A person who receives personal information from a personal information controller shall not use the personal information, or provide it to a third party, for any purpose other than the intended one, except in the following circumstances:

1. Where separate consent is obtained from the data subject;
2. Where special provisions exist in other statutes.