(3) Any other person who receives the information, whether directly or indirectly from the person to whom the Welsh Revenue Authority discloses the information, must not further disclose the information, except with the consent of the Welsh Revenue Authority.
(4) A person who discloses information in contravention of subsection (2) or (3) commits an offence.
(5) It is a defence for a person charged with an offence under subsection (4) to prove that the person reasonably believed—
(a) that the disclosure was lawful, or
(b) that the information had already lawfully been made available to the public.
(6) A person who commits an offence under subsection (4) is liable—
(a) on summary conviction in England and Wales, to imprisonment for a term not exceeding the general limit in a magistrates’ court or a fine (or both);
(b) on summary conviction in Scotland, to imprisonment for a term not exceeding 12 months or a fine not exceeding the statutory maximum (or both);
(c) on summary conviction in Northern Ireland, to imprisonment for a term not exceeding 6 months or a fine not exceeding the statutory maximum (or both);
(d) on conviction on indictment, to imprisonment for a term not exceeding 2 years or a fine (or both).
(7) In this section, “ personal information ” means information relating to a person whose identity—
(a) is specified in the information, or
(b) can be deduced from it.
I91 S. 47 not in force at Royal Assent, see s. 142(1)
48 Information disclosed by Revenue Scotland U.K.
(1) This section applies where Revenue Scotland discloses personal information to a person under section 45 for the purpose of enabling the person to provide digital verification services for an individual.
(2) The person must not further disclose the information otherwise than for the purpose of providing digital verification services for the individual, except with the consent of Revenue Scotland.
(3) Any other person who receives the information, whether directly or indirectly from the person to whom Revenue Scotland discloses the information, must not further disclose the information, except with the consent of Revenue Scotland.
I92 S. 48 not in force at Royal Assent, see s. 142(1)
49 Code of practice about the disclosure of information U.K.
(1) The Secretary of State must prepare and publish a code of practice about the disclosure of information under section 45.
(2) The code of practice must be consistent with the code of practice prepared under section 121 of the Data Protection Act 2018 (data-sharing code) and issued under section 125(4) of that Act (as altered or replaced from time to time).
(3) A public authority must have regard to the code of practice in disclosing information under section 45.
(4) The Secretary of State may from time to time revise and republish the code of practice.
(5) In preparing or revising the code of practice, the Secretary of State must consult—
(a) the Information Commissioner,