A service provider shall not access data retained in accordance with section 3 except -
(a) at the request and with the consent of a person to whom the data relate,
(b) for the purpose of complying with a disclosure requirement,
(c) in accordance with a court order, or
(d) as may be authorised by the Data Protection Commissioner.