Then I'll get your answer differently for my first question.
Under SCISA, institutions can disclose information if it's relevant to the recipient institution's mandate. It does not change the recipient institution's mandate.
I have two questions. Should the recipient institution be subject to a necessity collection requirement, and should we clarify in black and white that SCISA has not changed their mandate, because there has been some confusion in the academic literature to this effect?