Duty of confidentiality

(1) Persons employed at the Bundesanstalt, persons engaged under section 4(3) of the Financial Services Supervision Act, special commissioners appointed under section 80(1), court-appointed trustees under section 27(2), and persons in the service of the Deutsche Bundesbank, insofar as they act in the application of this Act, may not without authorisation disclose or exploit facts that come to their knowledge in the course of their activity, the confidentiality of which is in the interest of the securities institution, of the competent authorities or of a third party, in particular business and trade secrets, even after they have left the service or their activity has ended. This also applies to the persons named in the first sentence where facts are entrusted to them in the course of the initiation of an engagement or appointment. The first sentence also applies to other persons who obtain knowledge of the facts referred to in the first sentence through official reporting. The general data-protection provisions to be observed by supervised securities institutions remain unaffected. Unauthorised disclosure or exploitation within the meaning of the first sentence does not in particular exist where facts are passed on to 1. prosecuting authorities or courts competent for criminal matters and matters involving regulatory fines; 2. bodies or authorities competent, by law or under public mandate, for the supervision of securities institutions, crowdfunding service providers, credit institutions, financial services institutions, management companies, externally managed investment companies, EU management companies or foreign AIF management companies, financial undertakings, insurance undertakings, the financial markets or payment transactions, and persons engaged by them; 3. bodies dealing with the liquidation or insolvency proceedings over the assets of a securities institution; 4. persons entrusted with the statutory audit of the accounts of securities institutions, and bodies supervising the aforementioned persons; 5. an investor compensation or guarantee scheme; 6. securities or derivatives exchanges; 7. central banks; 8. operators of systems within the meaning of section 1(16) of the Banking Act; 9. the competent authorities and bodies in other state parties and in third countries with which the Bundesanstalt cooperates within the framework of supervisory colleges under section 58; 10. the European Central Bank, the European System of Central Banks, the European Banking Authority, the European Insurance and Occupational Pensions Authority, the European Securities and Markets Authority, the Joint Committee of the European Supervisory Authorities, or the European Commission; 11. authorities competent for the supervision of payment and settlement systems; 12. parliamentary committees of inquiry under section 1 of the Committees of Inquiry Act, on the basis of a decision on a request under section 18(2) of the Committees of Inquiry Act; 13. the Federal Constitutional Court; 14. the Federal Court of Audit, insofar as its remit relates to the decisions and other activities of the Bundesanstalt under this Act or Regulation (EU) No 575/2013; 15. administrative courts in administrative proceedings in which the Bundesanstalt is the defendant, other than actions under the Freedom of Information Act; 16. the Bank for International Settlements for the purposes of quantitative impact studies, and the Financial Stability Board for the purposes of its monitoring tasks; 17. the International Monetary Fund or the World Bank for the purposes of assessment under the Financial Sector Assessment Program; 18. the Financial Stability Committee or the European Systemic Risk Board; 19. the body responsible for the Financial Market Stabilisation Fund within the meaning of section 10a(1) of the Financial Market Stabilisation Fund Act, or the steering committee within the meaning of section 4(1), second sentence of the Financial Market Stabilisation Fund Act; 20. bodies within the meaning of Article 2(1), points 17 and 18 of Regulation (EU) No 909/2014; 21. bodies competent for supervising compliance with Directive (EU) 2015/849 of the European Parliament and of the Council of 20 May 2015 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, amending Regulation (EU) No 648/2012 of the European Parliament and of the Council, and repealing Directive 2005/60/EC of the European Parliament and of the Council and Commission Directive 2006/70/EC (OJ L 141, 5.6.2015, p. 73), as last amended by Directive (EU) 2018/843 (OJ L 156, 19.6.2018, p. 43), on the part of the obliged entities listed in Article 2(1), points 1 and 2 of that Directive, and central reporting offices or other authorities entrusted, by law or under public mandate, with combating, investigating and preventing money laundering or terrorist financing; 22. competent authorities or bodies responsible for the application of the rules on structural separation within a banking group; 23. the Federal Office for Information Security; 24. competent authorities within the meaning of Article 2(1), letter r) of Regulation (EU) 2020/1503; or 25. natural or legal persons acting as special commissioners under section 80 or as trustees under section 27(2), or in a comparable capacity; the same applies to the passing on of information to that group of persons where necessary in connection with the initiation of an engagement or appointment, insofar as those bodies or persons need the information to perform their tasks, or to examine whether they are able to perform one of the tasks referred to in the fifth sentence, no. 25. The duty of confidentiality under the first sentence applies correspondingly to the persons employed at the bodies or by the persons named in the fifth sentence, nos. 1 to 11, 13 to 23 and 25, and to the persons engaged by those bodies or persons, and to the members of the committees named in the fifth sentence, nos. 12 and 19. Where the passing on of facts under the fifth sentence concerns personal data, the general data-protection provisions must be observed.
(2) Where a body named in subsection (1), fifth sentence, nos. 1 to 11, 16 to 18 and 20 to 22 is situated in another state, the facts may be passed on only if the persons employed at, and engaged by, that body are subject to a duty of confidentiality substantially corresponding to subsection (1). The foreign body must be advised that it may use the information only for the purpose for which it was transmitted to it. Information originating from a third country or from other persons or bodies may be passed on only with the express consent of the competent bodies that communicated the information, and only for such purposes as those bodies have consented to, or as are permissible on the basis of the cooperation or administrative arrangements concluded.
(3) Information may be passed on to bodies under subsection (1), fifth sentence, nos. 16 and 17 only where the request, having regard to the specific tasks performed by the requesting body under its statutory mandate, is sufficiently substantiated and sufficiently precise as to the nature, scope and format of the information requested and the means for its disclosure or transmission, the information requested is strictly necessary for the requesting body to perform its specific tasks and does not go beyond the statutory tasks assigned to it, and the information is transmitted or disclosed exclusively to the persons directly concerned with the performance of the specific task. Information other than aggregated and anonymised information may, in the cases under subsection (1), fifth sentence, nos. 16 and 17, be inspected only on the premises of the Bundesanstalt and the Deutsche Bundesbank.
(4) Sections 93, 97 and 105(1), section 111(5) in conjunction with section 105(1), and section 116(1) of the Fiscal Code apply to the persons referred to in subsection (1) only insofar as the tax authorities need the knowledge for the conduct of proceedings concerning a tax offence and a related assessment procedure. The provisions referred to in the first sentence do not apply, however, where the facts concerned were communicated to the persons referred to in subsection (1), first or third sentence, by the competent supervisory body of another state or by persons engaged by that body.
(5) Persons or bodies other than those named in subsection (1) that receive confidential information within the meaning of this Act may use that information only for the purposes expressly provided for by the Bundesanstalt. The Bundesanstalt is authorised to determine how information under subsection (1) is to be handled and to restrict any passing on of that information.
(6) Confidential information that competent authorities receive, exchange or transmit under section 11 or Regulation (EU) 2019/2033 may be used only for the performance of their tasks. Competent authorities may, in an individual case, expressly 1. determine separately how such information is to be handled; 2. prohibit any passing on of that information; or 3. restrict its passing on.