CHAPTER VI ROLE OF COMPETENT AUTHORITIES

Article 32

Each Member State shall designate one or more of the competent authorities for the purpose of this Regulation.

Where a Member State designates more than one competent authority, it shall clearly determine their respective roles and it shall designate the authority to be responsible for coordinating the cooperation and the exchange of information with the Commission, ESMA and the competent authorities of the other Member States.

Member States shall inform the Commission, ESMA and the competent authorities of the other Member States of those designations.

Article 35

The competent authorities shall cooperate where necessary or expedient for the purposes of this Regulation. In particular, the competent authorities shall, without undue delay, supply each other with information which is relevant for the purposes of carrying out their duties under this Regulation.

Article 36

The competent authorities shall cooperate with ESMA for the purposes of this Regulation in accordance with Regulation (EU) No 1095/2010.

The competent authorities shall provide, without delay, ESMA with all the information necessary to carry out its duties in accordance with Regulation (EU) No 1095/2010.

Article 39

With regard to transfer of personal data between Member States or between Member States and a third country, Member States shall apply Directive 95/46/EC. With regard to transfer of personal data by ESMA to Member States or to a third country, ESMA shall comply with Regulation (EC) No 45/2001.

Personal data referred to in the first paragraph shall be retained for a maximum period of 5 years.

Article 40

A competent authority may transfer to a supervisory authority of a third country data and the analysis of data where the conditions laid down in Article 25 or 26 of Directive 95/46/EC are fulfilled but such transfer shall be made only on a case-by-case basis. The competent authority shall be satisfied that the transfer is necessary for the purposes of this Regulation. Any such transfer shall be made under agreement that the third country shall not transfer the data to the supervisory authority of another third country without the express written authorisation of the competent authority.

A competent authority shall disclose information which is confidential pursuant to Article 34 and which is received from a competent authority of another Member State to a supervisory authority of a third country only where the competent authority has obtained the express agreement of the competent authority which transmitted the information and, where applicable, the information is disclosed solely for the purposes for which that competent authority gave its agreement.

Article 41

Member States shall establish rules on penalties and administrative measures, applicable to infringements of this Regulation and shall take all measures necessary to ensure that they are implemented. Those penalties and administrative measures shall be effective, proportionate and dissuasive.

In accordance with Regulation (EU) No 1095/2010, ESMA may adopt guidelines to ensure a consistent approach is taken concerning the penalties and administrative measures to be established by Members States.

Member States shall notify the Commission and ESMA of the provisions referred to in the first and second subparagraphs by 1 July 2012 and shall notify them without delay of any subsequent amendment affecting those provisions.

ESMA shall publish on its website and update regularly a list of existing penalties and administrative measures applicable in each Member State.

Member States shall provide ESMA annually with aggregate information regarding the penalties and administrative measures imposed. If a competent authority discloses to the public the fact that a penalty or an administrative measure has been imposed, it shall, contemporaneously, notify ESMA thereof.