Restoring the security or functionality of information technology systems in exceptional cases

(1) Where an impairment of the security or functionality of an information technology system of a federal administration entity, an essential entity or an important entity constitutes an exceptional case, the BSI may, at the request of the entity or operator concerned or of another authority competent for the entity or operator, take the measures necessary to restore the security or functionality of the information technology system concerned. Insofar as the BSI takes initial measures on site to limit damage and ensure emergency operation, no fees or expenses are charged for the BSI's activity in that regard. Any costs for engaging qualified third parties remain unaffected.
(2) An exceptional case under subsection (1) exists in particular where it is an attack of particular technical quality, or where the prompt restoration of the security or functionality of the information technology system concerned is of particular public interest.
(3) The BSI may, in measures under subsection (1), process personal data or data subject to the secrecy of telecommunications, insofar as necessary and appropriate for restoring the security or functionality of the information technology system concerned. The data must be deleted without delay once no longer needed for restoring the security or functionality of the information technology system. Where the data has, in the cases of subsection (4), been passed on to another authority for the performance of its statutory tasks, the BSI may, by way of derogation from the second sentence, continue processing the data until support for that authority has ended. Use for other purposes is inadmissible. Section 8(8) applies accordingly.
(4) The BSI may pass on information of which it obtains knowledge within the framework of this provision only with the requesting party's consent, unless the information permits no conclusions as to the requesting party's identity, or the information can be transmitted in accordance with section 8(6) and (7). Third parties are not granted access to the files kept in proceedings under subsection (1). Necessary exchanges of information between the BSI and the Federal Office of Civil Protection and Disaster Assistance under section 3(7) of the Critical Infrastructure Umbrella Act are excepted from this.
(5) The BSI may, in measures under subsection (1), with the requesting party's consent, avail itself of the help of qualified third parties, where necessary for the timely or complete restoration of the security or functionality of the information technology system concerned. The costs thereby arising must be borne by the requesting party. The BSI may also refer the requesting party to qualified third parties. The BSI and third parties engaged by the requesting party or by the BSI under the first sentence may, with the requesting party's consent, transmit data to one another in measures under subsection (1). Subsection (3) applies accordingly.
(6) Insofar as necessary for restoring the security or functionality of the information technology system, the BSI may require the manufacturer of the information technology system to cooperate in restoring the security or functionality.
(7) In justified individual cases, the BSI may also act at entities other than those named in subsection (1), where the BSI has been requested to do so and it is an exceptional case under subsection (2). A justified individual case generally exists where a body of a Land is affected.
(8) In the case of facilities or activities requiring a licence under the Atomic Energy Act, in the cases of subsections (1), (4), (5) and (7) the BSI must, before acting, consult with the competent nuclear-law supervisory authorities of the Federation and of the Länder. In the case of facilities or activities requiring a licence under the Atomic Energy Act, the requirements under the Atomic Energy Act take precedence in measures of the BSI under this section.