Investigation of IT security, requests for information

(1) To perform its tasks under section 3(1), second sentence, nos. 1, 20, 21, 24 or 25, the BSI may investigate information technology products and systems made available, or intended to be made available, on the market. It may avail itself of third-party support, insofar as the legitimate interests of the manufacturer of the products and systems concerned do not preclude this.
(2) Insofar as necessary, the BSI may, for investigations under subsection (1), first sentence, require from manufacturers of information technology products and systems all necessary information, including technical details. In the request for information, the BSI states the legal basis, the purpose of the request and the information required, and sets a reasonable period for its transmission. The request for information must further include a reference to the sanctions provided for in section 65.
(3) The BSI passes on the information, and the findings obtained from the investigations, without delay to the competent federal supervisory authorities or, where no supervisory authority exists, to the respective department, where indications exist that they need it to perform their tasks.
(4) The information and the findings obtained from the investigations may be used only to perform the tasks under section 3(1), second sentence, nos. 1, 20, 21, 24 and 25. The BSI may pass on and publish its findings insofar as necessary to perform the tasks under section 3(1), second sentence, nos. 1, 20, 21, 24 and 25. Before doing so the manufacturer of the products and systems concerned must be given an opportunity to comment, with a reasonable period. An opportunity to comment may be dispensed with where the findings are passed on or published without a discernible connection to the manufacturer or to the information technology products and systems investigated.
(5) Where a manufacturer fails to comply, or complies only inadequately, with the BSI's request under subsection (2), first sentence, the BSI may inform the public of this. In doing so it may state the manufacturer's name and the designation of the product or system concerned, and describe the extent to which the manufacturer failed to comply with its duty to provide information. The manufacturer must first be given an opportunity to comment, with a reasonable period. Section 13(2), second sentence applies accordingly.