The competent authority of a Member State shall only disclose personal data received from a competent authority of another Member State to a supervisory authority of a third country where the competent authority of the Member State concerned has obtained express agreement from the competent authority which transmitted the data and, where applicable, the data is disclosed solely for the purposes for which that competent authority gave its agreement.
Ní dhéanfaidh údarás inniúil Ballstáit na sonraí pearsanta a fhaightear ó údarás inniúil Ballstáit eile a nochtadh d’údarás maoirseachta tríú tíre ach amháin más rud é go bhfuil comhaontú sainráite faighte ag údarás inniúil an Bhallstáit lena mbaineann ón údarás inniúil a tharchuir na sonraí agus, i gcás inarb infheidhme, go ndéantar na sonraí a nochtadh chun na gcríoch lenar thug an t-údarás inniúil sin a chomhaontú, agus chun na gcríoch sin amháin.