With regard to transfer of personal data between Member States or between Member States and a third country, Member States shall apply Directive 95/46/EC. With regard to transfer of personal data by ESMA to Member States or to a third country, ESMA shall comply with Regulation (EC) No 45/2001.
Personal data referred to in the first paragraph shall be retained for a maximum period of 5 years.