Recital 8

(8)Where a transfer of audit working papers or other documents held by statutory auditors or audit firms and of inspection or investigation reports to the competent authorities of the People’s Republic of China involves the transfer of personal data, such a transfer is lawful only if it also complies with the requirements for international data transfers laid down in Regulation (EU) 2016/679 of the European Parliament and of the Council ² . Article 47(1)(e) of Directive 2006/43/EC therefore requires Member States to ensure that the transfer of personal data between their competent authorities and the competent authorities of the People’s Republic of China complies with any applicable data protection principles and rules and, in particular, with the provisions of Chapter V of Regulation (EU) 2016/679. Member States should ensure that appropriate safeguards for the transfer of personal data are provided for, in accordance with Article 46 of Regulation (EU) 2016/679. In addition, Member States should ensure that the competent authorities of the People’s Republic of China will not further disclose personal data contained in the documents transferred without the prior agreement of the competent authorities of the Member States concerned.