When a registered provider is asked by an individual to provide registered services, a public authority may disclose information about that individual to the provider to enable the service, may charge for it, and must have regard to the Secretary of State's code of practice (consistent with the data-sharing code under the 2018 Act); the power does not override the data protection legislation or the Investigatory Powers Act 2016. A provider receiving personal information from HMRC must not disclose it further except to provide the verification service for that individual or with HMRC's consent (breach is the wrongful disclosure offence in the Commissioners for Revenue and Customs Act 2005); the same limit applies to anyone who receives it from the provider. The Welsh Revenue Authority and Revenue Scotland equivalents create an offence of up to two years' imprisonment on indictment, with a defence of reasonable belief that the disclosure was lawful or the information already public.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.