as well as personal and sensitive information. Such access does not require the consent of the persons deprived of liberty concerned,42 nor can such access be limited to only some members of NPMs (such as limiting access to medical files to members of NPMs with a medical background). IV. The principle of confidentiality Confidential information collected by the NPMs shall be privileged.43 NPMs cannot publish any personal data without the express consent of the person(s) concerned. The principle of confidentiality should be strictly observed. This principle should be given the widest possible interpretation in order to reflect the preventive spirit of the Optional Protocol. The principle of confidentiality extends to a broad range of persons including, but not limited to, persons deprived of their liberty, their families, lawyers, members of NGOs and State officials. The confidentiality obligation should not prevent NPMs from disseminating information, provided that such information does not include personal data or information that would allow identification of a person, unless there is express consent. For example, where information relating to systematic allegations of torture or other crimes is gathered, its existence can be reported in general terms. However, particular care must be taken to assess whether the sharing of information relating to a particular situation or crime might inevitably lead to the disclosure of personal data or to the identification of a person who has not given express consent for their personal data to be revealed (see also Protection against Reprisals). NPMs should establish policies for working with external experts and specialists. Such policies should include the responsibility of external experts for keeping confidential any data acquired in the course of their work with the NPMs, and for not using the data for any external purpose, in order to maintain the relationship of trust between persons deprived of their liberty and the NPMs. V. Protection against reprisals for providing information to NPMs Preventing and addressing reprisals against persons who have provided information to NPMs is an important part of NPMs’ mandates. While NPMs do not have a mandate to investigate allegations of reprisals, they should: 1. systematically remind States of their obligations to ensure the prohibition of reprisals in all places of detention, including informing the staff of all places of detention accordingly, and setting up investigative mechanisms to address allegations of reprisals; and 2. monitor fulfilment of these obligations. NPMs should develop strategies for preventing reprisals. Reprisals may take different forms, including threats against detention centre staff, detainees, persons interviewed during visits and others who may provide information both before or after visits. The strategies should also address reprisals that may be made against members and staff of the NPMs, and should include, inter alia: uuPolicies for the collection of information through group and private interviews. Whenever sensitive information is obtained during private interviews, a number of additional private interviews should be conducted to preserve the anonymity of the sources of this information. 42 According to rule 9 of the Nelson Mandela Rules, the information in the prisoner file management system “shall be kept confidential and made available only to those whose professional responsibilities require access to such records”. 43 Article 21 (2) of the Optional Protocol. KEY CRITERIA FOR AN EFFECTIVE NATIONAL PREVENTIVE MECHANISM I 23