure.

(2) A person is guilty of an offence if, in purporting to comply with a notice under section 45C or 45D, the person—

(a) provides information which is false in a material respect, and

(b) knows that the information is false in that respect or is reckless as to whether it is false in that respect.

(3) A person who is guilty of an offence under subsection (1) or (2) is liable on summary conviction—

(a) in England and Wales, to a fine, and

(b) in Scotland or Northern Ireland, to a fine not exceeding level 5 on the standard scale.

(4) If an offence under this section is committed by a body corporate with the consent or connivance of an officer of the body, the officer, as well as the body, is to be treated as having committed the offence.

(5) In subsection (4) a reference to an officer of a body includes a reference to—

(a) a director, manager or secretary,

(b) a person purporting to act as a director, manager or secretary, and

(c) if the affairs of the body are managed by its members, a member.

(6) Where an offence under this section is committed by a partnership (whether or not a limited partnership) subsection (4) has effect, but as if a reference to an officer of the body were a reference to—

(a) a partner, and

(b) a person purporting to act as a partner.

45G Code of practice on changes to data systems

(1) The Board must prepare, adopt and publish a code of practice containing guidance on the matters to be taken into account by a public authority in making changes to—

(a) its processes for collecting, organising, storing or retrieving information, or

(b) its processes (if any) for supplying information to the Board.

(2) A public authority must have regard to any code of practice under this section in making such changes.

(3) The Board may at any time revise a code of practice under this section and, if it decides to do so, must publish the code as revised.

(4) In preparing or revising a code of practice under this section, the Board must consult—

(a) the Minister for the Cabinet Office,

(b) the Scottish Ministers,

(c) the Welsh Ministers,

(d) the Department of Finance in Northern Ireland, and

(e) such other persons as the Board thinks fit.

(5) The fact that this section was not in force when consultation of the kind mentioned in subsection (4) took place is to be disregarded in determining whether there has been compliance with that subsection.

(6) The Board may not publish the original code of practice under this section unless a draft of the code has been laid before, and approved by a resolution of, each House of Parliament

(7) Before publishing a revised code of practice under this section the Board must lay a draft of the code as proposed to be published before Parliament.

(8) The Board may not publish the revised code of practice if, within the 40-day period, either House of Parliament resolves not to approve it.

(9) In subsection (8) “the 40 day period” means—

(a) the period of 40 days beginning with the day on which the draft is laid before Parliament, or

(b) if the draft is not laid before each House on the same day, the period of 40 days beginning with the later of the days on which it is laid before Parliament.

(10) For the purposes of subsection (9) no account is to be taken of any period during which Parliament is dissolved or prorogued or during which both Houses are adjourned for more than four days.

(11) After preparing or revising a code of practice under this section the Board must lay the code, or the code as revised, before—

(a) the Scottish Parliament,

(b) the National Assembly for Wales, and

(c) the Northern Ireland Assembly.

(12) The reference in subsection (1) to making changes to a process includes introducing or removing a process.

(13) This section binds the Crown.

(14) The reference to the Crown in subsection (13) does not include—

(a) Her Majesty in Her private capacity,

(b) Her Majesty in right of the Duchy of Lancaster, or

(c) the Duke of Cornwall.”

Commencement Information

I5 S. 80 in force at 1.10.2017 for specified purposes for E.W.S. by S.I. 2017/765, reg. 3(n)

I6 S. 80 in force at 1.5.2018 in so far as not already in force by S.I. 2018/382, reg. 3(ll)

81 Disclosure by the Statistics Board to devolved administrations U.K.

After section 53 of the Statistics and Registration Service Act 2007 insert—

“53A Disclosure by the Board to devolved administrations

(1) Subject to this section, the Board may disclose information held by the Board in connection with the exercise of any of its functions to a devolved authority.

(2) In this section “devolved authority” means—

(a) a person who is a part of the Scottish Administration,

(b) the Welsh Ministers,

(c) the Department of Finance in Northern Ireland, or

(d) the Registrar General for Northern Ireland.

(3) Information may only be disclosed under this section for the purposes of any or all of the statistical functions of a devolved authority.

(4) Information may only be disclosed under this section in response to a request in writing by a devolved authority which specifies—

(a) the information which is sought, and

(b) the purposes for which it is sought.

(5) A request under subsection (4) may request information to be disclosed on more than one date specified in the notice within a period specified in the notice.

(6) Information may be disclosed under this section only if—

(a) the Board is satisfied that the information is required for the purposes of the statistical functions of the devolved authority which are specified in the request,

(b) the Board is satisfied that the information will not be used for any other purpose, and

(c) if the information was obtained by the Board from a public authority, the authority consents to the disclosure.

(7) The Board may—

(a) disclose information under this section subject to conditions to be met by the devolved authority;

(b) from time to time modify conditions subject to which information has been disclosed;

(c) in the case of information which it is disclosing in response to a request to which subsection (5) applies, cease to disclose information in response to the request if any of the conditions are breached.

(8) A devolved authority may only use information disclosed under this section for the purposes for which it was disclosed.

(9) In disclosing information under subsection (1), the Board must have regard to the following codes of practice issued by the Information Commissioner under section 51(3) of the Data Protection Act 1998, so far as they apply to the information in question—

(a) any code which makes provision about the identification and reduction of the risks to privacy of a proposal to disclose information;

(b) any code which makes provision about the information to be provided to data subjects (within the meaning of that Act) about the use to be made of information collected from them.

(10) The duty in subsection (9) to have regard to a code of practice does not affect any other requirement for the Board to have regard to a code of practice under the Data Protection Act 1998 in disclosing the information.

(11) In the application of section 39 to personal information which has been disclosed to a devolved authority under this section, paragraphs (c) and (i) of subsection (4) of that section do not apply.

(12) This section does not authorise the making of a disclosure which would—

(a) breach any obligation of confidence owed by the Board,

(b) contravene the Data Protection Act 1998,

(c) be prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016, or

(d) breach any other restriction on the disclosure of information (however imposed).

(13) Until the repeal of Part 1 of the Regulation of Investigatory Powers Act 2000 by paragraphs 45 and 54 of Schedule 10 to the Investigatory Powers Act 2016 is fully in force, subsection (12)(c) has effect as if it included a reference to that Part.

(14) Nothing in this section affects the scope of the powers in sections 51 to 53.”

Commencement Information

I7 S. 81 in force at 31.7.2017 for E.W.S. by S.I. 2017/765, reg. 2(v)

I8 S. 81 in force at 1.5.2018 in so far as not already in force by S.I. 2018/382, reg. 3(mm)