(1) Subject to subsection (2), a person to whom a disclosure order is addressed—
(a) shall be entitled to use any key in his or her possession to obtain access to the protected information; and
(b) in accordance with the disclosure order, shall disclose the protected information in an intelligible form.
(2) Where a disclosure order requires the person to whom it is addressed to disclose protected information in an intelligible form, that person shall be taken to have complied with that requirement if—
(a) he or she makes instead, a disclosure of any key to the protected information that is in his or her possession; or
(b) the disclosure is made in accordance with the order, with respect to the person to whom and the time in which, he or she was required to disclose the information.
(3) When a disclosure order requiring access to protected information or the putting of protected information into intelligible form, is addressed to a person who is—
(a) not in possession of the protected information to which the order relates; or
(b) incapable, without the use of a key that is not in his or her possession, of obtaining access to the protected information or disclosing it in an intelligible form,
he or she shall be taken to have complied with the order if he or she discloses any key to the protected information that is in his or her possession.
(4) It shall be sufficient for the purposes of complying with a disclosure order for the person to whom it is addressed to disclose only those keys, the disclosure of which is sufficient to enable the person to whom they are disclosed to obtain access to the protected information and to put it in an intelligible form.
(5) Where—
(a) the disclosure required by a disclosure order under this section allows the person to whom it is addressed to comply with the disclosure order without disclosing all of the keys in his or her possession; and
(b) there are different keys, or combination of keys, in the possession of the person referred to in paragraph (a), the disclosure of which would constitute compliance with the order;
that person may select which of the keys, or combination of keys, to disclose for the purposes of complying with the disclosure order.
(6) Where a disclosure order is addressed to a person who—
(a) was in possession of a key to protected information but is no longer in possession of it; and
(b) if he or she had continued to have the key to the protected information in his or her possession, would be required by virtue of the order to disclose it; and
(c) is in possession of information that would facilitate the obtaining of discovery of the key to the protected information or the putting of the protected information into an intelligible form;
that person shall disclose to the person to whom he or she would have been required to disclose the key, all such information as is mentioned in paragraph (c) for the purpose therein mentioned.
(7) A person who, without reasonable excuse fails to comply with a disclosure order commits an offence and is liable on summary conviction on indictment to a fine not exceeding $5,000 or to a term of imprisonment not exceeding one year or to both.
(8) A person who obtains a disclosure order shall ensure that such arrangements are made as are necessary for ensuring that—
(a) a key disclosed under the disclosure order is used to obtain access to or put into intelligible form only the protected information in relation to which the order was given;
(b) every key disclosed under the disclosure order is stored, for so long as it is retained, in a secure manner, and any records of such key are destroyed as soon as no longer needed to access the information or put it in an intelligible form; and
(c) the number of—
(i) persons to whom the key is disclosed or otherwise made available, and
(ii) copies made of the key,
is limited to the minimum that is necessary for the purpose of enabling the protected information to be accessed or put into an intelligible form.
(9) Subject to subsection (10) of this section, where any relevant person incurs any loss or damage as a consequence of a breach by a person referred to in subsection (8) of the duty imposed upon him or her by that subsection, the breach shall be actionable against the person referred to in subsection (8) at the suit or instance of the relevant person.
(10) A person is a relevant person for the purposes of subsection (9) if he or she is—
(a) a person who has made a disclosure in pursuance of a disclosure order made under section 21; or
(b) a person whose protected information or key has been disclosed under a disclosure order made under section 21,
and loss or damage shall be taken into account for the purposes of section 21 to the extent only that it relates to the disclosure of a particular protected information or a particular key which, in the case of a person falling within paragraph (b), shall be his or her information or key.
(11) For the purposes of subsection (10)—
(a) information belongs to a person if he or she has any right that would be infringed by an unauthorised disclosure of the information; and
(b) a key belongs to a person if it is a key to information that belongs to him or her or he or she has any right that would be infringed by an unauthorised disclosure of the key.