Duty of confidentiality

(1) Persons employed at the Federal Institute and persons engaged under section 4(3) of the Act on the Federal Financial Supervisory Authority, the special representatives appointed under section 45c, the administrators appointed under section 37(1), second sentence, and section 38(2), second and third sentences, the court-appointed trustees under section 2c(2), second sentence, the court-appointed administrators under section 22l(1), first sentence, and section 22o(1), first sentence, and persons in the service of the Deutsche Bundesbank, insofar as they act to implement this Act, may not, without authorisation, disclose or exploit facts that have become known to them in the course of their activity and whose confidentiality is in the interest of the institution, the competent authorities, or a third party, in particular trade and business secrets, even after they have left the service or their activity has ended. This also applies to the persons named in the first sentence where facts are entrusted to them in the course of initiating an engagement or appointment. The general data protection provisions to be observed by the supervised institutions and undertakings remain unaffected. This also applies to other persons who obtain knowledge of the facts referred to in the first sentence through official reporting. There is, in particular, no unauthorised disclosure or exploitation within the meaning of the first sentence where facts are passed on to:
1. criminal prosecution authorities or courts responsible for criminal and regulatory-fine matters,
2. authorities entrusted, by law or by public mandate, with supervising institutions, securities institutions, crowdfunding service providers, credit servicing institutions, capital management companies, externally managed investment companies, EU management companies, or foreign AIF management companies, financial enterprises, insurance undertakings, the financial markets, or payment transactions, and persons engaged by them,
3. authorities dealing with the liquidation or insolvency proceedings concerning an institution's assets,
4. persons entrusted with the statutory audit of the accounts of institutions or financial enterprises, and authorities supervising the aforementioned persons,
5. a deposit guarantee scheme or investor compensation scheme,
6. securities or commodities exchanges,
7. central banks,
8. operators of systems within the meaning of section 1(16),
9. the competent authorities in other states of the European Economic Area and in third countries with which the Federal Institute cooperates in the course of supervisory colleges under section 8e,
10. the European Central Bank, the European System of Central Banks, the European Banking Authority, the European Insurance and Occupational Pensions Authority, the European Securities and Markets Authority, the Joint Committee of the European Supervisory Authorities, the European Systemic Risk Board, or the European Commission,
11. authorities responsible for supervising payment and settlement systems,
12. parliamentary committees of inquiry under section 1 of the Committees of Inquiry Act, on the basis of a decision on a request under section 18(2) of the Committees of Inquiry Act,
13. the Federal Constitutional Court,
14. the Federal Court of Auditors, insofar as its examination mandate relates to the decisions and other activities of the Federal Institute under this Act or Regulation (EU) No 575/2013,
15. administrative courts in administrative-law disputes in which the Federal Institute is the defendant, with the exception of actions under the Freedom of Information Act,
16. the Bank for International Settlements for the purposes of quantitative impact assessments, and to the Financial Stability Board for the purposes of its monitoring tasks,
17. the International Monetary Fund or the World Bank for the purposes of assessments under the Financial Sector Assessment Program,
18. the Financial Stability Committee or the European Systemic Risk Board,
19. Bundesrepublik Deutschland – Finanzagentur GmbH in its function as administrator of the Financial Market Stabilisation Fund under section 3a(2) and (2a) of the Stabilisation Fund Act, the panel for the Financial Market Stabilisation Fund within the meaning of section 10a(1) of the Stabilisation Fund Act, or the steering committee within the meaning of section 4(1), second sentence, of the Stabilisation Fund Act,
20. authorities within the meaning of Article 2(1), points 17 and 18, of Regulation (EU) No 909/2014,
21. authorities responsible for monitoring compliance, by the obliged entities listed in Article 2(1), points 1 and 2, of Directive (EU) 2015/849 of the European Parliament and of the Council, with that Directive, and financial intelligence units or other authorities entrusted, by law or by public mandate, with combating, investigating, and preventing money laundering or the financing of terrorism,
22. competent authorities or bodies responsible for applying the rules on structural separation within a banking group,
23. the Federal Office for Information Security,
24. competent authorities within the meaning of Article 2(1)(r) of Regulation (EU) 2020/1503, or
25. natural or legal persons acting as special representatives under section 45c, as administrators under section 37(1), second sentence, or section 38(2), second or third sentence, or as trustees under section 2c(2), second sentence, or in a comparable capacity; the same applies to passing on information to this group of persons that is necessary in the course of initiating an engagement or appointment, insofar as these bodies or persons need the information to perform their tasks or to examine whether they can perform one of the tasks named in point 25. For persons employed by the bodies or persons named in the fifth sentence, points 1 to 11, 13 to 19, 21, 23, and 25, and persons engaged by these bodies or persons, and for the members of the committees named in the fifth sentence, points 12 and 19, the duty of confidentiality under the first sentence applies correspondingly. Where a body named in the fifth sentence, points 1 to 11, 16 to 18, 21, and 22, is located in another state, the facts may be passed on only where the persons employed by that body and the persons engaged by that body are subject to a duty of confidentiality largely corresponding to the first sentence. The foreign body must be informed that it may process information only for the purpose for which it was transmitted to it. Information may be passed on to the bodies named in the fifth sentence, points 16 and 17, only where
1. the request, having regard to the specific tasks assigned, is sufficiently substantiated and sufficiently precise as regards the type, scope, and format of the information requested and as regards the means of its transmission,
2. the information requested
a) is absolutely necessary for the requesting body to perform its specific tasks, and
b) does not go beyond the statutory tasks assigned to the requesting body, and
3. the information is transmitted exclusively to the persons at the requesting body who are directly involved in performing the specific task for whose fulfilment the requested information is absolutely necessary. Information other than aggregated and anonymised information may be exchanged with the bodies named in the fifth sentence, points 16 and 17, only on the premises of the supervisory authority and the Deutsche Bundesbank. Information originating from another state may be passed on only with the express consent of the competent authorities that communicated that information, and only for the purposes to which those authorities have consented.
(2) There is no unauthorised disclosure or exploitation of facts within the meaning of subsection (1), first sentence, where the results of stress tests carried out in accordance with Article 100 of Directive 2013/36/EU or Article 32 of Regulation (EU) No 1093/2010, as amended from time to time, are published or transmitted to the European Banking Authority for the publication of EU-wide stress-test results.
(2a) There is no unauthorised disclosure or exploitation of facts within the meaning of subsection (1), first sentence, insofar as information is made accessible in accordance with section 5(5) and (6) of the Insolvency Code.
(3) Where the passing on of facts under subsection (1) concerns personal data, the general data protection provisions apply.
(4) Where a crisis situation occurs, the Federal Institute may also pass on facts, for supervisory purposes, to the competent authorities in other states.
(5) Sections 93, 97, and 105(1), section 111(5) in conjunction with section 105(1), and section 116(1) of the Fiscal Code apply to the persons named in subsection (1) only insofar as the tax authorities need the knowledge to conduct proceedings for a tax offence or a taxation procedure, unless other provisions preclude the passing on of the information. However, the provisions named in the first sentence do not apply insofar as facts are concerned that
1. were communicated to the persons named in subsection (1), first or third sentence, by the competent supervisory authority of another state or by persons engaged by that authority,
2. persons employed at the Federal Institute become aware of through their participation in the supervision of institutions supervised directly by the European Central Bank, in particular in joint supervisory teams within the meaning of Article 2, point 6, of Regulation (EU) No 468/2014 of the European Central Bank, and that are confidential under the rules of the European Central Bank, or
3. were made available to the Federal Institute by the Deutsche Bundesbank under section 7(3), second sentence, and that are subject to confidentiality under section 16 of the Federal Statistics Act.