Publication of measures and sanctions for breaches of Regulation (EU) 2015/2365, Regulation (EU) 2016/1011, Regulation (EU) 2017/2402, or Regulation (EU) 2022/2554

(1) The supervisory authority publishes decisions on measures and sanctions issued on account of breaches of Regulation (EU) 2015/2365 or Regulation (EU) 2016/1011, or of delegated acts based on these Regulations, on its website without delay after informing the natural or legal person against whom the measure or sanction was imposed. The supervisory authority publicly announces decisions on final measures and regulatory-fine decisions that have become unappealable, issued on account of breaches of Regulation (EU) 2022/2554 or of the delegated acts based on it, on its website without delay.
(2) In the publication, the supervisory authority names the provision that was breached, and the natural or legal person or association of persons responsible for the breach.
(3) Where publication of the identity of a legal person affected by the decision, or of the personal data of a natural person, is disproportionate, or where publication would endanger ongoing investigations or the stability of the financial markets, then
1. the supervisory authority postpones publication of the decision until the reasons for the postponement have ceased to apply,
2. the supervisory authority publishes the decision without naming the identity or the personal data, where this ensures effective protection of the identity or the personal data concerned, or
3. the supervisory authority does not publish the decision, where a publication under points 1 and 2 would not be sufficient to ensure that
a) the stability of the financial markets is not endangered, or
b) the proportionality of the publication is maintained.
(4) For decisions that have not become final or become res judicata, the supervisory authority adds a corresponding notice. Where a legal remedy is lodged against the decision to be published, the supervisory authority supplements the publication without delay with a reference to the legal remedy, and with all further information on the outcome of the legal remedy proceedings.
(5) A publication under subsection (1) must be deleted five years after its publication. By way of derogation from the first sentence, personal data must be deleted as soon as their publication is no longer necessary.
(6) For final measures and regulatory-fine decisions that have become unappealable, issued on account of a breach of Articles 6, 7, 9, or 27(1) of Regulation (EU) 2017/2402, subsections (1) to (3) and (5) apply correspondingly, on the understanding that the publication also covers the measures and regulatory-fine decisions imposed, and that, in the proportionality review under subsection (3), it is examined whether the publication would cause disproportionate harm to the persons involved.