[F1Voluntary provision of dataN.I.
4C—(1) If the Comptroller and Auditor General thinks it appropriate to conduct a data matching exercise using data held by or on behalf of a body or person not subject to Article 4B, the data may be disclosed to the Comptroller and Auditor General or a person acting on his behalf.
(2) A disclosure under paragraph (1) does not breach—
(a)any obligation of confidence owed by a person making the disclosure; or
(b)any other restriction on the disclosure of information (however imposed).
(3) But nothing in this Article authorises a disclosure which—
(a)contravenes the Data Protection Act 1998 (c. 29); or
(b)is prohibited by [F2any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016] .
(4) Data may not be disclosed under paragraph (1) if the data comprise or include patient data.
(5) “Patient data” means data relating to an individual which are held for any of the following purposes and from which the individual can be identified—
(a)preventative medicine, medical diagnosis, medical research, the provision of care and treatment and the management of health and social care services;
(b)informing individuals about their physical or mental health or condition, the diagnosis of their condition or their care and treatment.
(6) This Article does not limit the circumstances in which data may be disclosed apart from this Article.
(7) Data matching exercises may include data provided by a body or person outside Northern Ireland.]
F1Arts. 4A-4H and preceding cross-heading inserted (1.3.2008 for preceding cross-heading and Art. 4G(1)(3)(4) otherwise 6.4.2008) by Serious Crime Act 2007 (c. 27), ss. 73, 94(1), Sch. 7 para. 6; S.I. 2008/219, art. 3(j); S.I. 2008/755, art. 16(a)
F2Words in art. 4C(3)(b) substituted (27.6.2018) by Investigatory Powers Act 2016 (c. 25), s. 272(1), Sch. 10 para. 15 (with Sch. 9 paras. 7, 8, 10); S.I. 2018/652, reg. 12(g)(iii)