1. Competent authorities of a Member State may transfer personal data to a third country provided that the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council [Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1).';] are fulfilled and only on a case-by-case basis. Competent authorities shall ensure that such a transfer is necessary for the purpose of this Regulation and that the third country does not transfer the data to another third country unless it is given express written authorisation to do so and complies with the conditions specified by the competent authority of the Member State concerned.

2. Competent authorities of a Member State shall only disclose personal data received from a competent authority of another Member State to a supervisory authority of a third country where the competent authority of the Member State concerned has obtained express agreement from the competent authority which transmitted the data and, where applicable, provided that the data are disclosed solely for the purposes for which that competent authority gave its agreement.