Article 36Protection of personal data
1.Member States and the Commission shall take all necessary measures to prevent any unauthorised disclosure of, or illegitimate access to, the information referred to in Article 27(1)(h) of the basic act, information collected by the Commission in the course of its on-the-spot checks and the information referred to in Chapter 4.
2.The information referred to in Chapter 4 may not be sent to persons other than those in the Member States or within the Community institutions whose duties require that they have access to it, unless the Member State supplying such information has expressly agreed so.