12. (1) Subject to subsections (2) to (4), the Bank may provide any data collected by it under section 8 to any person, on request being made of it in that behalf by the person.

(2) Data shall not be provided to a person under this section such that there is identifiable, from the data, any insurance undertaking or individual.

(3) Data shall not be provided to a person under this section if the Bank considers that—

(a) the provision of the data would involve a disclosure of information seriously prejudicial to the legitimate interests of consumers or of any company or other undertaking, or

(b) the data are not likely to be of value to the person by reason of—

(i) the Bank being of the opinion that the data are not complete or have not been sufficiently verified, or

(ii) any other exceptional circumstances.

(4) The Bank may stipulate that the provision of data under this section to a person is subject to compliance by the person with such one or more conditions as the Bank determines for the purposes of this section and, before the provision of any data under this section to the person, the Bank may require the person to give to it an undertaking in writing that the person will comply with those conditions.