Without prejudice to Articles 4, 5, 6 and 10:
1. Personal data shall only be transferred within or to other Community institutions or bodies if the data are necessary for the legitimate performance of tasks covered by the competence of the recipient.
2. Where the data are transferred following a request from the recipient, both the controller and the recipient shall bear the responsibility for the legitimacy of this transfer.
The controller shall be required to verify the competence of the recipient and to make a provisional evaluation of the necessity for the transfer of the data. If doubts arise as to this necessity, the controller shall seek further information from the recipient.
The recipient shall ensure that the necessity for the transfer of the data can be subsequently verified.
3. The recipient shall process the personal data only for the purposes for which they were transmitted.