Duty of confidentiality

(1) Persons employed by, or engaged by, the insurance supervisory authorities, the special commissioners appointed under section 307, the liquidators appointed under section 308(1), second sentence, and the trustees appointed by the court under section 19(2), first sentence, and the members of the Insurance Advisory Council, may not pass on confidential information received in the course of their activity to any other person or authority. This also applies to the persons named in the first sentence, insofar as facts are entrusted to them in the course of the initiation of an engagement or appointment, and to other persons who gain knowledge of the information named in the first sentence through official reporting. The first and second sentences do not apply to the passing on of information in summarised or general form, in which the individual insurance undertakings cannot be identified.
(2) The duty of confidentiality under subsection (1), first sentence, does not prohibit the exchange of information with the competent authorities of other member or contracting states. The duty of confidentiality under subsection (1), first sentence, applies to the information received in this way.
(3) An exchange of information with competent authorities of third countries is permissible only where the protection of the information to be communicated is guaranteed by professional secrecy at least to the same extent as under this provision. This exchange of information must serve the performance of the supervisory tasks of these authorities. Where the information that a member state has to communicate to a third country originates from another member state, it may be passed on only with the express consent of the supervisory authority of that member state, and then only for the purposes to which that authority has consented.
(4) The supervisory authorities may use information they receive under subsections (1) and (2) only 1. to examine an insurance undertaking's application for the grant of authorisation, 2. to monitor the activity of an insurance undertaking, a group, or a financial conglomerate, 3. for orders of the supervisory authority, and for the prosecution and punishment of regulatory offences by the supervisory authority, 4. within an administrative procedure concerning legal remedies against a decision of the supervisory authority, and 5. within proceedings before administrative courts, insolvency courts, prosecuting authorities, or courts competent for criminal and regulatory offence matters.
(5) The duty of confidentiality under subsection (1) does not, in particular, prohibit the passing on of information to 1. prosecuting authorities or courts competent for criminal and regulatory offence matters, 2. bodies entrusted by law or by public mandate with monitoring insurance undertakings, insurance intermediaries, credit institutions, investment firms, crowdfunding service providers, capital management companies, externally managed investment companies, EU management companies, or foreign AIF management companies, financial undertakings, the financial markets or payment transactions, or with the prevention of money laundering, and persons engaged by these bodies, 3. bodies dealing with the liquidation or insolvency of an insurance undertaking, a credit institution, a financial services institution, an investment company, or another financial institution, 4. persons entrusted with the statutory audit of the accounts of insurance undertakings, credit institutions, capital management companies, externally managed investment companies, EU management companies, or foreign AIF management companies, or financial undertakings, and bodies supervising the aforementioned persons, 5. central banks, 6. the European Central Bank, the central banks of the European System of Central Banks, and other bodies with a similar function in their capacity as monetary authorities, the European Insurance and Occupational Pensions Authority, the European Banking Authority, the European Securities and Markets Authority, the Joint Committee of the European Supervisory Authorities, the European Systemic Risk Board, or the European Commission, 7. authorities competent for supervising payment and settlement systems, 8. bodies for administering protection funds, 9. parliamentary committees of inquiry under section 1 of the Committees of Inquiry Act, on the basis of a decision on a request under section 18(2) of the Committees of Inquiry Act, 10. the Federal Constitutional Court, 11. the Federal Court of Auditors, provided its examination mandate relates to the decisions and other activities of the Federal Institute under this Act or delegated acts based on Directive 2009/138/EC, 12. administrative courts in administrative-law disputes in which the Federal Institute is the defendant, with the exception of actions under the Freedom of Information Act, 13. the Federal Office for Information Security, 14. natural or legal persons who act as special commissioners under section 307, as liquidators under section 308(1), second sentence, or as trustees under section 19(2), first sentence, or in a comparable capacity; the same applies to the passing on of information to this group of persons that is necessary in the course of the initiation of an engagement or appointment, insofar as these bodies need the information to perform their tasks.
(6) In a crisis situation, in particular a crisis situation as described in Article 18 of Regulation (EU) No 1094/2010, information may be passed on without delay to the European Central Bank, to the central banks of the European System of Central Banks, and to the European Systemic Risk Board, insofar as these bodies need the information to perform their tasks.
(7) The duty of confidentiality under subsection (1), first sentence, does not prohibit the exchange of information with all undertakings belonging to a group within the meaning of section 7, point 13, even where this concerns information from other undertakings belonging to the group.
(8) The duty of confidentiality under subsection (1) applies correspondingly to persons employed by the bodies named in subsection (5), points 1 to 8 and 10 to 14, persons engaged by these bodies, and the members of the committees named in subsection (5), point 9. Where a body named in subsection (5), points 1 to 8, 12, and 14, is located in another state, the information may be passed on only where the persons employed by, and engaged by, this body are subject to a duty of confidentiality corresponding to subsection (1). The body of a third country must be advised that the information transmitted may not be used for any other purpose. Information originating from another state may be passed on only with the express consent of the competent bodies that communicated this information, and only for such purposes to which these bodies have consented.
(9) Sections 93, 97, 105(1), section 111(5) in conjunction with section 105(1), and section 116(1) of the Fiscal Code do not apply to the persons named in subsection (1), insofar as they act to implement this Act. This does not apply insofar as the tax authorities need the knowledge to conduct proceedings concerning a criminal offence and a related taxation procedure.
(10) Confidential information that the supervisory authority has received from the bodies named in subsection (2), first sentence, and subsection (5), points 2 to 7, may be passed on by way of official reporting under subsection (1), second sentence, only with the consent of the competent authority that provided the information. The same applies to information obtained in the course of an on-site examination of a branch in another member or contracting state; in this case, the consent of the competent authority of the member or contracting state in which the on-site examination was carried out is required.
(11) The general data protection provisions remain unaffected.