Any information gained in the course of certification activities about a particular commodity or organization shall be treated as confidential, and it shall not be disclosed to a third party without the written consent of the organization. Where the law requires information to be disclosed to a third party, the organization shall be informed of the information to be provided as permitted by law.