(1) The NIS enforcement authorities may share information with each other, relevant law-enforcement authorities, the CSIRT, and public authorities in the EU if that information sharing is -

(a) necessary for -

(i) the purposes of these Regulations or of facilitating the performance of any functions of a NIS enforcement authority under or by virtue of these Regulations or any other enactment;

(ii) national security purposes; or

(iii) purposes related to the prevention or detection of crime, the investigation of an offence or the conduct of a prosecution;

(b) limited to information which is relevant and proportionate to the purpose of the information sharing.

(1A) Information shared under paragraph (1) may not be further shared by the person with whom it is shared under that paragraph for any purpose other than a purpose mentioned in that paragraph unless otherwise agreed by the NIS enforcement authority.

(2) When sharing information with a public authority in the EU under paragraph (1), the NIS enforcement authorities are not required to share -

(a) confidential information, or

(b) information which may prejudice the security or commercial interests of operators of essential services or digital service providers.