Recital 6

(6)Where a transfer of audit working papers or other documents held by statutory auditors or audit firms and of inspection or investigation reports to the competent authority of the United Kingdom involves the transfer of personal data, such a transfer is lawful only if it also complies with the requirements for international data transfers laid down in Regulation (EU) 2016/679 of the European Parliament and of the Council ² . Article 47(1), point (e), of Directive 2006/43/EC therefore requires Member States to ensure that the transfer of personal data between their competent authorities and the competent authority of the United Kingdom complies with any applicable data protection principles and rules and, in particular, with the provisions of Chapter V of Regulation (EU) 2016/679. Member States should ensure that appropriate safeguards for the transfer of personal data are provided for, in accordance with Commission Implementing Decision (EU) 2021/1772 of 28 June 2021 (‘United Kingdom data protection adequacy decision’) ³ . In addition, Member States should ensure that the competent authority of United Kingdom will not further disclose personal data contained in the documents transferred without the prior agreement of the competent authorities of the Member States concerned.