The competent authority of a Member State may transfer personal data to a third country provided the requirements of Directive 95/46/EC are fulfilled and only on a case-by-case basis. The competent authority shall ensure that the transfer is necessary for the purpose of this Regulation and that the third country does not transfer the data to another third country unless it is given express written authorisation and complies with the conditions specified by the competent authority of the Member State.

The competent authority of a Member State shall only disclose personal data received from a competent authority of another Member State to a supervisory authority of a third country where the competent authority of the Member State concerned has obtained express agreement from the competent authority which transmitted the data and, where applicable, the data is disclosed solely for the purposes for which that competent authority gave its agreement.

Where a cooperation agreement provides for the exchange of personal data, it shall comply with the national laws, regulations or administrative provisions transposing Directive 95/46/EC.