27Restrictions on use and disclosure of information
(1)A person who holds information which has at any time been provided under section 25 may use it if, and only if, the use is for—
(a)the purpose referred to in section 25(4),
(b)the purpose of mitigating or eliminating the effects of disruption to a food supply chain, or
(c)the purpose of preventing or reducing the risk of future disruption to a food supply chain.
(2)A person who holds information which has at any time been provided under section 25 (“the holder”) may disclose it to another person (“the recipient”) if, and only if—
(a)the disclosure is for a purpose specified in subsection (1)(a) to (c),
(b)in a case where the holder is not a government authority, the disclosure is in accordance with the terms on which the information was disclosed to that person, and
(c)in a case where the recipient is not a government authority, the information is anonymised.
(3)Subsection (2) does not apply where the disclosure of information is required by section 26(7).
(4)A disclosure made in accordance with this Act does not breach any obligation of confidence owed by the person making the disclosure or any other restriction on the disclosure of information (however imposed).
(5)Personal data may not be used or disclosed under this section if the use or disclosure would contravene the data protection legislation (but in determining whether it would do so, take into account the powers conferred by subsections (1) and (2)).
(6)In this section—
“data protection legislation” and “personal data” have the same meanings as in the Data Protection Act 2018 (see section 3 of that Act);
“government authority” means—
(a)a Minister of the Crown,
(b)the Scottish Ministers,
(c)the Welsh Ministers,
(d)the First Minister of Northern Ireland, the deputy First Minister of Northern Ireland and any Northern Ireland Minister,
(e)a Northern Ireland department, and
(f)any other person exercising functions on behalf of the Crown.
(7)The provisions of this section bind the Crown.