(1) Subject to paragraph (8), the Bank and all persons who work or who have worked for the Bank, including the persons referred to in Article 76(1) of Directive 2014/65/EU, shall comply with the obligation of professional secrecy for the purposes of these Regulations and of Regulation (EU) 2019/2033.

(2) In a case in which the Bank or a person referred to in paragraph (1) receives confidential information in the course of the Bank’s duties or the person’s duties, as the case may be, that information may be disclosed only where -

(a) the information is disclosed in summary or aggregate form, and

(b) individual investment firms or persons cannot be identified from the information that is disclosed.

(3) Paragraph (2) is without prejudice to any restrictions on the disclosure of information under the law of the State applicable to criminal proceedings.

(4) Where an investment firm has been declared bankrupt or is being compulsorily wound up, confidential information which does not concern third parties may be disclosed in civil proceedings, where such disclosure is necessary for carrying out those proceedings.