The key area to be considered is the Protection of Privacy Law; for example, does such sharing require consent of the data subject? The general rule is that sharing/disclosure of identified data requires informed consent, while sharing/disclosure of properly de-identified data does not.