1. With regard to transfer of personal data between competent authorities, competent authorities shall apply Directive 95/46/EC. With regard to transfer of personal data by ESMA to the competent authorities of a Member State or of a third country, ESMA shall comply with Regulation (EC) No 45/2001.
2. Data shall be retained for a maximum period of 5 years.