As per Section 243(10)(b) of the Enterprise Act 2002, information disclosed to an overseas public authority may be disclosed subject to the condition that it must not be further disclosed without the agreement of the CMA. The disclosed information may not be used by the overseas public authority for any purpose other than that for which it was first disclosed. See para 7.10 of CMA6  Under EA02 s.243(2), the CMA can disclose specified information to overseas NCAs in order to facilitate:  • the investigation and bringing of criminal proceedings • the investigation and bringing of civil proceedings in connection with the enforcement of specified legislation • decision as to whether to start or bring to an end such investigations or proceedings Under Section 243(6) of EA02, when considering disclosing information to an overseas authority, the CMA will must have regard to a number of other factors, including:  • whether the matter in respect of which disclosure is sought is sufficiently serious to justify making the disclosure  • whether the law of the overseas country to whose authority disclosure would be made provides appropriate protection against self-incrimination in criminal proceedings • whether the law of that country provides appropriate protection for the storage and disclosure of personal data, and  • whether any mutual assistance arrangements apply The test in Part 9 s244 sets out that the CMA, as far as practicable, should exclude from disclosure any information whose disclosure the authority thinks is contrary to the public interest; commercial information whose disclosure might significantly harm the legitimate business interests of the undertaking; and information relating to the private affairs of an individual whose disclosure might significantly harm the individual’s interests. The CMA will also need to consider the extent to which the disclosure of commercial information/private affairs is necessary for the purpose for which the CMA is permitted to make the disclosure. There are further restrictions on the sharing of personal data (including special category data) under the UK GDPR and Data Protection Act 2018 (DPA 2018).