Chapter IX: Confidentiality, data protection, funding and penalties

Article 102: Confidentiality

1. Unless otherwise provided for in this Regulation and without prejudice to existing national provisions and practices in the Member States on confidentiality, all parties involved in the application of this Regulation shall respect the confidentiality of information and data obtained in carrying out their tasks in order to protect the following:

(a) personal data in accordance with Article 103;

(b) commercially confidential information and trade secrets of a natural or legal person, including intellectual property rights unless disclosure is in the public interest;

(c) the effective implementation of this Regulation, in particular for the purpose of inspections, investigations or audits.

2. Without prejudice to paragraph 1, information exchanged on a confidential basis between competent authorities and between competent authorities and the Commission shall not be disclosed without the prior agreement of the originating authority.

3. Paragraphs 1 and 2 shall not affect the rights and obligations of the Commission, Member States and notified bodies with regard to exchange of information and the dissemination of warnings, nor the obligations of the persons concerned to provide information under criminal law.

4. The Commission and Member States may exchange confidential information with regulatory authorities of third countries with which they have concluded bilateral or multilateral confidentiality arrangements.

Article 103: Data protection

1. Member States shall apply Directive 95/46/EC to the processing of personal data carried out in the Member States pursuant to this Regulation.

2. Regulation (EC) No 45/2001 shall apply to the processing of personal data carried out by the Commission pursuant to this Regulation.

Article 104: Levying of fees

1. This Regulation shall be without prejudice to the possibility for Member States to levy fees for the activities set out in this Regulation, provided that the level of the fees is set in a transparent manner and on the basis of cost-recovery principles.

2. Member States shall inform the Commission and the other Member States at least three months before the structure and level of fees is to be adopted. The structure and level of fees shall be made publicly available on request.

Article 105: Funding of activities related to designation and monitoring of notified bodies

The costs associated with joint assessment activities shall be covered by the Commission. The Commission shall, by means of implementing acts, lay down the scale and structure of recoverable costs and other necessary implementing rules. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 107(3).

Article 106: Penalties

The Member States shall lay down the rules on penalties applicable for infringement of the provisions of this Regulation and shall take all measures necessary to ensure that they are implemented. The penalties provided for shall be effective, proportionate, and dissuasive. The Member States shall notify the Commission of those rules and of those measures by 25 February 2022 and shall notify it without delay of any subsequent amendment affecting them.