Provisions on the processing of personal data

(1) BaFin is authorised to process personal data insofar as this is necessary for the performance of its statutory tasks. Where BaFin processes personal data in the course of a supervisory measure within its statutory competence under the relevant supervisory statutes, the data subjects do not have the rights under Articles 15 to 18 and 20 to 22 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1; L 314, 22.11.2016, p. 72; L 127, 23.5.2018, p. 2), in its current version, insofar as fulfilling those rights of the data subjects would endanger: 1. the stability and integrity of the financial markets of the Federal Republic of Germany or of one or more Member States of the European Economic Area, 2. the purpose of the measure, 3. any other important objective of general public interest of the Federal Republic of Germany or of one or more Member States of the European Economic Area, in particular an important economic or financial interest, or 4. the prevention, investigation, detection or prosecution of criminal offences, or the execution of criminal penalties, including protection against and defence against threats to public security. Under these conditions BaFin is also exempt from the obligations under Articles 5, 12 to 14, 19 and 34 of Regulation (EU) 2016/679. The second and third sentences apply accordingly to persons and bodies of which BaFin avails itself in carrying out its tasks, and to the Deutsche Bundesbank. Section 4(3) to (5) of the Recovery and Resolution Act remains unaffected.
(2) The data subject concerned is to be informed of the end of the restriction in a suitable form, unless this would be detrimental to the purpose of the restriction. This obligation applies accordingly to persons and bodies of which BaFin avails itself in carrying out its tasks.
(3) Where, in the cases of subsection (1), second to fourth sentences, no information is given to the data subject, the information must be given, on the data subject's request, to the Federal Commissioner for Data Protection and Freedom of Information, unless it is found in the individual case that this would endanger the public security of the Federation or a Land or the stability and integrity of the financial markets. The communication by the Federal Commissioner to the data subject of the outcome of the data-protection review may not allow any conclusions to be drawn about the state of knowledge of BaFin, of the persons and bodies of which BaFin avails itself in carrying out its tasks, or of the Deutsche Bundesbank, unless they consent to more extensive information.
(4) Insofar as persons, institutions and undertakings transmit personal data to BaFin, the persons and bodies of which BaFin avails itself in carrying out its tasks, or the Deutsche Bundesbank, for supervisory purposes, or such data is collected from persons, institutions and undertakings by them, the obligations of those persons, institutions and undertakings to inform the data subject under Article 13(3) and Article 14(4) of Regulation (EU) 2016/679, and the data subject's right of access under Article 15 of Regulation (EU) 2016/679, do not apply.