Duty of confidentiality and data protection

(1) Persons employed by or working for a deposit guarantee scheme may not, without authorisation, disclose or exploit others' secrets, in particular trade or business secrets. They are to be placed under a duty by BaFin, under the Public Officials Undertaking Act of 2 March 1974 (Federal Law Gazette I, p. 469, 547), as amended by section 1, no. 4 of the Act of 15 August 1974 (Federal Law Gazette I, p. 1942), to conscientiously fulfil their duties.
(2) There is in particular no unauthorised disclosure or exploitation under subsection (1), first sentence, where facts are passed on to BaFin, the resolution authority, the Deutsche Bundesbank, the European Central Bank or the European Banking Authority for the performance of their tasks.
(3) Deposit guarantee schemes must ensure the confidentiality and protection of data connected with depositors' accounts. The general data-protection provisions apply to the processing of such data.
(4) Deposit guarantee schemes are authorised to process personal data insofar as this is necessary for the performance of their statutory tasks. Where deposit guarantee schemes process personal data in the course of a measure to carry out their tasks under this Act, the data subjects do not have the rights under Articles 15 to 18 and 20 to 22 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1; L 314, 22.11.2016, p. 72; L 127, 23.5.2018, p. 2), in its current version, insofar as fulfilling the data subjects' rights would endanger: 1. the stability and integrity of the financial markets of the Federal Republic of Germany or of one or more Member States of the European Economic Area, 2. the purpose of the measure, 3. any other important objective of general public interest of the Federal Republic of Germany or of one or more Member States of the European Economic Area, in particular an important economic or financial interest, or 4. the prevention, investigation, detection or prosecution of criminal offences, or the execution of criminal penalties, including protection against and defence against threats to public security. Under these conditions, deposit guarantee schemes are also exempt from the obligations under Articles 5, 12 to 14, 19 and 34 of Regulation (EU) 2016/679.
(5) The data subject concerned is to be informed of the end of the restriction in a suitable form, unless this would be detrimental to the purpose of the restriction.
(6) Insofar as the deposit guarantee scheme does not provide information to the data subject in the cases of subsection (4), the information must be given, on the data subject's request, to the Federal Commissioner for Data Protection and Freedom of Information, unless it is found in the individual case that this would endanger the public security of the Federation or a Land or the stability and integrity of the financial markets. The communication by the Federal Commissioner for Data Protection and Freedom of Information to the data subject of the outcome of the data-protection review may not allow any conclusions to be drawn about the state of knowledge of the deposit guarantee schemes, unless they consent to more extensive information.
(7) Insofar as persons and undertakings transmit personal data to deposit guarantee schemes for the performance of the tasks under subsection (4), or such data is collected from them, the duty to inform the data subject under Article 13(3) and Article 14(4) of Regulation (EU) 2016/679, and the data subject's right of access under Article 15 of Regulation (EU) 2016/679, do not apply.