1. Member States shall provide that competent authorities are to publish every decision on sanctions and measures imposed for a breach of this Directive without undue delay, including at least information on the type and nature of the breach and the identity of natural persons or legal entities responsible for it.

However, competent authorities may delay publication of a decision, or may publish the decision on an anonymous basis in a manner which is in conformity with national law, in any of the following circumstances:

(a) where, in the event that the sanction is imposed on a natural person, publication of personal data is found to be disproportionate by an obligatory prior assessment of the proportionality of such publication;

(b) where publication would seriously jeopardise the stability of the financial system or an ongoing official investigation;

(c) where publication would, in so far as can be determined, cause disproportionate and serious damage to the institutions or natural persons involved.