I understand. That is why I did not choose to add subsection (4).
I nevertheless maintain that, at the end of subsection (3), in view of the fact that subsection 5.393(1) states: “If an operator of aircraft has a management system [...]”, he must not disclose personal information and so on. I would have said: “If an operator of aircraft cannot use information gathered in a process [...]”.
You say: “A holder of a Canadian aviation document [...].” If you're telling me that's the same as an operator of aircraft, I'm going to make the correlation. Otherwise, subsection (3) should be as in subsection (1), “an operator of aircraft [...].”