Duty of Confidentiality

(1) Insofar as persons employed at, or acting for, the supervisory authorities competent under section 50 perform tasks under section 51(1), they may not disclose or exploit, without authorisation, facts that have come to their knowledge in the course of their activity, where the confidentiality of those facts, in particular business and trade secrets, is in the interest of an obliged entity supervised by them or of a third party. The first sentence also applies once they are no longer in service or their activity has ended. The data-protection provisions to be observed by the supervised obliged entities remain unaffected.
(2) Subsection (1) also applies to other persons who obtain knowledge of the facts referred to in subsection (1), first sentence through official reporting.
(3) There is in particular no unauthorised disclosure or exploitation where facts within the meaning of subsection (1) are passed on, insofar as no other statutory provisions preclude the disclosure, 1. in a summarised or aggregated form such that individual obliged entities cannot be identified, or 2. to one of the following bodies, insofar as those bodies require the information for the performance of their tasks: a) the law enforcement authorities, and the authorities and courts competent for criminal and regulatory-fine matters, b) other bodies entrusted, by statute or by public mandate, with the investigation and prevention of money laundering or of terrorist financing, or with the supervision of credit and financial institutions within the meaning of Article 3 of Directive (EU) 2015/849, and persons engaged by those bodies, c) the European Central Bank, insofar as it acts in accordance with Council Regulation (EU) No 1024/2013 of 15 October 2013 conferring specific tasks on the European Central Bank concerning policies relating to the prudential supervision of credit institutions, and the European Banking Authority, d) the financial intelligence units within the meaning of Article 32(1) of Directive (EU) 2015/849, and e) other bodies entrusted, by statute or by public mandate, with the supervision of the general risk management or of the compliance of obliged entities, and persons engaged by those bodies.
(4) Where one of the bodies referred to in subsection (3) is located in another state, or is a supranational body, facts within the meaning of subsection (1) may be passed on only where the persons employed at, or acting on behalf of, that body are subject to a duty of confidentiality that largely corresponds to the duty of confidentiality under subsections (1) to (3). The foreign or supranational body shall be informed by the disclosing body that it may use the facts only for the purpose for which they are transmitted to it. Facts originating from another state may be passed on only 1. with the express consent of the competent authorities that communicated those facts, and 2. for such purposes as the competent authorities have consented to.