Citation, commencement and interpretation

1. —(1) These Regulations may be cited as the Companies (Disclosure of Date of Birth Information) Regulations 2015 and come into force on 10th October 2015.

(2) In these Regulations—

“the “ Act ” means the Companies Act 2006 and, unless the context otherwise requires, reference to a numbered section is a section so numbered in that Act;

“ the 1985 Act ” means the Companies Act 1985 ;

“ the 1986 Order ” means the Companies (Northern Ireland) Order 1986 ;

...

Permitted disclosure by the registrar to specified public authorities

2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Permitted disclosure by the registrar to credit reference agencies

3. —(1) The registrar may disclose relevant date of birth information to a credit reference agency where the conditions specified in paragraphs 6 to 10A of Schedule 2 are satisfied.

(2) The registrar may rely on a statement delivered to the registrar by a credit reference agency under paragraph 10 of Schedule 2 as sufficient evidence of the matters stated in it.

(3) Notwithstanding paragraph (2), a credit reference agency shall deliver to the registrar such information or evidence in addition to the statement required by paragraph 10 of Schedule 2 as the registrar may direct for the purpose of enabling the registrar to determine in accordance with these Regulations whether to disclose relevant date of birth information to a credit reference agency.

(4) The registrar may require such information or evidence to be verified in such manner as the registrar may direct.

(5) The credit reference agency must inform the registrar immediately of any change in respect of any statement delivered to the registrar pursuant to Schedule 2 or information or evidence provided for the purpose of enabling the registrar to determine whether to disclose relevant date of birth information .

Regulation 2

SCHEDULE 1 SPECIFIED PUBLIC AUTHORITIES

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Regulations 2 and 3

SCHEDULE 2 CONDITIONS FOR PERMITTED DISCLOSURE

PART 1 Disclosure to specified public authorities

1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

PART 2 Disclosure to a credit reference agency

5. Paragraphs 6 to 10 set out the conditions specified for the disclosure of relevant date of birth information by the registrar to a credit reference agency.

6. —(1) The credit reference agency—

(a) is carrying on in the United Kingdom ... a business comprising the furnishing of information relevant to the financial standing of individuals, being information collected by the agency for that purpose;

(b) maintains appropriate procedures—

(i) to ensure that an independent person can investigate and audit the measures maintained by the agency for the purposes of ensuring the security of any relevant date of birth information disclosed to that agency; and

(ii) for the purposes of ensuring that it complies with its obligations under the data protection legislation (as defined in section 3 of the Data Protection Act 2018) ;

(c) has not been found guilty of an offence under—

(i) section 1112 (false statements: basic offence) or section 1112A (false statements: aggravated offence) of the Act or section 2 of the Fraud Act 2006 (fraud by false representation);

(ii) section 47 (failure to comply with enforcement notice) of the Data Protection Act 1998 in circumstances where it has used the relevant date of birth information for purposes other than those described in sub-paragraphs (a) to (e) of paragraph 7 below ; or

(iii) section 144 of the Data Protection Act 2018 (false statements made in response to an information notice) or section 148 of that Act (destroying or falsifying information and documents etc );

(d) has not been given a penalty notice under section 155 of the Data Protection Act 2018 in circumstances described in paragraph (c)(ii), other than a penalty notice that has been cancelled.

(2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

7. The credit reference agency has delivered to the registrar a statement that it intends to use the relevant date of birth information only for the purposes of—

(a) providing an assessment of the financial standing of a person;

(b) meeting any obligations contained in the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 or any rules made pursuant to section 137A of the Financial Services and Markets Act 2000 which relate to the prevention and detection of money laundering in connection with the carrying on of regulated activities by authorised persons ... ;

(c) conducting conflict of interest checks required or made necessary by any enactment;

(d) the provision of relevant date of birth information to—

(i) a person to whom the registrar could disclose information under section 1110F (disclosure by the registrar) of the Act; or

(ii) a credit reference agency which has satisfied the requirements of this Part of this Schedule; or

(e) conducting checks for the prevention and detection of crime and fraud.

8. The credit reference agency has delivered to the registrar a statement that it intends to take delivery of and to use the relevant date of birth information only in the United Kingdom ....

9. The credit reference agency has delivered to the registrar a statement that it will, where it supplies a copy of the relevant date of birth information to a processor for the purpose of processing the information for use in respect of the purposes referred to in paragraph 7—

(a) ensure that the processor is one who carries on business in the United Kingdom ;

(b) require that the information is not transmitted outside the United Kingdom by the processor; and

(c) require that the processor does not disclose the information except to the credit reference agency or an employee of the credit reference agency.

10. The credit reference agency has delivered to the registrar a statement that it meets the conditions in paragraph 6 above.

10A. The relevant date of birth information is not information to which regulation 34(1) of the Register of People with Significant Control Regulations 2016 ( S.I. 2016/339 ) applies.

PART 3 Interpretation of this Schedule

11. —(1) In this Schedule—

“ processor ” means any person who provides a service which consists of putting information into data form or processing information in data form and any reference to a processor includes a reference to its employees; and

...

(2) In this Schedule any reference to—

(a) an employee of any person who has access to relevant date of birth information shall be deemed to include any person working or providing services for the purposes of that person or employed by or on behalf of, or working for, any person who is so working or who is supplying such a service; and

(b) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .