Part 5: Digital Government Chapter 5: Sharing for research purposes Section 66: Bar on further disclosure of personal information
This section applies to personal information disclosed by public authorities other than the revenue authorities. It establishes two criminal offences.
	The subsection (2) offence protects a defined class of personal information once it has been disclosed under section 64(1). The offence applies to information which specifies the identity of a particular person, even though section 64(1) does not permit the disclosure of such information. This is to ensure that if such information is purportedly disclosed under section 64(1), when it should not have been, that the information is protected by the offence.
	Once information has been properly processed for disclosure, it will not be reasonably likely that a person’s identity will be deduced from the information. However, it might still be possible to deduce a person’s identity from the information. The subsection (2) offence recognises this and protects the information if a person’s identity could be deduced (from the information itself or from the information taken together with any other published information).
	Any person who receives that defined class of personal information under section 64(1) and any other person who receives that information, directly or indirectly, from such a person, is prohibited from disclosing it, other than in accordance with subsection (3) or subsection (7). Subsection (3)(a) permits a disclosure to the researcher who is accredited to carry out the relevant research. Subsection (3)(b) permits disclosure to an accredited peer reviewer. Subsection (7) contains a list of various exceptions, including disclosures that are required or permitted by any enactment (including the Act itself) and disclosures made with consent of the person to whom the information relates.
	The Act does not place restrictions on the use or onward disclosure of information which has been disclosed under section 64(1) but which is not personal information within the meaning of section 66(1).
	The subsection (5) offence protects personal information (within the meaning of sections 64(11) and (12)) that has been disclosed for the purpose of processing it for disclosure under section 64(1). It is an offence for a processor, or any person who receives such information directly or indirectly from a processor, to disclose that information other than as permitted by subsection (6) or (7). Subsection (6)(a) ensures that the offence is not committed when a processor discloses the processed information under section 64(1) or when a processor discloses the information to another processor under section 64(5)(b). Subsection (6)(b) ensures – where it is a processor that makes the disclosure under section 64(1) on behalf of the public authority – that the subsection (5)(b) offence does not apply to a disclosure made by the initial recipient of the information or by any person who receives the information from that initial recipient. The last line of subsection (6)(b) ensures that the subsection (2) offence may still apply to a disclosure of information made by those persons.
	Given that the offence applies to personal information which has been disclosed for processing, it will apply even if the information has been processed and is ready for disclosure under section 64(1). As set out above, however, subsection (6)(a) permits a processor to make a disclosure of that information under section 64(1).
	By virtue of subsection (10), a person commits an offence if at the time the person makes the disclosure, the person knows that the disclosure contravenes subsections (2) or (5) or is reckless as to whether the disclosure does so.
	The limited circumstances in which personal information can be disclosed without committing the offence apply to the offences under subsections (2) and (5). Other restrictions on disclosure of personal information – including other criminal offences regarding the unauthorised disclosure of information – may still also apply.