Article 25 — Identification and protection of confidential information

1. Any information, documents or parts of documents shall be considered confidential in so far as they contain trade secrets as defined in Directive (EU) 2016/943 of the European Parliament and the Council or other confidential information in accordance with Union or national law. 2. Unless otherwise provided for by Union or national law, information collected, produced or obtained by a supervisory authority in a case concerning cross-border processing under Regulation (EU) 2016/679, which is considered confidential pursuant to paragraph 1, shall not be communicated or made accessible to a party under investigation, a complainant or any third person. 3. A party under investigation, a complainant, or a third person submitting information that it considers to be confidential shall clearly identify that information, giving reasons for the confidentiality claimed. The party under investigation, complainant, or third person shall always provide the full version of the information. Where possible, it shall also provide a proposed non-confidential version. 4. Without prejudice to paragraph 3, the supervisory authority to which the information is submitted may require the parties under investigation, or any other person that submits documents, to identify the documents or parts of documents that they consider to contain trade secrets or other confidential information belonging to them and to identify the persons concerned with regard to the confidentiality of those trade secrets or other confidential information. 5. The supervisory authority to which the information is submitted shall set an appropriate time-limit no longer than six weeks for parties under investigation and any other person claiming that the information submitted is confidential to: (a) substantiate their claims that the information submitted contains trade secrets or other confidential information for each individual document or part of document, statement, or part of statement; (b) propose, where possible, a non-confidential version of the documents and statements, in which the trade secrets or other confidential information are redacted; (c) provide a concise, non-confidential, description of each piece of redacted information. 6. If the parties under investigation or any other person fails to comply with paragraphs 4 and 5, the supervisory authority to which the information is submitted may assume that the documents or statements concerned do not contain trade secrets or other confidential information. 7. The supervisory authority to which the information is submitted shall determine whether or not the information or relevant and specific parts of documents are confidential, in accordance with paragraph 1. It shall ensure that the redaction of documents is limited to what is necessary and proportionate to protect the confidential information. The supervisory authority to which the information is submitted shall inform the other supervisory authorities about the confidential nature of the information when transmitted. 8. Information regarded as confidential information under the national law of the supervisory authority to which the information is submitted and exchanged between supervisory authorities in the application of Regulation (EU) 2016/679, shall continue to be treated as confidential by the supervisory authority receiving it.