My understanding of the Certificate of Confidentiality as described on this site, is that no disclosure need be made unless X condition makes it mandatory or unless the holder of the certificate or the subject choose to disclose something. So like all assurances of confidentiality that I have received, showing someone a certificate pretty much translates into layman's terms as "We won't disclose anything... unless we have to or we feel like it."

Please understand this is nothing against you, it's just that I have been bitten by this kind of thing before. These assurances that confidentiality will be respected seem crafted to convince us that they are cast iron if we don't look too closely, while allowing enough exceptions that they can be easily circumvented if you look at the details.

Also, as jeep has pointed out below, the certificate seems to cover a different site to the one collecting the data.