618.Subsections (2), (3) and (4) define what is, and what is not, to be regarded as confidential information.  Subsection (1) makes clear that this information is not to be disclosed by a “primary recipient”, or a person who has received the information from a primary recipient, without the consent of the person from whom it was obtained and, if different, the person to whom it relates.  Subsection (5) lists primary recipients.
Commentary on Sections Part Xxiii: Public Record, Disclosure of Information and Co-Operation Section 348: Restrictions on disclosure of confidential information by Authority etc.