Article 40

A competent authority may transfer to a supervisory authority of a third country data and the analysis of data where the conditions laid down in Article 25 or 26 of Directive 95/46/EC are fulfilled but such transfer shall be made only on a case-by-case basis. The competent authority shall be satisfied that the transfer is necessary for the purposes of this Regulation. Any such transfer shall be made under agreement that the third country shall not transfer the data to the supervisory authority of another third country without the express written authorisation of the competent authority.

A competent authority shall disclose information which is confidential pursuant to Article 34 and which is received from a competent authority of another Member State to a supervisory authority of a third country only where the competent authority has obtained the express agreement of the competent authority which transmitted the information and, where applicable, the information is disclosed solely for the purposes for which that competent authority gave its agreement.