Serious Crime Act 2007

6 After Article 4 of the Audit and Accountability (Northern Ireland) Order 2003 (S.I. 2003/418 (N.I.5)) insert—

“Data matching

4A Power to conduct data matching exercises

(1) The Comptroller and Auditor General may conduct data matching exercises or arrange for them to be conducted on his behalf.

(2) A data matching exercise is an exercise involving the comparison of sets of data to determine how far they match (including the identification of any patterns and trends).

(3) The power in paragraph (1) is exercisable for the purpose of assisting in the prevention and detection of fraud.

(4) That assistance may, but need not, form part of an audit.

(5) A data matching exercise may not be used to identify patterns and trends in an individual’s characteristics or behaviour which suggest nothing more than his potential to commit fraud in the future.

(6) In Articles 4B to 4H, reference to a data matching exercise is to an exercise conducted or arranged to be conducted under this Article.

4B Mandatory provision of data

(1) The Comptroller and Auditor General may require—

(a) any body mentioned in paragraph (2); and

(b) any officer or member of such a body,

to provide the Comptroller and Auditor General or a person acting on his behalf with such data (and in such form) as the Comptroller and Auditor General or that person may reasonably require for the purpose of conducting data matching exercises.

(2) The bodies are—

(a) any body (including a holder of a statutory office) whose accounts are required to be audited by the Comptroller and Auditor General, other than a body whose accounts are required to be so audited by virtue of section 55 of the Northern Ireland Act 1998 (c. 47);

(b) any body whose accounts are required to be audited by a local government auditor.

(3) A person who without reasonable excuse fails to comply with a requirement of the Comptroller and Auditor General under paragraph (1)(b) is guilty of an offence and liable on summary conviction—

(a) to a fine not exceeding level 3 on the standard scale; and

(b) to an additional fine not exceeding £20 for each day on which the offence continues after conviction for that offence.

(4) If an officer or member of a body is convicted of an offence under paragraph (3), any expenses incurred by the Comptroller and Auditor General in connection with proceedings for the offence, so far as not recovered from any other source, are recoverable from that body.

4C Voluntary provision of data

(1) If the Comptroller and Auditor General thinks it appropriate to conduct a data matching exercise using data held by or on behalf of a body or person not subject to Article 4B, the data may be disclosed to the Comptroller and Auditor General or a person acting on his behalf.

(2) A disclosure under paragraph (1) does not breach—

(a) any obligation of confidence owed by a person making the disclosure; or

(b) any other restriction on the disclosure of information (however imposed).

(3) But nothing in this Article authorises a disclosure which—

(a) contravenes the Data Protection Act 1998 (c. 29); or

(b) is prohibited by Part 1 of the Regulation of Investigatory Powers Act 2000 (c. 23).

(4) Data may not be disclosed under paragraph (1) if the data comprise or include patient data.

(5) “Patient data” means data relating to an individual which are held for any of the following purposes and from which the individual can be identified—

(a) preventative medicine, medical diagnosis, medical research, the provision of care and treatment and the management of health and social care services;

(b) informing individuals about their physical or mental health or condition, the diagnosis of their condition or their care and treatment.

(6) This Article does not limit the circumstances in which data may be disclosed apart from this Article.

(7) Data matching exercises may include data provided by a body or person outside Northern Ireland.

4D Disclosure of results of data matching etc

(1) This Article applies to the following information—

(a) information relating to a particular body or person obtained by or on behalf of the Comptroller and Auditor General for the purpose of conducting a data matching exercise;

(b) the results of any such exercise.

(2) Information to which this Article applies may be disclosed by or on behalf of the Comptroller and Auditor General if the disclosure is—

(a) for or in connection with a purpose for which the data matching exercise is conducted;

(b) to a body mentioned in paragraph (3) (or a related party) for or in connection with a function of that body corresponding or similar to the audit functions of the Comptroller and Auditor General or a local government auditor under any statutory provision or the data matching functions of the Comptroller and Auditor General under Article 4A; or

(c) in pursuance of a duty imposed by or under a statutory provision.

(3) The bodies are—

(a) the Audit Commission for Local Authorities and the National Health Service in England;

(b) the Auditor General for Wales;

(c) the Auditor General for Scotland;

(d) the Accounts Commission for Scotland;

(e) Audit Scotland.

(4) “Related party”, in relation to a body mentioned in paragraph (3), means—

(a) a body or person acting on its behalf;

(b) a body whose accounts are required to be audited by it or by a person appointed by it;

(c) a person appointed by it to audit those accounts.

(5) If the data used for a data matching exercise include patient data—

(a) paragraph (2)(a) applies only so far as the purpose for which the disclosure is made relates to a relevant NHS body;

(b) paragraph (2)(b) applies only so far as the function for or in connection with which the disclosure is made relates to such a body.

(6) In paragraph (5)—

(a) “patient data” has the same meaning as in Article 4C;

(b) “relevant NHS body” means—

(i) a body to which Article 90 of the Health and Personal Social Services (Northern Ireland) Order 1972 (NI 14) applies;

(ii) a health service body as defined in section 53(1) of the Audit Commission Act 1998 (c. 18);

(iii) a Welsh NHS body as defined in section 60 of the Public Audit (Wales) Act 2004 (c. 23);

(iv) an NHS body as defined in section 22(1) of the Community Care and Health (Scotland) Act 2002 (asp 5).

(7) Information disclosed under paragraph (2) may not be further disclosed except—

(a) for or in connection with the purpose for which it was disclosed under sub-paragraph (a) or the function for which it was disclosed under sub-paragraph (b) of that paragraph;

(b) for the investigation or prosecution of an offence (so far as the disclosure does not fall within sub-paragraph (a)); or

(c) in pursuance of a duty imposed by or under a statutory provision.

(8) Except as authorised by paragraphs (2) and (7), a person who discloses information to which this Article applies is guilty of an offence and liable—

(a) on conviction on indictment, to imprisonment for a term not exceeding two years, to a fine or to both; or

(b) on summary conviction, to imprisonment for a term not exceeding 6 months, to a fine not exceeding the statutory maximum or to both.

(9) Article 27 of the Local Government (Northern Ireland) Order 2005 (NI 18) does not apply to information to which this Article applies.

(10) In this Article “body” includes office.

4E Publication

(1) Nothing in Article 4D prevents the Comptroller and Auditor General from publishing a report on a data matching exercise (including on the results of the exercise).

(2) But the report may not include information relating to a particular body or person if—

(a) the body or person is the subject of any data included in the data matching exercise;

(b) the body or person can be identified from the information; and

(c) the information is not otherwise in the public domain.

(3) A report published under this Article may be published in such manner as the Comptroller and Auditor General considers appropriate for bringing it to the attention of those members of the public who may be interested.

(4) This Article does not affect any powers of the Comptroller and Auditor General or a local government auditor where the data matching exercise in question forms part of an audit carried out by either of them.

4F Fees for data matching

(1) The Comptroller and Auditor General may charge a fee to any body required under Article 4B(1) to provide data for a data matching exercise.

(2) But a body whose functions are discharged on behalf of the Crown may not be charged a fee under paragraph (1) except with the consent of the Department.

(3) In addition to the power under paragraph (1), the Comptroller and Auditor General may charge a fee to any other body or person providing data for or receiving the results of a data matching exercise, such fee to be payable in accordance with terms agreed between the Comptroller and Auditor General and that body or person.

(4) Any fee received by the Comptroller and Auditor General by virtue of this Article is to be paid by him into the Consolidated Fund.

4G Code of data matching practice

(1) The Comptroller and Auditor General must prepare, and keep under review, a code of practice with respect to data matching exercises.

(2) Regard must be had to the code in conducting and participating in any such exercise.

(3) Before preparing or altering the code, the Comptroller and Auditor General must consult the bodies mentioned in Article 4B(2), the Information Commissioner and such other bodies or persons as he thinks fit.

(4) The Comptroller and Auditor General must—

(a) send a copy of the code, and of any alterations made to the code, to the Department and the Department must lay the copy before the Assembly; and

(b) from time to time publish the code as for the time being in force.

4H Powers of the Department

(1) The Department may by order amend Articles 4A to 4G—

(a) to add any purpose mentioned in paragraph (2) to the purposes for which data matching exercises may be conducted;

(b) to modify the application of those Articles in relation to a purpose so added.

(2) The purposes which may be added are—

(a) to assist in the prevention and detection of crime (other than fraud);

(b) to assist in the apprehension and prosecution of offenders;

(c) to assist in the recovery of debt owing to public bodies.

(3) The Department may by order amend Articles 4A to 4G—

(a) to add a public body to the list of bodies in Article 4B(2);

(b) to modify the application of those Articles in relation to a body so added;

(c) to remove a body from that list.

(4) An order under this Article may include such incidental, consequential, supplemental or transitional provision as the Department thinks fit.

(5) An order under this Article is subject to affirmative resolution.

(6) In this Article “public body” means a body or person whose functions—

(a) are functions of a public nature; or

(b) include functions of that nature,

but, in the latter case, the body or person is a public body to the extent only of those functions.”