Member States and the Commission shall take all necessary measures to prevent any unauthorised disclosure of, or access to, the information referred to in Article 14(1), information collected by the Commission in the course of its audits and information referred to in Section 4.

The information referred to in Article 14(1), together with information collected by the Commission in the course of its audits, shall be used by the Commission for the sole purpose of fulfilling its responsibilities pursuant to Article 72 of Regulation (EC) No 1083/2006. The European Court of Auditors and the European Anti-Fraud Office shall have access to that information.

The information referred to in Section 4 may not be sent to persons other than those in the Member States or within the Community institutions whose duties require that they have access to it, unless the Member State supplying such information has expressly so agreed.

Any personal data included in the information referred to in Article 7(2) (d) shall be processed only for the purpose specified in that Article.