
Article 1 
Annex II to Directive 2006/87/EC is amended as set out in the Annex to this Directive.
Article 2 
Member States which have inland waterways as referred to in Article 1(1) of Directive 2006/87/EC shall bring into force the laws, regulations and administrative provisions necessary to comply with this Directive within one year from its entry into force. They shall forthwith communicate to the Commission the text of those provisions.
When Member States adopt those provisions, they shall contain a reference to this Directive or be accompanied by such a reference on the occasion of their official publication. Member States shall determine how such reference is to be made.
Article 3 
All processing of personal data for the purposes of this Directive shall be in accordance with Directive 95/46/EC and Regulation (EC) No 45/2001.
Article 4 
This Directive shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.
Article 5 
This Directive is addressed to the Member States which have inland waterways as referred to in Article 1(1) of Directive 2006/87/EC.
Done at Brussels, 11 October 2013.
For the Commission
The President
José Manuel BARROSO
ANNEX

In Annex II to Directive 2006/87/EC, Article 2.18(6) is replaced by the following:
'
6. 
Member States shall, in accordance with Union and national legislation, take the necessary measures to ensure the confidentiality and reliability of information sent to them pursuant to this Directive and shall only use such information in compliance with this Directive.

The competent authority of a Member State may transfer personal data to a third country or international organisation provided the requirements of Directive 95/46/EC of the European Parliament and of the Council, particularly of Articles 25 or 26, are fulfilled and only on a case-by-case basis. The competent authority of the Member State shall ensure that the transfer is necessary for the purposes referred to in subparagraph 1. The competent authority shall ensure that the third country or international organisation does not transfer the data to another third country or international organisation unless it is given express written authorisation and complies with the conditions specified by the competent authority of the Member State.

The transfer of personal data to a third country or international organisation by the Commission shall be carried out provided the requirements of Article 9 of Regulation (EC) No 45/2001 of the European Parliament and of the Council are fulfilled and only on a case-by-case basis. The Commission shall ensure that the transfer is necessary for the purposes referred to in subparagraph 1. The Commission shall ensure that the third country or international organisation does not transfer the data to another third country or international organisation unless it is given express written authorisation and complies with the conditions specified by the Commission.
'
