An information management system that is shared by a payment card scheme and a processing entity shall ensure that:
((a))
the staff of the payment card scheme and of the processing entity are separately identified via the authentication procedure to access the information management system;
((b))
users only have access to information which they are entitled to in compliance with this Regulation. In particular, any sensitive information, as referred to in Article 14, of a processing entity shall not be accessed by the staff of the payment card scheme and any sensitive information of a payment card scheme shall not be accessed by the staff of the processing entity.