(1) The competent supervisory authorities under this Act are entitled to process personal data to the extent necessary to perform their statutory functions.
(2) 1If the competent supervisory authorities under this Act process personal data in the course of a supervisory measure taken under this Act or on the basis of statutory instruments enacted under this Act, the data subjects do not enjoy the rights under Articles 15 to 18 and 20 to 22 of Regulation (EU) 2016/679 to the extent that fulfilling the rights of the data subjects would jeopardise the following:
- the purpose of the measure,
- the stability of the financial markets of the Federal Republic of Germany or of one or more signatories to the Agreement on the European Economic Area,
- any other important objective of general public interest in the Federal Republic of Germany or one or more signatories to the Agreement on the European Economic Area, in particular an important economic or financial interest, or
- the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including protection and defence against dangers to public safety.
2Under these conditions, the competent supervisory authority is also exempted from the obligations under Articles 12 to 14, 19 and 34 and the transparency requirements under Article 5 of Regulation (EU) 2016/679. 3Sentences 1 and 2 apply, with the necessary modifications, to persons and institutions that the competent supervisory authority uses to perform its functions, and to the registrar entity.
(3) The data subject must be informed about the lifting of the restriction, unless this is prejudicial to the purpose of the restriction.
(4) 1If no information is provided to the data subject in the cases set out in subsection (2) sentences 1 to 3, it must be provided to the Federal Commissioner for Data Protection and Freedom of Information or the supervisory authority responsible for data protection under Land law, depending on responsibility, if requested by the data subject, unless it is established on a case-by-case basis that this would endanger public safety at the federal or Land level, or would jeopardise the stability and integrity of the financial markets. 2The notification by the Federal Commissioner for Data Protection and Freedom of Information or the supervisory authority responsible for data protection under Land law to the data subject about the outcome of the data protection examination may not allow any conclusions to be drawn about the state of knowledge of the competent supervisory authority and of the persons and institutions the competent supervisory authority uses to perform its functions, insofar as they do not consent to any additional information.