Reporting of infringements

(1) The exchange supervisory authority takes suitable precautions to enable the reporting of possible or actual infringements of this Act or of Regulation (EU) No 600/2014 or of Article 4 or 15 of Regulation (EU) 2015/2365, or of the regulations, legal acts or orders issued to implement this Act or Regulation (EU) No 600/2014 or Article 4 or 15 of Regulation (EU) 2015/2365, or of other provisions whose compliance it is to monitor. Reports may also be made anonymously.
(2) The exchange supervisory authority is empowered, for that purpose, to process personal data, insofar as necessary for the performance of its tasks under subsection (1). Incoming reports are subject to data-protection provisions.
(3) The exchange supervisory authority does not disclose the identity of a person who has made a report without first having obtained that person's express consent. Nor does the exchange supervisory authority disclose the identity of a person who is the subject of a report. The first and second sentences do not apply where disclosure of the information is necessary in connection with further investigations or subsequent administrative or judicial proceedings, or where disclosure is ordered by a judicial decision.
(4) The freedom of information acts of the Länder do not apply to the reporting of infringements under subsection (1).
(5) Employees who are employed by undertakings or persons supervised by an exchange supervisory authority, or who are employed by undertakings or persons to whom activities of supervised undertakings or persons have been outsourced, and who make a report under subsection (1), may not be held liable under employment-law or criminal-law provisions, or made liable in damages, on account of that report, unless the report was made wilfully or through gross negligence knowing it to be untrue.
(6) The entitlement to make reports under subsection (1) by employees who are employed by undertakings or persons supervised by the exchange supervisory authority, or who are employed by other undertakings or persons to whom activities of supervised undertakings or persons have been outsourced, who are employed at an exchange or an exchange operator, may not be restricted by contract. Agreements to the contrary are void.
(7) The rights of a person who is the subject of a report, in particular the rights under the applicable administrative procedure acts, under sections 68 to 71 of the Code of Administrative Court Procedure and under sections 137, 140, 141 and 147 of the Code of Criminal Procedure, are not restricted by the establishment of the system for reporting infringements under subsection (1).