I'm not sure if it has been mentioned yet, but assuming BASSA comply with the law when requested to do so, are they entitled to make whoever has requested the information sign a non-disclosure agreement?
As long as no irregularities come to light if/when the information is made available as requested.