(1) Schedule 4 (conditions for permitted disclosure) is amended as follows.
(2) After Part 2 insert -
"PART 2A Disclosure to a Credit Institution or a Financial Institution
12A. The credit institution or financial institution maintains appropriate procedures -
(a) to ensure that an independent person can investigate and audit the measures maintained by that institution for the purposes of ensuring the security of any information disclosed to it; and
(b) for the purpose of ensuring that it complies with its obligations under the Data Protection Act 1998 [1998 c.29.], or, where the institution carries on business in an EEA State other than the United Kingdom, with its obligations under any other legislation implementing Directive 95/46/EC [OJ No L 281, 23.11.1995 p.31.] of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data.
12B. The credit institution or financial institution has
…