I think you were told by officials that section 5 deals with disclosure. It is true that it deals with disclosure, i.e. not receipt, but once the disclosure has occurred under the relevance test, there is nothing that says—certainly not explicitly anyway, and I think it would be extremely ambiguous at best—what a receiving institution should do.
CSIS, under its legislation, has a clear collection-test necessity. I'm less concerned about it, but I'm concerned about all the other receiving institutions that may not have that kind of test.