Right to Information from Domestic Public Bodies; Right of Data Access; Authorisation to Issue Statutory Instruments

(1) The Financial Intelligence Unit may, insofar as necessary for the performance of its tasks, collect data from domestic public bodies; domestic public bodies also include the domestic designated authority within the meaning of Article 3(2) of Directive (EU) 2019/1153. Domestic public bodies shall, on request by the Financial Intelligence Unit, provide it with information for the performance of its tasks, insofar as no transmission restrictions under this or other Acts preclude this.
(2) Enquiries shall be answered without delay by the domestic public body. Data connected with the enquiry shall be made available.
(3) The Financial Intelligence Unit should establish an automated procedure for the transmission, by retrieval, of personal data held by other domestic public bodies and to which the Financial Intelligence Unit is statutorily entitled, insofar as no other statutory provision exists and this form of data transmission is appropriate, having regard to the interests of the data subjects warranting protection, on account of the volume of transmissions or their particular urgency. To monitor the permissibility of the automated retrieval procedure, the Financial Intelligence Unit shall determine in writing:
1. the occasion and the purpose of the matching or retrieval procedure,
2. the third parties to whom transmission is made,
3. the type of data to be transmitted, and
4. the technical and organisational measures to ensure data protection.
(4) The Financial Intelligence Unit is entitled, insofar as necessary for the performance of its tasks under section 28(1), third sentence, no. 2, to match, by automated means, the personal data stored in its information system against the personal data held in the police information network under section 29(1) and (2) of the Federal Criminal Police Office Act. Where a match under the first sentence establishes that transmitted data correspond to data held in the police information network, the Financial Intelligence Unit shall automatically be informed of the existence of a hit and is entitled to retrieve, by automated means, the corresponding data held in the police information network. Where participants in the police information network have classified data as particularly sensitive and, for that reason, have excluded data retrieval by the Financial Intelligence Unit under the second sentence, the participant in the police information network holding the data shall automatically be informed of the existence of a hit. At the same time, in the cases under the third sentence, the Financial Intelligence Unit shall be informed of the existence of a hit and of the identity of the participant in the police information network holding the data. On being informed of a hit under the third sentence, it is incumbent on the respective participant in the police information network holding the data to make contact with the Financial Intelligence Unit without delay and to transmit the data to it, insofar as no transmission restrictions preclude this. The first to fifth sentences take precedence over section 29(8) of the Federal Criminal Police Office Act. The establishment of a more extensive automated retrieval procedure for the Financial Intelligence Unit is permissible with the consent of the Federal Ministry of the Interior, Building and Community, the Federal Ministry of Finance, and the interior ministries and Senate interior administrations of the Länder, insofar as this form of data transmission is appropriate, having regard to the interests of the data subjects warranting protection, on account of the volume of transmissions or their particular urgency.
(4a) The Financial Intelligence Unit is entitled, insofar as necessary for the performance of its tasks under section 28(1), third sentence, no. 2, to obtain information, by automated means, from the Central Register of Public Prosecutors' Proceedings, stating the first name, surname, and additionally the date of birth, place of birth, or last known address of a natural person. Where obtaining information under the first sentence establishes that the transmitted data correspond to data held in the Central Register of Public Prosecutors' Proceedings, the Financial Intelligence Unit shall automatically be informed of the existence of a hit and is entitled to retrieve, by automated means, the corresponding data held in the Central Register of Public Prosecutors' Proceedings. Personal data obtained from the Central Register of Public Prosecutors' Proceedings may be used only for the purposes of operational analysis.
(5) Tax authorities shall provide the Financial Intelligence Unit with information in accordance with section 31b(1), no. 5 of the Fiscal Code, and shall notify it of the information referred to in section 31b(2) of the Fiscal Code. The Financial Intelligence Unit may, for the performance of its tasks under section 28(1), third sentence, no. 2, retrieve, by automated procedure, the following data subject to tax secrecy under section 30 of the Fiscal Code, insofar as, on the basis of facts arising from the analysis of a report, communication or information under section 30(1), that data are necessary for further analysis:
1. from the Federal Central Tax Office, the data held under section 5(1), no. 13 of the Fiscal Administration Act,
2. from the Land tax authorities, the basic information stored on a taxpayer, comprising the tax number, the trade identification number, the basic and additional identification letters, the bank details, the value-added-tax identification number issued, and the competent tax office. In retrievals under the second sentence, in respect of natural persons the first name, surname and address or date of birth, and in respect of legal persons and associations of persons the name or business name and the place of management or registered office, shall be stated. Responsibility for the permissibility of a data retrieval under the second sentence lies with the Financial Intelligence Unit. The Financial Intelligence Unit shall examine without delay to what extent it requires, in the specific individual case, the data transmitted in response; it shall delete without delay any data not required. Where the result of the analysis is not transmitted to the competent law enforcement authority under section 32(2), first sentence, the data obtained under the first and second sentences shall be deleted without delay. In other respects, section 29(1) applies to the processing of data that the Financial Intelligence Unit receives under the first or second sentence; transmission of the data obtained under the first or second sentences to the bodies competent for proceedings within the meaning of section 32(3), second sentence, nos. 2 and 3 is not permitted. Insofar as it is to be feared that a data retrieval under the second sentence, no. 1 would jeopardise the investigative purpose of proceedings within the meaning of section 30(2), no. 1, letter b) of the Fiscal Code, the tax authority competent for those proceedings, or the competent public prosecutor's office, may order that no data retrieval under the second sentence take place. Section 480(1), first and second sentences of the Code of Criminal Procedure applies insofar as the data relate to proceedings that led to criminal proceedings. Further details of the retrieval procedure under the second sentence, in particular the technical formats of the retrievable data, the granting and scope of retrieval authorisations, logging and review of retrievals, and other technical and organisational measures required under data protection law, shall be regulated by statutory instrument of the Federal Ministry of Finance, in agreement with the Federal Ministry of Justice and Consumer Protection, requiring the consent of the Bundesrat. Retrieval of data other than those referred to in the second sentence that are held by tax authorities and are subject to tax secrecy under section 30 of the Fiscal Code, by the Financial Intelligence Unit, is permissible only insofar as this is permitted under section 31b of the Fiscal Code or otherwise under tax law. By way of derogation from the second to ninth sentences, subsection (3) applies to the retrieval of data held with the tax authorities of the customs administration and to which the Financial Intelligence Unit is statutorily entitled.
(5a) (repealed)
(6) Obliged entities under section 2(1), no. 1 shall also maintain, for retrieval by the Financial Intelligence Unit, the data system to be kept under section 24c(1) of the Banking Act. The same applies correspondingly to obliged entities under section 2(1), no. 3, as regards the data system to be kept under section 27 of the Payment Services Supervision Act, and to obliged entities under section 2(1), no. 9, as regards the data system to be kept under section 28 of the Capital Investment Code. The Financial Intelligence Unit may, for the performance of its tasks, retrieve data from these data systems by automated procedure. Section 24c(4) to (8) of the Banking Act applies correspondingly.
(7) Insofar as necessary to verify the personal particulars of the person concerned, the Financial Intelligence Unit may, in the automated retrieval procedure under sections 34a and 38 of the Federal Registration Act, retrieve, in addition to the data listed in section 34(1), first sentence of the Federal Registration Act, the following data:
1. the issuing authority, date of issue, period of validity, and serial number of the identity card, provisional identity card or substitute identity card, or of the recognised passport or substitute passport document,
2. facts as to passport and identity-card data under section 3(2), no. 4 of the Federal Registration Act, and
3. data on the housing provider under section 3(2), no. 10 of the Federal Registration Act. The same applies where concrete indications exist that this is necessary for the performance of the tasks under section 28(1), third sentence, no. 2. In the cases under the second sentence, the data retrieved under the first sentence shall be deleted without delay where it emerges, after completion of the operational analysis, that the conditions for transmission under section 32(2), first sentence do not exist.