1. Subject to the third subparagraph, competent authorities shall publish any decision imposing an administrative sanction or other administrative measure in relation to an infringement of this Regulation on their website immediately after the person subject to that decision has been informed of that decision. Such publication shall include at least information on the type and nature of the infringement and the identity of the person subject to the decision.

The first subparagraph does not apply to decisions imposing measures that are of an investigatory nature.

Where a competent authority considers that the publication of the identity of the legal person subject to the decision, or of the personal data of a natural person, would be disproportionate following a case-by-case assessment conducted on the proportionality of the publication of such data, or where such publication would jeopardise an ongoing investigation or the stability of the financial markets, it shall do any of the following:

(a) defer publication of the decision until the reasons for that deferral cease to exist;

(b) publish the decision on an anonymous basis in accordance with national law where such publication ensures the effective protection of the personal data concerned;

(c) not publish the decision in the event that the competent authority is of the opinion that publication in accordance with point (a) or (b) will be insufficient to ensure: