28M. Application of sections 21 and 22 of Personal Data Protection Act 2012

Sections 21 and 22 of the Personal Data Protection Act 2012 do not apply to a prescribed financial institution in relation to any personal data about an individual that is in the possession or under the control of the prescribed financial institution if —

the personal data was risk information received by the prescribed financial institution under section 28D or 28E, including any correction to such risk information; or

the personal data was risk information accessed by the prescribed financial institution under section 28F, including any correction to such risk information.