1. Subject to paragraph 2, a competent authority shall publish any decision imposing an administrative sanction or other administrative measure in relation to infringements of this Regulation on its official website immediately after the person subject to that decision has been informed of that decision. Such publication shall include at least information on the type and nature of the infringement and the identity of the persons subject to the decision.

The first subparagraph does not apply to decisions imposing measures that are of an investigatory nature.

2. Where a competent authority considers that the publication of the identity of the legal person or of the personal data of a natural person, would be disproportionate following a case-by-case assessment conducted on the proportionality of the publication of such data, or where such publication would jeopardise the stability of financial markets or an on-going investigation, it shall do any of the following:

(a) defer publication of the decision until such time as the reasons for that deferral cease to exist;

(b) publish the decision on an anonymous basis in accordance with national law where such anonymous publication ensures an effective protection of the personal data concerned;

(c) not publish the decision at all in the event that the competent authority is of the opinion that publication in accordance with point (a) or (b) will be insufficient to ensure:

(i) that the stability of financial markets is not jeopardised; or