Section 47 — Information disclosed by the Welsh Revenue Authority

(1) This section applies where the Welsh Revenue Authority discloses personal information to a person under section 45 for the purpose of enabling the person to provide digital verification services for an individual.

(2) The person must not further disclose the information otherwise than for the purpose of providing digital verification services for the individual, except with the consent of the Welsh Revenue Authority.

(3) Any other person who receives the information, whether directly or indirectly from the person to whom the Welsh Revenue Authority discloses the information, must not further disclose the information, except with the consent of the Welsh Revenue Authority.

(4) A person who discloses information in contravention of subsection (2) or (3) commits an offence.

(5) It is a defence for a person charged with an offence under subsection (4) to prove that the person reasonably believed—

(a) that the disclosure was lawful, or

(b) that the information had already lawfully been made available to the public.

(6) A person who commits an offence under subsection (4) is liable—

(a) on summary conviction in England and Wales, to imprisonment for a term not exceeding the general limit in a magistrates’ court or a fine (or both);

(b) on summary conviction in Scotland, to imprisonment for a term not exceeding 12 months or a fine not exceeding the statutory maximum (or both);

(c) on summary conviction in Northern Ireland, to imprisonment for a term not exceeding 6 months or a fine not exceeding the statutory maximum (or both);

(d) on conviction on indictment, to imprisonment for a term not exceeding 2 years or a fine (or both).

(7) In this section, “personal information” means information relating to a person whose identity—

(a) is specified in the information, or

(b) can be deduced from it.