40Further provisions about disclosures under any of sections 35 to 39U.K.
(1)Personal information disclosed under any of sections 35 to 39 may only be used by the person to whom it is disclosed for the purposes for which it was disclosed, subject to subsection (2).
(2)Subsection (1) does not prevent the use of information by a person—
(a)if the information has already lawfully been made available to the public,
(b)if the person to whom the information relates consents to its use for another purpose,
(c)for the prevention or detection of crime or the prevention of anti-social behaviour,
(d)for the purposes of a criminal investigation,
(e)for the purposes of legal proceedings (whether civil or criminal), or
(f)for the purposes of—
(i)preventing serious physical harm to a person,
(ii)preventing loss of human life,
(iii)safeguarding vulnerable adults or children,
(iv)responding to an emergency, or
(v)protecting national security.
(3)In subsection (2)(c) “anti-social behaviour” means conduct that—
(a)is likely to cause harassment, alarm or distress to any person, or
(b)is capable of causing nuisance or annoyance to a person in relation to that person's occupation of residential premises.
(4)Subsection (2) does not apply to information disclosed to a person under section 35, 36 or 38 by the Revenue and Customs; but such information may be used by that person for purposes other than those for which it was disclosed with the consent of the Commissioners for Her Majesty's Revenue and Customs (which may be general or specific).
(5)For the purposes of this Chapter information is “personal information” if—
(a)it relates to and identifies a particular person (including a body corporate), but
(b)it is not information about the internal administrative arrangements of a specified person or a person to whom information may be disclosed under section 36 or 38.
(6)For the purposes of subsection (5) information identifies a particular person if the identity of that person—
(a)is specified in the information,
(b)can be deduced from the information, or
(c)can be deduced from the information taken together with any other information.
(7)A disclosure under any of sections 35 to 39 does not breach—
(a)any obligation of confidence owed by the person making the disclosure, or
(b)any other restriction on the disclosure of information (however imposed).
(8)But nothing in sections 35 to 39 authorises the making of a disclosure which—
(a)contravenes [F1the data protection legislation], or
(b)is prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016.
(9)Until the repeal of Part 1 of the Regulation of Investigatory Powers Act 2000 by paragraphs 45 and 54 of Schedule 10 to the Investigatory Powers Act 2016 is fully in force, subsection (8)(b) has effect as if it included a reference to that Part.
(10)Sections 35 to 39 do not limit the circumstances in which information may be disclosed apart from those sections.
[F2(11)In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).]
Textual Amendments
F1Words in s. 40(8)(a) substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 216(2) (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g)
F2S. 40(11) inserted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 216(3) (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g)
Modifications etc. (not altering text)
C1Pt. 5 Ch. 1: functions made exercisable concurrently (30.9.2020) by The Transfer of Functions (Digital Government) Order 2020 (S.I. 2020/940), arts. 1(2), 2 (with art. 5)
Commencement Information
I1S. 40 in force at 1.4.2018 for specified purposes by S.I. 2018/342, reg. 3(1)(d)
I2S. 40 in force at 1.5.2018 for E.W.S. in so far as not already in force by S.I. 2018/382, reg. 3(f)