Confidentiality of information; personal data; rights to information

(1) Sections 5 to 10 apply to the passing on of 1. confidential information, in particular trade and business secrets of credit institutions, group entities, or other third parties, and 2. information whose disclosure could adversely affect the achievement of the resolution objectives within the meaning of section 67(1), the effectiveness of supervisory and resolution tools, or financial, monetary or economic policy.
(2) The protection of personal data under Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1; L 314, 22.11.2016, p. 72; L 127, 23.5.2018, p. 2), as amended from time to time, and under the Federal Data Protection Act, as well as the protection of intellectual property, remain unaffected, save where subsections (3) to (6) provide otherwise.
(3) Where personal data are processed within the scope of the responsibility of the supervisory authority or the resolution authority under this Act or under Regulation (EU) 806/2014, the data subjects do not have the rights under Articles 15 to 18 and Articles 20 to 22 of Regulation (EU) 2016/679, insofar as a risk to the success of the respective measures cannot be excluded. Under these conditions, the supervisory authority and the resolution authority are also released from the obligations under Articles 5, 12 to 14, 19 and 34 of Regulation (EU) 2016/679.
(4) The supervisory authority and the resolution authority inform the persons affected by the restrictions under subsection (3), first sentence, in an appropriate form about the end of the restriction, unless this would be detrimental to the purpose of the restriction.
(5) Insofar as the supervisory authority or the resolution authority does not provide the data subject with information, the information must, on request of the data subject, be provided to the Federal Commissioner for Data Protection and Freedom of Information. This applies only insofar as the respective authority has not determined, in the individual case, that this would endanger public security of the Federation or a Land, or financial stability. The communication of the Federal Commissioner for Data Protection and Freedom of Information to the data subject regarding the outcome of the data protection review may not permit any conclusions to be drawn about the state of knowledge of the respective authority, unless that authority consents to more extensive information.
(6) Insofar as institutions, undertakings or domestic Union branches under section 1 transmit personal data for purposes under this Act or under Regulation (EU) 806/2014, the obligation to inform the data subject under Article 13(3) and Article 14(4) of Regulation (EU) 2016/679, and the data subject's right of access under Article 15 of Regulation (EU) 2016/679, do not apply.