Which statement regarding the confidentiality of documented information related to or collected from the auditee...

The certification body notifies the auditee before disclosing information, considering all types of information as confidential unless already public

Confidential information related to the auditee's AIMS can be disclosed without prior notice if legally required or contractually authorized

Information from external sources, like regulators or complaints, is automatically public and can be disclosed without restriction

Auditors and certification bodies must protect the confidentiality of auditee information unless legal or contractual disclosure is required