Information processed by operator or person acting under authority

20. An operator or anyone processing personal information on behalf of a responsible
party or an operator, must—
(a) process such information only with the knowledge or authorisation of the
responsible party; and
(b) treat personal information which comes to their knowledge as confidential and
must not disclose it,
unless required by law or in the course of the proper performance of their duties.