1. The Ombudsman and his staff, to whom Article 287 of the Treaty establishing the European Community and Article 194 of the Treaty establishing the European Atomic Energy Community shall apply, shall be required not to divulge information or documents which they obtain in the course of their inquiries. They shall, in particular, be required not to divulge any classified information or any document supplied to the Ombudsman, in particular sensitive documents within the meaning of Article 9 of Regulation (EC) No 1049/2001, or documents falling within the scope of Community legislation regarding the protection of personal data, as well as any information which could harm the person lodging the complaint or any other person involved, without prejudice to paragraph 2.
2. If, in the course of inquiries, he learns of facts which he considers might relate to criminal law, the Ombudsman shall immediately notify the competent national authorities via the Permanent Representations of the Member States to the European Communities and, insofar as the case falls within its powers, the competent Community institution, body or service in charge of combating fraud; if appropriate, the Ombudsman shall also notify the Community institution or body with authority over the official or servant concerned, which may apply the second paragraph of Article 18 of the Protocol on the Privileges and Immunities of the European Communities. The Ombudsman may also inform the Community institution or body concerned of the facts calling into question the conduct of a member of their staff from a disciplinary point of view.]