Part 5 – Miscellaneous Disclosures to prevent, detect, or investigate economic crime etc Section 189: Indirect disclosure of information: no breach of obligation of confidence
This section disapplies duties of confidentiality and civil liabilities where information is shared via a third-party intermediary (TPI) who may hold information on, for instance, a database or platform, such as one akin to the National Fraud Database. This type of information sharing will occur where, for instance, Bank ‘A’ has information about a customer that is relevant to other banks for preventing, detecting, or investigating economic crime, but it does not know specifically which banks would benefit from the information. An example would be where a bank has terminated a relationship with a customer due to economic crime concerns and wants to inform other banks of its decision to inform their own risk-assessments about the customer.
	Section 189(1) creates the conditions that must be met in order for a disclosure made by a person A to another (TPI) not to breach any obligation of confidence A may owe. These include:
That A is a business to which Section 189(3) applies, namely a business in the regulated sector as: a deposit taking body; electronic money institution; a payment institution; a cryptoasset exchange provider; a custodian wallet provider; a legal, accountancy, audit, tax or insolvency practitioner whose revenues exceed the amount specified in subsection (11); or a business prescribed by regulations made by the Secretary of State;
That the person whose data is being shared is a customer or former customer of A;
That A has taken specified safeguarding action against the customer;
That A is satisfied that the information disclosed, if disclosed by B to another C who is carrying on a business to which subsection (3) applies will or may assist the eventual recipient C in carrying out its relevant actions;
That the UK GDPR applies to the disclosure; and
That A and the TPI are parties to an agreement that ensures that to the extent the information is personal data any processing or disclosure by the TPI will only take place in circumstances where the UK GDPR applies to that processing or disclosure.
	That the disclosure is not a privileged disclosure as defined in Section 190.
	Section 189(2) sets out the protections that are applied by the sections: that the disclosure does not- (a) give rise to a breach of any obligation of confidence owed by A, or (b) give rise to any civil liability, on the part of A, to the person to whom the disclosed information relates.
	Section 189(4) is designed to ensure the TPI qualifies for the protections where the TPI discloses information to another business C and the condition of section 189(5) is met, covered by the provisions for the purposes of preventing, investigating, or detecting economic crime.
	Section 189(6) is designed to ensure that the use of the disclosed information by the eventual recipient C, for their relevant actions does not breach any obligation of confidence owed by C.
	Section 189(7) ensures that a person, carrying on a business to which subsection (3) applies, who makes a disclosure of information to another for the purposes of making a request for disclosure does not breach any duty of confidentiality owed or give rise to civil liability when doing so in specified circumstances.
	Section 189(10) makes clear that the disclosure of information must still be compliant with data protection legislation, the UK GDPR, and the Data Protection Act 2018, and that the protection from civil liability offered by these sections do not include those that arise under these acts.
	Section 189(11) provides the definition of relevant financial year, and the revenue threshold to qualify as a large firm under section 189(3).