Regulations 42 and 45
1. The specified public authority has delivered to the registrar a statement that it intends to use the information only for the purpose of facilitating the carrying out by that specified public authority of a public function (“the permitted purpose”).
2. Subject to paragraph 3, the specified public authority has delivered to the registrar a statement that, where it supplies a copy of the information to a processor for the purpose of processing the information for use in respect of the permitted purpose, the specified public authority will—
(a)ensure that the processor is one who carries on business in the European Economic Area;
(b)require that the processor does not transmit the information outside the European Economic Area; and
(c)require that the processor does not disclose the information except to that specified public authority or an employee of that specified public authority.
3. Paragraph 2 does not apply where the specified public authority is the National Crime Agency, Secret Intelligence Service, Security Service or Government Communications Headquarters.
4. The specified public authority has delivered any information or evidence required by the registrar for the purpose of enabling the registrar to determine in accordance with these Regulations whether to disclose the information.
5. The specified public authority has complied with any requirement by the registrar to confirm the accuracy of the statements, information or evidence delivered to the registrar pursuant to this Part of this Schedule.
6. The credit institution or financial institution, referred to in this Part as the “relevant institution,” maintains appropriate procedures to ensure that—
(a)an independent person can investigate and audit the measures maintained by the relevant institution for the purpose of ensuring the security of any information disclosed to that institution; and
(b)it complies with its obligations under the Data Protection Act 1998, or, where the relevant institution carries on business in an EEA State other than the United Kingdom, with its obligations under legislation implementing Directive 95/46/EC(1) of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data.
7. The relevant institution has delivered to the registrar a statement confirming that it is a credit institution or a financial institution, as the case may be, and that it meets the conditions in paragraph 6.
8. The relevant institution has delivered to the registrar a statement that it intends to use information only for the purpose of applying customer due diligence measures to the eligible Scottish partnership to which the secured information relates, in compliance with the institution’s obligations under Part 3 (customer due diligence) of the 2017 Money Laundering Regulations.
9. The relevant institution has delivered to the registrar a statement that confirms the name and registered number of the eligible Scottish partnership in respect of which it is required to apply customer due diligence measures under the 2017 Money Laundering Regulations.
10. The relevant institution has delivered to the registrar a statement that it intends to take delivery of and to use the information only in the United Kingdom or another EEA State.
11. The relevant institution has delivered to the registrar a statement that it will, where it supplies a copy of the information to a processor for the purpose of processing the information for use in respect of the purpose referred to in paragraph 8—
(a)ensure that the processor is one who carries on business in the European Economic Area;
(b)require that the processor does not transmit the information outside the European Economic Area; and
(c)require that the processor does not disclose the information except to that institution.
12. The relevant institution has delivered any information or evidence required by the registrar for the purpose of enabling the registrar to determine in accordance with these Regulations whether to disclose the information.
13. The relevant institution has complied with any requirement by the registrar to confirm the accuracy of the statements, information or evidence delivered to the registrar pursuant to this Part of this Schedule.
14. In this Schedule—
(a)“processor” means any person who provides a service which consists of putting information into data form or processing information in data form and any reference to a processor includes a reference to the processor’s employees;
(b)“public function” includes—
(i)any function conferred by or in accordance with any provision contained in any enactment(2);
(ii)any function conferred by or in accordance with any provision contained in the EU Treaties or any EU instrument;
(iii)any similar function conferred on persons by or under provisions having effect as part of the law of a country or territory outside the United Kingdom; and
(iv)any function exercisable in relation to the investigation of any criminal offence or for the purpose of any criminal proceedings;
(c)any reference to an employee of any person who has access to information includes any person working or providing services for the purposes of that person or employed by or on behalf of, or working for, any person who is so working or who is supplying such a service; and
(d)any reference to the disclosure for the purpose of facilitating the carrying out of a public function includes disclosure in relation to, and for the purpose of, any proceedings whether civil, criminal or disciplinary in which the specified public authority engages while carrying out its public functions.
OJ L 281, 23.11.1995, p.31.
See section 1293 of the Companies Act 2006 for the meaning of “enactment”; section 1293 was amended by section 90(4) of the Small Business, Enterprise and Employment Act 2015 (c.26).