(1) The Implementation Monitor must not use or disclose confidential or personal information obtained or received in the course of, or as a result of, the performance of the functions of the Implementation Monitor except as permitted by this Act.
(2) Nothing in subsection (1) prevents an Implementation Monitor from disclosing—
(a) the identity of a person if—
(i) the person has consented to the disclosure of the information; or
(ii) information relating to the person's identity is already in the public domain; or
(b) confidential or personal information—
(i) to a person assisting the Implementation Monitor in the performance of the Implementation Monitor's functions; or
(ii) to another Implementation Monitor.