CHAPTER VIIGENERAL AND FINAL PROVISIONS
Article 25Data protection
F11.
All exchange of information pursuant to this Directive shall be subject to the provisions implementing Directive 95/46/EC. However, Member States shall, for the purpose of the correct application of this Directive, restrict the scope of the obligations and rights provided for in Article 10, Article 11(1), Articles 12 and 21 of Directive 95/46/EC to the extent required in order to safeguard the interests referred to in Article 13(1)(e) of that Directive.
F21a.
Regulation (EC) No 45/2001 applies to any processing of personal data under this Directive by the Union institutions and bodies. However, for the purpose of the correct application of this Directive, the scope of the obligations and rights provided for in Article 11, Article 12(1), Articles 13 to 17 of Regulation (EC) No 45/2001 is restricted to the extent required in order to safeguard the interests referred to in point (b) of Article 20(1) of that Regulation.
F32.
Reporting Financial Institutions and the competent authorities of each Member State shall be considered to be data controllers for the purposes of Directive 95/46/EC.
3.
Notwithstanding paragraph 1, each Member State shall ensure that each Reporting Financial Institution under its jurisdiction informs each individual Reportable Person concerned that the information relating to him referred to in Article 8(3a) will be collected and transferred in accordance with this Directive and shall ensure that the Reporting Financial Institution provides to that individual all information that he is entitled to under its domestic legislation implementing Directive 95/46/EC in sufficient time for the individual to exercise his data protection rights and, in any case, before the Reporting Financial Institution concerned reports the information referred to in Article 8(3a) to the competent authority of its Member State of residence.
4.
Information processed in accordance with this Directive shall be retained for no longer than necessary to achieve the purposes of this Directive, and in any case in accordance with each data controller's domestic rules on statute of limitations.