98Additional authorisation—person engaged by institution disclosing etc. for a specified purpose

98  Additional authorisation—person engaged by institution disclosing etc. for a specified purpose  (1) A person engaged (whether as an employee or otherwise) by a participating institution or partly‑participating institution may:  (a) obtain protected information; or  (b) make a record of protected information; or  (c) disclose protected information to another person; or  (d) use protected information; if the person believes, on reasonable grounds, that the obtaining, recording, disclosure or use that is proposed to be made of the information by the person is reasonably necessary for one or more of the purposes specified in subsection (2).  (2) The purposes for which the person may obtain, record, disclose or use protected information are as follows:  (a) the purpose of the institution complying with a request under section 25 to provide information;  (b) the purpose of the institution providing a direct personal response to a person under section 54;  (c) in the case of a participating institution—the purpose of the participating institution facilitating a claim under an insurance policy;  (d) in any case—the purpose of either of the following undertaking investigation and disciplinary procedures:  (i) the institution;  (ii) if the institution is a member of a participating group—another member of the group.  (3) However, before the person discloses information that relates to another person who has applied for redress, the person must have regard to the impact the disclosure might have on the other person.  (4) If the person obtains protected information for the purpose covered by subparagraph (2)(d)(ii), the person may record, disclose or use the protected information for only that purpose.