1 Member countries and their designated operators shall ensure the confidentiality and security of personal data in accordance with national legislation and, where applicable, international obligations, and the Regulations.

2 Personal data may be employed only for the purposes for which it was gathered in accordance with applicable national legislation and international obligations and prevention of money laundering, terrorist financing and financial crime.

3 Personal data shall be notified only to third parties authorized by applicable national legislation to access that data.

4 Designated operators shall inform their customers of the use that is made of their personal data, and of the purpose for which it has been gathered.

5 The data required to execute the postal payment order shall be confidential.

6 For statistical purposes, and possibly also for the purpose of quality of service measurement and centralized clearing, designated operators shall be required to provide the International Bureau of the Union with postal data at least once a year. The International Bureau shall treat all individual postal data in confidence.