Processing of Personal Data by Obliged Entities

(1) Obliged entities under section 2 may process personal data only insofar as this is necessary, on the basis of this Act, for the purposes of preventing money laundering and terrorist financing.
(2) Insofar as an obliged entity under section 2 subject to the provisions of this Act transmits personal data for purposes under subsection (1) to the competent supervisory authorities or to the persons and bodies which the competent supervisory authorities engage to carry out their tasks, or to the Financial Intelligence Unit, the obligation to inform the data subject under Article 13(3) of Regulation (EU) 2016/679 and the data subject's right of access under Article 15 of Regulation (EU) 2016/679 do not apply.
(3) Subsections (1) and (2) apply correspondingly to third parties within the meaning of section 17 on whom an obliged entity relies to fulfil the general due diligence obligations under section 10(1), nos. 1 to 4.