(1)Subsection (2) applies to personal information—
(a)in which the identity of a particular person is specified or from which the identity of a particular person can be deduced, whether from the information itself or from that information taken together with any other published information, and
(b)which—
(i)is disclosed under section 64(1) (disclosure for research purposes) by the Welsh Revenue Authority, or
(ii)is disclosed under section 64(1) by a person other than the Welsh Revenue Authority and is derived from information disclosed under section 64(5) by the Welsh Revenue Authority,
and is received by a person (“P”) under section 64(1).
(2)Personal information to which this subsection applies may not be disclosed—
(a)by P, or
(b)by a person to whom the information is disclosed by virtue of subsection (3).
(3)Subsection (2) does not apply to a disclosure—
(a)to a person by whom the research referred to in section 64(1) is being or is to be carried out, or
(b)for the purposes of enabling anything that is to be published as a result of the research to be reviewed before publication, where the disclosure is made to a person who is accredited under section 71 as a person to whom such information may be disclosed for that purpose.
(4)Subsection (5) applies to personal information which—
(a)identifies a particular person, and
(b)is disclosed by the Welsh Revenue Authority under section 64(5) (disclosure for processing) and received by a person (“P”).
(5)Personal information to which this subsection applies may not be disclosed—
(a)by P, or
(b)by any other person who has received it under section 64(5).
(6)Subsection (5) does not apply to a disclosure under section 64(1).
(7)Subsection (2) or (5) does not apply to a disclosure which is made with the consent of the Welsh Revenue Authority (which may be general or specific).
(8)A person who contravenes subsection (2) or (5) is guilty of an offence.
(9)It is a defence for a person charged with an offence under subsection (8) to prove that the person reasonably believed—
(a)that the disclosure was lawful, or
(b)that the information had already and lawfully been made available to the public.
(10)A person who is guilty of an offence under subsection (8) is liable—
(a)on summary conviction, to imprisonment for a term not exceeding 12 months, to a fine, or to both;
(b)on conviction on indictment to imprisonment for a term not exceeding two years, to a fine or to both.
(11)In the application of subsection (10)(a) to an offence committed before the coming into force of section 154(1) of the Criminal Justice Act 2003 the reference to 12 months is to be read as a reference to 6 months.