Such information may be provided on a need-to-know basis only to persons authorized by law or regulation to receive it .
The process to be legally authorized to receive this information , is a lengthy one .