{
  "url": "https://openlegislation.uk/public-audit-wales-act-2004/section-64C",
  "json_url": "https://openlegislation.uk/public-audit-wales-act-2004/section-64C.json",
  "legislation": "ukpga/2004/23",
  "legislation_title": "Public Audit (Wales) Act 2004",
  "legislation_url": "https://openlegislation.uk/public-audit-wales-act-2004",
  "path": "section/64C",
  "kind": "section",
  "number": "64C",
  "heading": "Voluntary provision of data",
  "text": "(1) If the Auditor General for Wales thinks it appropriate to conduct a data matching exercise using data held by or on behalf of a body or person not subject to section 64B, the data may be disclosed to the Auditor General or a person acting on his behalf by virtue of a delegation made under section 18 of the Public Audit (Wales) Act 2013.\n(2) A disclosure under subsection (1) does not breach—\n(a) any obligation of confidence owed by a person making the disclosure, or\n(b) any other restriction on the disclosure of information (however imposed).\n(3) But nothing in this section authorises a disclosure which—\n(a) contravenes the data protection legislation, or\n(b) is prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016.\n(4) Data may not be disclosed under subsection (1) if the data comprise or include patient data.\n(5) In this section—\n“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);\n“Patient data” means data relating to an individual which are held for medical purposes (within the meaning of section 251 of the National Health Service Act 2006 (c. 41)) and from which the individual can be identified.\n(6) This section does not limit the circumstances in which data may be disclosed apart from this section.\n(7) Data matching exercises may include data provided by a body or person outside England and Wales.",
  "extent": "E+W",
  "status": null,
  "version": "current",
  "annotations": [
    {
      "type": "F",
      "label": "F1",
      "text": "Pt. 3A inserted (1.3.2008 for s. 64G(1)(3)(4) and 6.4.2008 otherwise) by Serious Crime Act 2007 (c. 27), ss. 73, 94, Sch. 7 para. 4; S.I. 2008/219, art. 3(i); S.I. 2008/755, art. 16"
    },
    {
      "type": "F",
      "label": "F2",
      "text": "Words in s. 64C(1) inserted (1.4.2014) by Public Audit (Wales) Act 2013 (anaw 3), s. 35(2), Sch. 4 para. 64 (with Sch. 3 para. 3); S.I. 2013/1466, art. 3(1)"
    },
    {
      "type": "F",
      "label": "F3",
      "text": "Words in s. 64C(3)(a) substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 99(2) (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g)"
    },
    {
      "type": "F",
      "label": "F4",
      "text": "Words in s. 64C(3)(b) substituted (27.6.2018) by Investigatory Powers Act 2016 (c. 25), s. 272(1), Sch. 10 para. 16 (with Sch. 9 paras. 7, 8, 10); S.I. 2018/652, reg. 12(g)(iii)"
    },
    {
      "type": "F",
      "label": "F5",
      "text": "Words in s. 64C(5) inserted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 99(3) (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g)"
    }
  ],
  "outstanding_effects": [],
  "provenance": {
    "source": "legislation.gov.uk",
    "source_url": "https://www.legislation.gov.uk/ukpga/2004/23/section/64C",
    "retrieved_at": "2026-10-29T09:17:02.610556+00:00"
  },
  "licence": "Open Government Licence v3.0",
  "licence_url": "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/",
  "attribution": "Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives."
}