Pursuant to Article 28(10) of the Convention, information conveyed by either Party about an individual and required solely for the purposes of implementing this Protocol shall be used exclusively for the purpose of administering the Convention. Such information shall be governed by the laws applicable in either Party for the protection of privacy and confidentiality of personal data.

In no case shall a competent authority of either Party be expected to furnish information which is not obtainable under the laws of that, or the other Party.