18. Circumstances of refusal to comply with the data access request. – (1) A data controller may refuse to comply with a data access request under section 16 if— (a) the data controller is not supplied with such information as the data controller may reasonably require— (i) to satisfy itself concerning the identity of the requestor; or (ii) where the requestor claims to be a relevant person to satisfy itself— (a) as to the identity of the data subject concerning whom the requestor claims to be the relevant person; and (b) that the requestor is the relevant person in relation to the data subject; (iii) to locate the personal data to which the data access request relates; (b) the data controller cannot comply with the data access request without disclosing personal data relating to another individual who can be identified from that information, unless— (i) another individual has consented to the disclosure of the information to the requestor; or (ii) it is reasonable in all the circumstances to comply with the data access request without receiving the consent of the other individual; (c) providing access may constitute a violation of any court order; (d) providing access may disclose confidential information relating to the business of the data controller; or (e) such access to personal data is regulated by another law. (2) In determining for the purposes of clause (ii) of subparagraph (b) of sub-section (1) whether it is reasonable in all the circumstances to comply with the data access request without the consent of the other individual, regard shall be given in particular to— (a) any duty of confidentiality owed to the other individual; (b) any steps taken by the data controller to seek the consent of the other individual; (c) whether the other individual is capable of giving consent; and (d) any express refusal of consent by the other individual. (3) Clause (c) of sub-section (1) shall not operate to excuse the data controller from complying with the data access request under sub-section (1) of section 16 to any extent that the data controller can comply with the data access request without contravening the prohibition concerned. 21