Skip to main content
Version status: Amended
Version date: 27 June 2023 - onwards
Version 5 of 5

188 Indirect disclosure of information: restrictions on civil liability

This format of the bill is taken from the text of stage 1st reading published on 22 September 2022 by House of Commons

(1) The protections set out in subsection (2) apply in relation to a disclosure made by a person ("A") to another person ("B") if -

(a) A is carrying on business in circumstances where subsection (3) applies,

(b) the information relates to a person who is a customer or former customer of A ("the customer"),

(c) due to concerns about the risk of economic crime, A has decided to -

(i) terminate a business relationship with the customer,

(ii) refuse the customer a product or service, or

(iii) restrict the customer's access to elements of a product or service which are available to other customers,

(d) A is satisfied that the information disclosed to B, if it is disclosed by B to one or more persons carrying on business in circumstances where subsection (3) applies,  will or may assist those persons in carrying out their relevant actions,

(e) to the extent that the information is personal data, the UK GDPR applies to the disclosure of the information by A,

(f) A and B are parties to an agreement the terms of which provide that, to the extent that the information is personal data, B will only disclose or otherwise process it in circumstances where the UK GDPR applies to the disclosure or other processing, and

(g) the disclosure is not a privileged disclosure.