The competent authority of a Member State may transfer to a third country data and the analysis of data on a case-by-case basis where the conditions laid down in Article 25 or 26 of Directive 95/46/EC are met and where the competent authority of the Member State is satisfied that the transfer is necessary for the purpose of this Directive. The third country shall not transfer the data to another third country without the express written authorisation of the competent authority of the Member State.

The competent authority of a Member State shall only disclose information received from a competent authority of another Member State to a supervisory authority of a third country where the competent authority of the Member State concerned has obtained express agreement of the competent authority which transmitted the information and, where applicable, the information is disclosed solely for the purposes for which that competent authority gave its agreement.