1. The ECB and the NCAs shall each define and implement authorisation rules and logical protection measures governing their staff's access to confidential statistical information.
2. Without prejudice to the continuity of the system administration function, the minimum protection measure to be implemented shall be a unique user identifier and personalised password.
3. All appropriate measures shall be taken to ensure that confidential statistical information is arranged in such a way that any published data covers at least three economic agents. Where one or two economic agents make up a sufficiently large proportion of any observation to make them indirectly identifiable, published data shall be arranged in such a way as to prevent their indirect identification. These rules shall not apply if the reporting agents or the other legal persons, natural persons, entities or branches that can be identified have explicitly given their consent to disclosure.