Information remains privileged; exceptions

10. If a depository institution voluntarily discloses information it obtained from a voluntary compliance review to the department or to another appropriate regulatory agency, that information and the voluntary compliance review which resulted in the information shall remain subject to sections 3 and 4 of this act except that the agency receiving the information may use it with respect to an enforcement action. The regulatory agency, in deciding on the appropriate penalty or sanction for a violation shall consider the disclosure as a mitigating factor if the violation is disclosed within 60 days of completion of the voluntary compliance review and the depository institution responsible for the violation demonstrates and the regulator determines that the violation is not the result of knowing, purposeful, reckless or criminally negligent conduct, and that the institution has made or is making a good-faith effort to prevent similar violations. L.1999,c.18,s.10.