Establishment Order

(1) The Financial Intelligence Unit shall issue an establishment order for every automated procedure for the processing of personal data under section 29(2a) that it operates for the performance of its tasks. The establishment order requires the consent of the Federal Ministry of Finance. Before issuing an establishment order, the Federal Commissioner for Data Protection and Freedom of Information shall be consulted.
(2) The establishment order shall determine:
1. the designation of the responsible body,
2. the legal basis and purpose of the processing,
3. the category of persons on whom data are stored,
4. the types of personal data to be stored,
5. the types of personal data used to index the collection,
6. the delivery or input of the data to be stored,
7. the conditions under which stored personal data are transmitted, to which recipients, and in which procedures,
8. review periods and retention periods, and
9. logging.
(3) Where, having regard to the urgency of the performance of the tasks of the Financial Intelligence Unit, involvement of the bodies referred to in subsection (1) is not possible, the General Directorate of Customs may issue an emergency order. At the same time the General Directorate of Customs shall inform the Federal Ministry of Finance and submit the emergency order to it. The procedure under subsection (1) shall be carried out without delay thereafter.
(4) At appropriate intervals, the necessity of continuing or amending the establishment order shall be reviewed.