F1Part 3AData matching

64CVoluntary provision of data

(1)

If the Auditor General for Wales thinks it appropriate to conduct a data matching exercise using data held by or on behalf of a body or person not subject to section 64B, the data may be disclosed to the Auditor General or a person acting on his behalf F2by virtue of a delegation made under section 18 of the Public Audit (Wales) Act 2013.

(2)

A disclosure under subsection (1) does not breach—

(a)

any obligation of confidence owed by a person making the disclosure, or

(b)

any other restriction on the disclosure of information (however imposed).

(3)

But nothing in this section authorises a disclosure which—

(a)

contravenes F3the data protection legislation, or

(b)

is prohibited by F4any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016.

(4)

Data may not be disclosed under subsection (1) if the data comprise or include patient data.

(5)

F5In this section—

“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

“Patient data” means data relating to an individual which are held for medical purposes (within the meaning of section 251 of the National Health Service Act 2006 (c. 41)) and from which the individual can be identified.

(6)

This section does not limit the circumstances in which data may be disclosed apart from this section.

(7)

Data matching exercises may include data provided by a body or person outside England and Wales.