Reports of Infringements

(1) The supervisory authorities shall establish a system for receiving reports of potential or actual infringements of this Act and of the statutory instruments issued under this Act, and of other provisions for the prevention of money laundering and terrorist financing, where it is the task of the supervisory authority to ensure compliance with those provisions or to penalise infringements of those provisions. The system must enable reports to be made via a protected communication channel. Reports may also be made anonymously.
(2) The supervisory authorities are, for this purpose, authorised to process personal data, insofar as this is necessary for the performance of their tasks.
(3) The supervisory authorities shall disclose the identity of a person who has made a report only where they have first obtained that person's express consent. They shall not disclose the identity of a person who is the subject of a report. The first and second sentences do not apply where 1. disclosure of the information is necessary, under a statute, in the context of further investigations or subsequent administrative or court proceedings, or 2. disclosure is ordered by a court decision or in court proceedings.
(4) The Freedom of Information Act does not apply to matters under this provision.
(5) Employees employed at undertakings and persons supervised by the competent supervisory authorities under subsection (1), or employed at other undertakings or by other persons to whom activities of supervised undertakings or persons have been outsourced, who make a report under subsection (1), may not, on account of that report, be held liable under employment-law or criminal-law provisions, nor required to pay damages, nor otherwise placed at a disadvantage. The first sentence does not apply where the report was made intentionally untrue or with gross negligence as to its untruth.
(5a) Employees within the meaning of subsection (5) who, on account of making a report under subsection (1) and contrary to the prohibition of disadvantage under subsection (5), are subjected to a disadvantage in connection with their employment relationship, have the right to lodge a complaint with the competent supervisory authority. This is without prejudice to recourse to the courts. The protected communication channel under subsection (1), second sentence is available to the complainant for lodging a complaint under the first sentence.
(6) The right to make reports under subsection (1) by employees employed at 1. undertakings and persons supervised by the supervisory authorities under subsection (1), or 2. other undertakings or persons to whom activities of supervised undertakings or persons have been outsourced, may not be contractually restricted. Agreements to the contrary are void.
(7) The establishment and operation of the system for reporting infringements does not restrict the rights of a person who is the subject of a report, in particular not the rights under 1. sections 28 and 29 of the Administrative Procedure Act, 2. sections 68 to 71 of the Code of Administrative Court Procedure, and 3. sections 137, 140, 141 and 147 of the Code of Criminal Procedure.
(8) Insofar as the Federal Financial Supervisory Authority, as the competent authority within the meaning of section 50, is responsible for establishing a system within the meaning of subsection (1), the establishment and operation of that system are governed by section 4d of the Financial Services Supervision Act. Subsections (3) to (7) do not apply in that respect.