254.—(1) A reference in this Section to “protected information” means information which has been—
(a)obtained by the regulator or an inspector under this Part, or
(b)shared with any of the persons listed in regulation 253(1).
(2) Information is not protected information for the purposes of this Section if it has been disclosed or made available to the public lawfully from other sources.
255. Protected information must not be disclosed except in accordance with Section 2 of this Chapter.
256. It is an offence for a person to disclose information in contravention of regulation 255.
257. It is a defence for a person charged with an offence under regulation 256 to prove—
(a)that the person did not know, and had no reason to suspect, that the information disclosed was protected information, or
(b)that the person took all reasonable precautions, and exercised all due diligence, to avoid committing the offence.
258. A person guilty of an offence under regulation 256 is liable—
(a)on summary conviction in England and Wales, to a fine;
(b)on summary conviction in Scotland or Northern Ireland, to a fine not exceeding the statutory maximum;
(c)on conviction on indictment, to imprisonment for a term not exceeding two years, or a fine, or both.
259. Regulation 255 does not prohibit disclosure of protected information if it is made with the consent of the person or body who provided or shared the information.
260.—(1) Regulation 255 does not prohibit a disclosure of protected information by—
(a)the regulator,
(b)an inspector,
(c)any person referred to in regulation 253(1),
(d)any other public authority,
for the purposes set out in paragraph (2).
(2) Those purposes are—
(a)complying with any of that person’s duties, or
(b)exercising their powers,
under the Act or any regulations made under the Act.
261.—(1) Regulation 255 does not prohibit a disclosure to a public or local authority, or an officer of that authority.
(2) Where protected information is disclosed by virtue of this paragraph, the person to whom the information is disclosed may only use the information for the purposes of the authority in question.
262. Regulation 255 does not prohibit a disclosure of protected information which is made in accordance with an obligation under—
(a)the Freedom of Information Act 2000(1), or
(b)the Freedom of Information (Scotland) Act 2002(2).
263.—(1) Regulation 255 does not prohibit a disclosure of protected information for the purposes of—
(a)any legal proceedings;
(b)an investigation under section 20;
(c)any report of such proceedings or investigation.
(2) Regulation 255 does not prohibit a disclosure of protected information which is made—
(a)by the regulator or an inspector, and
(b)for any of the purposes specified in section 17(2)(a) to (d) (criminal proceedings and investigation) of the Anti-terrorism, Crime and Security Act 2001(3).
264. Regulation 255 does not prohibit a disclosure of protected information which is made in a form calculated to prevent a particular person or case, to whom the information relates, from being identified.