4.2.1 The laboratory shall be responsible through legally enforceable commitments, for the management of all information obtained or created during the performance of laboratory activities. The laboratory shall inform the customer in advance, of the information it intends to place in the public domain. Except for the information the customer makes publicly available, or when agreed between the laboratory and the customer{e.g. for the purpose of responding to complaints}, all other information is considered proprietary information and shall be regarded as confidential.
4.2.3 Information about the customer obtained from sources other than the customer{ e.g. complainant, regulators}shall be confidential between the customer and the laboratory. The provider{source} of this information shall be confidential to the laboratory and shall not be shared with the customer, unless agreed by source."
