1. The obligation of professional secrecy shall apply to ESMA, the competent authorities, and all persons who work or who have worked for ESMA, for the competent authorities or for any other person to whom ESMA has delegated tasks, including auditors and experts contracted by ESMA. Information covered by professional secrecy shall not be disclosed to another person or authority except where such disclosure is necessary for legal proceedings.

2. All the information that, under this Regulation, is acquired by, or exchanged between, ESMA, the competent authorities, the sectoral competent authorities or other authorities and bodies referred to in Article 27(2), shall be considered confidential, except where ESMA or the competent authority or other authority or body concerned states at the time of communication that such information may be disclosed or where such disclosure is necessary for legal proceedings.