(1) 1Insofar as persons employed by the competent supervisory authorities under section 50 or working for those supervisory authorities perform functions under section 51 (1), they must not, without authorisation, reveal or utilise facts that have come to their knowledge in the course of their activity if keeping these facts, in particular business and trade secrets, confidential is in the interest of an obliged entity or a third party subject to their supervision. 2Sentence 1 also applies when they are no longer on duty or when their employment has ended. 3The legal provisions concerning data protection to be observed by the obliged entities subject to supervision remain unaffected.
(2) Subsection (1) also applies to other persons who, through reporting in an official capacity, gain knowledge of the facts specified in subsection (1) sentence 1.
(3) Facts are not revealed or utilised without authorisation in particular if they are disclosed within the meaning of subsection (1), insofar as disclosure is not prohibited by other legal provisions,
- in summary or aggregate form in such a way that individual obliged entities cannot be identified, or
- to one of the following institutions, provided that these institutions need the information for the purpose of performing their functions:
a) to the law enforcement agencies, to the authorities and courts responsible for criminal cases and administrative fine proceedings,
b) to other institutions which, by law or in the public interest, are entrusted with investigating and preventing money laundering or terrorist financing or with the supervision of credit and financial institutions as defined in Article 3 of Directive (EU) 2015/849, as well as to persons acting on the instruction of these institutions,
c) to the European Central Bank, insofar as it is acting in accordance with Council Regulation (EU) No. 1024/2013 of 15 October 2013 conferring specific tasks on the European Central Bank concerning policies relating to the prudential supervision of credit institutions,
d) to the Financial Intelligence Units as defined in Article 32(1) of Directive (EU) 2015/849 and
e) to other institutions which, by law or in the public interest, are entrusted with supervising the general risk management or compliance of obliged entities as well as to persons acting on the instruction of these institutions.
(4) 1The facts within the meaning of subsection (1) may only be disclosed to one of the institutions referred to in subsection (3), if it is located in another country, or to a supranational institution, if the persons employed by this institution or acting on its behalf are subject to a duty of confidentiality that to a large extent corresponds to the duty of confidentiality laid out in subsections (1) to (3). 2The foreign or supranational institution must be advised by the disclosing institution that it may only use the facts for the purpose for which they have been transmitted. 3Facts originating from another country may only be disclosed - with the explicit approval of the competent authorities that notified these facts and
- for purposes approved by the competent authorities.