Restrictions relating to disclosures
27.—(1) If a responsible body that is disclosing or to which is being disclosed any information under regulation 25 or 26 has an accountable officer, the disclosure shall be made by or to the accountable officer or his staff (and not by or to any other person who may act on behalf of the responsible body).
(2) If a responsible body has received information under regulation 25 or 26, it shall not process that information more than is necessary for the purposes of—
(a)identifying cases in which action may need to be taken in respect of matters arising in relation to the management or use of controlled drugs by a relevant person;
(b)considering issues relating to the taking of action in respect of such matters; or
(c)taking action in respect of such matters.
(3) In particular, the responsible body shall—
(a)not allow any person access to that information unless he is a person who, by virtue of his contract of employment or otherwise, is aware of the purposes for which the information may be processed; and
(b)ensure that appropriate organisational measures are taken to prevent unauthorised disclosure or processing of the information.