Processing of personal data

(1) The exchange supervisory authority, the Exchange Council, the Management, the Trading Surveillance Office and the Sanctions Committee are empowered to process personal data, insofar as necessary for the performance of their statutory tasks. Where the bodies named in the first sentence process personal data in the course of a measure to perform their tasks under this Act, the data subjects do not have the rights under Articles 15 to 18 and 20 to 22 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1; L 314, 22.11.2016, p. 72; L 127, 23.5.2018, p. 2), in its respective current version, insofar as fulfilling the rights of the data subjects would endanger:
1. the stability and integrity of the financial markets of the Federal Republic of Germany or of one or more Member States of the European Economic Area,
2. the purpose of the measure,
3. another important objective of the general public interest of the Federal Republic of Germany or of one or more Member States of the European Economic Area, in particular an important economic or financial interest, or
4. the prevention, investigation, detection or prosecution of criminal offences, or the enforcement of criminal penalties, including protection against and the prevention of dangers to public security. Under these conditions, the exchange supervisory authority, the Exchange Council, the Management, the Trading Surveillance Office and the Sanctions Committee are also exempt from the obligations under Articles 5, 12 to 14, 19 and 34 of Regulation (EU) 2016/679.
(2) The respective data subject must be informed in a suitable form of the end of the restriction, unless this would be detrimental to the purpose of the restriction.
(3) Insofar as, in the cases of subsection (1), no information is given to the data subject, the information must, at the data subject's request, be given to the supervisory authority competent under Land law for data protection, unless it is established in the individual case that this would endanger the public security of the Federation or a Land, or the stability and integrity of the financial markets. The communication by the supervisory authority competent under Land law for data protection to the data subject of the outcome of the data-protection review may not permit any conclusions as to the state of knowledge of the bodies named, unless they consent to more extensive information.
(4) Insofar as persons or undertakings transmit personal data to the exchange supervisory authority, the Exchange Council, the Management, the Trading Surveillance Office or the Sanctions Committee for the performance of the tasks under subsection (1), or such data is collected by them, the duty to inform the data subject under Article 13(3) and Article 14(4) of Regulation (EU) 2016/679 and the data subject's right to information under Article 15 of Regulation (EU) 2016/679 do not exist.