Section 66: Bar on further disclosure of personal information, Digital Economy Act 2017

Subsection (2) applies to personal information—

in which the identity of a particular person is specified or from which the identity of a particular person can be deduced, whether from the information itself or from that information taken together with any other published information, and

which is received by a person ("P") under section 64(1) (disclosure for research purposes).

Personal information to which this subsection applies may not be disclosed—

by P, or

by any other person who has received it directly or indirectly from P.

Subsection (2) does not apply to a disclosure—

to a person by whom the research referred to in section 64(1) is being or is to be carried out, or

for the purposes of enabling anything that is to be published as a result of the research to be reviewed before publication, where the disclosure is made to a person who is accredited under section 71 as a person to whom such information may be disclosed for that purpose.

Subsection (5) applies to personal information which—

identifies a particular person, and

is received by a person ("P") under section 64(5) (disclosure for processing).

Personal information to which this subsection applies may not be disclosed—

by P, or

by any other person who has received it directly or indirectly from P.

Subsection (5) does not apply to a disclosure—

under section 64(1) or (5), or

of information previously disclosed under section 64(1), where the disclosure is made by—

the person to whom the information was disclosed under that provision, or

any person who has received the information directly or indirectly from the person mentioned in sub-paragraph (i),

(but subsection (2) may apply to such a disclosure).

Subsection (2) or (5) does not apply to a disclosure—

which is required or permitted by any enactment,

which is required by an EU obligation,

which is made in pursuance of an order of the court,

of information which has already lawfully been made available to the public,

which is made for the prevention or detection of crime or the prevention of anti-social behaviour,

which is made for the purposes of a criminal investigation,

which is made for the purposes of legal proceedings (whether civil or criminal),

which is a protected disclosure for any of the purposes of the Employment Rights Act 1996 or the Employment Rights (Northern Ireland) Order 1996 (SI 1996/1919 (NI 16)),

consisting of the publication of information for the purposes of journalism, where the publication of the information is in the public interest, or

which is made with the consent of the person to whom it relates.

In subsection (7)(a) "enactment" includes—

an enactment contained in, or in an instrument made under, an Act of the Scottish Parliament;

an enactment contained in, or in an instrument made under, a Measure or Act of the National Assembly for Wales;

an enactment contained in, or in an instrument made under, Northern Ireland legislation;

an enactment contained in subordinate legislation within the meaning of the Interpretation Act 1978.

In subsection (7)(e) "anti-social behaviour" means conduct that—

is likely to cause harassment, alarm or distress to any person, or

is capable of causing nuisance or annoyance to a person in relation to that person's occupation of residential premises.

A person commits an offence if—

the person discloses personal information in contravention of subsection (2) or (5), and

at the time that the person makes the disclosure, the person knows that the disclosure contravenes that subsection or is reckless as to whether the disclosure does so.

A person who is guilty of an offence under subsection (10) is liable on conviction on indictment to imprisonment for a term not exceeding two years, to a fine or to both.

A person who is guilty of an offence under subsection (10) is liable on summary conviction—

in England and Wales, to imprisonment for a term not exceeding the general limit in a magistrates' court, to a fine or to both;

in Scotland, to imprisonment for a term not exceeding 12 months, to a fine not exceeding the statutory maximum or to both;

in Northern Ireland, to imprisonment for a term not exceeding 6 months, to a fine not exceeding the statutory maximum or to both.

In the application of subsection (12)(a) to an offence committed before 2 May 2022 the reference to the general limit in a magistrates' court is to be read as a reference to 6 months.

This section does not apply to personal information disclosed under section 64(1) or (5) by the Revenue and Customs, the Welsh Revenue Authority or Revenue Scotland.

Section 66: Bar on further disclosure of personal information

Discussed in

About this text