Commission Decision of 19 December 2007 laying down rules for the implementation of Decision No 573/2007/EC of the European Parliament and of the Council establishing the European Refugee Fund for the period 2008 to 2013 as part of the General programme ‘Solidarity and Management of Migration Flows’ as regards Member States’ management and control systems, the rules for administrative and financial management and the eligibility of expenditure on projects co-financed by the Fund (notified under document number C(2007) 6396) (Only the Bulgarian, Czech, Dutch, English, Estonian, Finnish, French, German, Greek, Hungarian, Italian, Latvian, Lithuanian, Maltese, Polish, Portuguese, Romanian, Slovak, Slovenian, Spanish and Swedish texts are authentic) (2008/22/EC)

Article 36 Protection of personal data

1. Member States and the Commission shall take all necessary measures to prevent any unauthorised disclosure of, or illegitimate access to, the information referred to in Article 27(1)(h) of the basic act, information collected by the Commission in the course of its on-the-spot checks and the information referred to in Chapter 4.

2. The information referred to in Chapter 4 may not be sent to persons other than those in the Member States or within the Community institutions whose duties require that they have access to it, unless the Member State supplying such information has expressly agreed so.