39. (1) Subject to this section, a person may—

(a) when making an application under section 38(3), or

(b) where there is an entry in the register in respect of him or her,

lodge with the Authority information or an item which the person wishes to be shared with such person as he or she may specify.

(2) Information or items lodged under subsection (1) may contain sealed information or communications from the person for the person specified under that subsection.

(3) The lodgement of information or an item under subsection (1) shall be done in such manner, and be accompanied by such information, as the Authority may specify.

(4) The Authority shall accept a lodgement of information under subsection (1) only where—

(a) it has informed the person making the lodgement of the following:

(i) the purpose for which, and the legal basis on which, personal data, including special categories of personal data, contained in the information may be processed;

(ii) the circumstances in which the information may be disclosed to a third party;

(iii) his or her right to make a request under subsection (6),

and

(b) the person making the lodgement has, in such manner as may be specified by the Authority, provided his or her consent to the Authority complying with subsection (5).

(5) The Authority, where it accepts a lodgement under subsection (1), shall—

(a) if no such entry in the register exists, make, in accordance with section 38, an entry in respect of the person who made the lodgement,

(b) record the lodgement in the entry in the register relating to the person,

(c) create a reference number that links the information or item lodged with the entry on the register in respect of the person, and

(d) safeguard the information or item lodged.

(6) A person who has made a lodgement under subsection (1) may, in such manner as may be specified by the Authority, request the Authority to return the information or item concerned and, where the information or item has not been provided to the persons concerned under section 40, the Authority shall comply with the request.