Questioning, duty to provide information

(1) The supervisory authority is authorised
1. to require from insurance undertakings, the members of their governing bodies, their employees, and the persons controlling the undertakings, including after they have left the governing body or the undertaking, information on all business matters, and the submission or transmission of all business documents — in an individual case in particular the general terms of insurance, the tariffs, the forms and other printed material that the insurance undertaking uses in dealings with policyholders or with the ceding insurance undertakings (previous insurers), and the intercompany agreements and the outsourcing agreements — and
2. to require from an insurance undertaking included in group supervision under Part 5, and the persons named in point 1, including after they have left the governing body or the undertaking, information and the submission of documents on business matters that are useful for group supervision; where the insurance undertaking does not transmit this information within a reasonable period despite being requested to do so, the supervisory authority may also require the information and the transmission or submission of the documents from all other undertakings belonging to the group.
(2) The supervisory authority also has the rights under subsection (1), point 1, against
1. persons and undertakings that broker, or have brokered, insurance contracts for an insurance undertaking as an insurance agent or insurance broker, insofar as this is significant for assessing the business operations and financial position of the insurance undertaking, or an insurance undertaking's fulfilment of the obligations under sections 53 to 56 or the provisions of the Money Laundering Act within the meaning of section 52;
2. persons and undertakings to whom an insurance undertaking has outsourced functions or activities, and its statutory auditors and independent trustees within the meaning of this Act or the Insurance Contract Act; the duty of statutory auditors to provide information is limited to facts that became known to them within the audit;
3. persons and undertakings that have notified an intention to acquire a participation under section 17(1), point 1, or that are named as holders of significant participations within an application for authorisation under section 9;
4. the holders of a significant participation in an insurance undertaking, and the undertakings controlled by them;
5. persons and undertakings for whom facts justify the assumption that they are persons or undertakings within the meaning of point 4; and
6. persons and undertakings related, under section 15 of the Stock Corporation Act, to a person or undertaking within the meaning of points 3 to 5.
(3) A person obliged under subsections (1) and (2) to provide information may refuse to answer questions the answering of which would expose that person, or a relative named in section 383(1), points 1 to 3, of the Code of Civil Procedure, to the risk of criminal prosecution or of proceedings under the Regulatory Offences Act.
(4) Insofar as necessary for providing information and submitting documents, the persons and undertakings obliged to provide information and submit documents under subsections (1) and (2) may process health data within the meaning of Article 4, point 15, of Regulation (EU) 2016/679. The general data protection provisions remain unaffected. Section 22(2) of the Federal Data Protection Act applies correspondingly.
(5) The supervisory authority may, for requests for information and submission under this provision, require electronic filing and lay down more detailed provisions on the manner of transmission.