Logging of Requests for Information; Statistics; Authorisation to Issue Statutory Instruments

(1) The Financial Intelligence Unit shall log requests for information in the cases under section 32(3a), section 32a, section 33(2), third sentence, second half-sentence, and in the cases under section 31 where the Financial Intelligence Unit collects data from the domestic designated authority within the meaning of Article 3(2) of Directive (EU) 2019/1153.
(2) The logs shall contain at least the following particulars:
1. the designation and contact details of the authority, and the name of the person, that addressed the request to the Financial Intelligence Unit, and, where known, the name of the person receiving the result of the request;
2. the reference number of the domestic case in respect of which the request is addressed to the Financial Intelligence Unit;
3. the subject matter of the request; and
4. all measures taken to comply with the request.
(3) The logs shall be retained, protected against access, for a period of five years after their creation. They shall serve exclusively the purpose of data protection monitoring. The Financial Intelligence Unit shall make available to the Federal Commissioner for Data Protection and Freedom of Information, on request, all necessary logs. On expiry of the retention period the logs shall be deleted without delay, unless they are required for ongoing monitoring procedures.
(4) The Financial Intelligence Unit shall maintain statistics on requests for information in the cases under section 33(2), third sentence, second half-sentence. It shall, for this purpose, collect the number of requests, the response time, and, where possible, the cost of processing the requests, and shall make the data available to the Federal Ministry of Finance. The Federal Ministry of Finance is authorised, by statutory instrument not requiring the consent of the Bundesrat, to regulate the details of the data to be collected and its compilation, evaluation and provision.