1. EBA may disclose information received from supervisory authorities of third countries only where EBA or the competent authority that provided the information to EBA has obtained the express agreement of the supervisory authority of a third country that has transmitted the information and, where applicable, the information is disclosed only for the purposes for which that supervisory authority gave its agreement or where such disclosure is necessary for judicial proceedings.

2. The requirement for an express agreement as referred to in paragraph 1 shall not apply to other supervisory authorities of the Union where the information requested by them is needed for the fulfilment of their tasks and shall not apply to courts where the information requested by them is needed for investigations or proceedings in respect of infringements subject to criminal penalties.