This new paragraph clarifies for organizations the circumstances under which they may accede at their discretion to the legitimate requests of government institutions for personal information, for national security, law enforcement and administrative purposes where they have lawful authority.
Organizations can often decide for themselves whether they would like to share personal information with government institutions. 