Personal Data Protection 33 (B) that the requestor is the relevant person in relation to the data subject; (b) the data user is not supplied with such information as he may reasonably require to locate the personal data to which the data access request relates; (c) the burden or expense of providing access is disproportionate to the risks to the data subject’s privacy in relation to the personal data in the case in question; (d) the data user cannot comply with the data access request without disclosing personal data relating to another individual who can be identified from that information, unless— (i) that other individual has consented to the disclosure of the information to the requestor; or (ii) it is reasonable in all the circumstances to comply with the data access request without the consent of the other individual; (e) subject to subsection (3), any other data user controls the processing of the personal data to which the data access request relates in such a way as to prohibit the first-mentioned data user from complying, whether in whole or in part, with the data access request; (f) providing access would constitute a violation of an order of a court; (g) providing access would disclose confidential commercial information; or (h) such access to personal data is regulated by another law. (2) In determining for the purposes of subparagraph (1)(d)(ii) whether it is reasonable in all the circumstances to comply with the data access request without the consent of the other individual, regard shall be had, in particular, to— (a) any duty of confidentiality owed to the other individual; (b) any steps taken by the data user with a view to seeking the consent of the other individual;