Article 29 2.

Competent authorities of a Member State shall only disclose personal data received from a competent authority of another Member State to a supervisory authority of a third country where the competent authority of the Member State concerned has obtained express agreement from the competent authority which transmitted the data and, where applicable, provided that the data are disclosed solely for the purposes for which that competent authority gave its agreement.