Cooperation with the Deutsche Bundesbank

(1) The Federal Institute and the Deutsche Bundesbank cooperate in accordance with this Act. Without prejudice to further statutory requirements, the cooperation includes ongoing monitoring of institutions by the Deutsche Bundesbank. Ongoing monitoring in particular includes evaluating the documents submitted by institutions, the audit reports under section 26 and the annual financial statement documents, and carrying out and evaluating banking business examinations to assess institutions' adequate capital resources and risk management procedures, and evaluating examination findings. Ongoing monitoring by the Deutsche Bundesbank is, as a rule, carried out by its regional head offices.
(1a) Within the Single Supervisory Mechanism within the meaning of Article 2, point 9, of Regulation (EU) No 1024/2013, subsection (1) also applies where the Federal Institute assists the European Central Bank in its tasks within the meaning of Article 6(2) and (3) of Regulation (EU) No 1024/2013. In the course of the cooperation under subsection (1), the Federal Institute and the Deutsche Bundesbank inform each other without delay of requests from the European Central Bank and exchange information received from it. Where the Federal Institute or the Deutsche Bundesbank, in the course of performing its tasks under this Act, transmits observations, findings, data, or other information to the European Central Bank, it transmits that information to the other authority at the same time. Subsections (2) to (5) apply correspondingly within the Single Supervisory Mechanism.
(2) The Deutsche Bundesbank must observe the guidelines of the Federal Institute. The Federal Institute's guidelines on ongoing supervision are issued in agreement with the Deutsche Bundesbank. Within the Single Supervisory Mechanism, the Federal Institute, in issuing the guidelines, observes the requirements of the European Central Bank under Article 6(5)(a) of Regulation (EU) No 1024/2013. Where agreement cannot be reached within a reasonable period, the Federal Ministry of Finance issues such guidelines in consultation with the Deutsche Bundesbank and having regard to the requirements of the European Central Bank issued within the Single Supervisory Mechanism under Article 6(5)(a) of Regulation (EU) No 1024/2013. Supervisory measures, in particular general rulings and administrative acts, including examination orders under section 44(1), third sentence, and section 44b(2), first sentence, are issued by the Federal Institute against institutions or outsourcing undertakings. The Federal Institute, as a rule, bases its supervisory measures on the examination findings and assessments made by the Deutsche Bundesbank.
(3) The Federal Institute and the Deutsche Bundesbank must communicate to each other the observations and findings necessary for performing their tasks. In this respect, the Deutsche Bundesbank must also make available to the Federal Institute the particulars it obtains on the basis of statistical surveys under section 18 of the Act on the Deutsche Bundesbank. Before ordering such a survey, it must hear the Federal Institute; section 18, fifth sentence, of the Act on the Deutsche Bundesbank applies correspondingly.
(4) The cooperation under subsections (1) and (1a), and the communications under subsection (3), include the transmission of the personal data necessary for the receiving authority to perform its tasks. To perform their tasks under this Act, the Federal Institute and the Deutsche Bundesbank may retrieve, from each other, the data respectively stored by the other authority, by automated means. The Deutsche Bundesbank must log, for every tenth retrieval of personal data carried out by the Federal Institute, the time, the particulars enabling identification of the data records retrieved, and the person responsible for the retrieval. The log data may be processed only for the purposes of data protection monitoring, data security, or ensuring the proper operation of the data-processing system. It must be deleted at the end of the calendar year following the year of logging, insofar as it is not needed for an ongoing monitoring procedure. The third to fifth sentences apply correspondingly to data retrievals by the Deutsche Bundesbank from the Federal Institute. In other respects, the general data protection provisions remain unaffected.
(5) The Federal Institute and the Deutsche Bundesbank may establish joint filing systems. Each of the two authorities may alter or delete, or restrict the processing of, only the data it has entered, and is the controller only with regard to the data it has entered. Where one of the two authorities has indications that data entered by the other authority is incorrect, it must inform the other authority of this without delay. When a joint filing system is established, it must be determined which authority is to take the technical and organisational measures under Articles 24, 25, and 32 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1; L 314, 22.11.2016, p. 72; L 127, 23.5.2018, p. 2), as amended from time to time. The authority determined under the fourth sentence must ensure that staff have access to personal data only to the extent necessary to perform their tasks.