Section 20 Information processed by operator or person acting under authority

1. An operator or anyone processing personal information on behalf of a responsible party or an operator, must—
   1. process such information only with the knowledge or authorisation of the responsible party; and
   2. treat personal information which comes to their knowledge as confidential and must not disclose it,

unless required by law or in the course of the proper performance of their duties.