(1)A regulatory body must disclose information it has obtained in the exercise of its relevant functions to any other person if it thinks that such disclosure is necessary or expedient to protect the well-being of an individual in Wales.
(2)But information must not be disclosed under subsection (1) if disclosure of the information is prohibited by any enactment or other rule of law.
(3)In the case of information identifying an individual, it may be disclosed in a manner which identifies the individual only if the regulatory body thinks such identification is necessary to protect the well-being of any individual.
(4)For the purposes of subsection (3), information is to be treated as being in a form which identifies an individual if the individual can be identified from a combination of—
(a)the information, and
(b)other information disclosed by the regulatory body to the other person referred to in subsection (1).