4. All processing of PNR data by air carriers, all transfers of PNR data by Passenger Information Units and all requests by competent authorities or Passenger Information Units of other Member States and third countries, even if refused, shall be logged or documented by the Passenger Information Unit and the competent authorities for the purposes of verification of the lawfulness of the data processing, self-monitoring and ensuring proper data integrity and security of data processing, in particular by the national data protection supervisory authorities.

4. All processing of PNR data by air carriers and non-carrier economic operators, all transfers of PNR data by Passenger Information Units and all requests by competent authorities or Passenger Information Units of other Member States and third countries, even if refused, shall be logged or documented by the Passenger Information Unit and the competent authorities for the purposes of verification of the lawfulness of the data processing, self-monitoring and ensuring proper data integrity and security of data processing, in particular by the national data protection supervisory authorities.

2. The competent authority of a Member State shall only disclose personal data received from a competent authority of another Member State to a supervisory authority of a third country where the competent authority of the Member State concerned has obtained express agreement from the competent authority which transmitted the data and, where applicable, the data is disclosed solely for the purposes for which that competent authority gave its agreement.

"(h) have at their disposal their consumption data, and shall be able to, by explicit agreement and free of charge, give any undertaking with a supply license access to its metering data.

34. Calls for a clear definition of the role and powers of the PIUs, in particular in terms of transparency and democratic accountability and in order to lay down appropriate data protection rules; requests that the role of PIUs be limited to the transfer of data to competent authorities, in order to ensure that risk assessments may only be carried out by competent authorities and in the context of an inquiry; asks for clarification of the law which will govern the risk assessment conducted by the PIUs, and the responsibility of data protection authorities in cases where Member States cooperate to set up a joint PIU;

No data shall be transferred or made accessible to the authorities of any third country, nor to any agency or authority in a Member State other than that which collects the original data referred to in Articles 4 and 8, except with the express written agreement of the joint supervisory authorities.