(1) The market surveillance authorities and the notifying authorities shall cooperate, within their respective areas of responsibility, in a spirit of cooperation and trust in order to perform their tasks. They shall share with one another observations and findings that may be relevant to the performance of their respective tasks.
(2) In so far as their respective areas of responsibility are affected in specific market surveillance activities or in examinations and measures under Article 79 of Regulation (EU) 2024/1689, the market surveillance authorities, the authorities and public bodies under Article 77(1) of Regulation (EU) 2024/1689 and the other authorities shall inform one another of measures they intend to take. In the course of implementing measures, they shall share with one another observations and findings that they need to perform their respective tasks under this Act or Regulation (EU) 2024/1689.
(3) Where the market surveillance authorities conclude that public bodies within the meaning of section 2(1) and (2) of the Federal Data Protection Act (Bundesdatenschutzgesetz) are infringing Regulation (EU) 2024/1689, this shall be communicated to the legal or technical supervisory authority (Rechts- oder Fachaufsichtsbehörde) responsible for the public body concerned, and that authority shall be given the opportunity to comment within a reasonable period before measures are taken against the public body. The opportunity to comment may be dispensed with where an immediate decision appears necessary because of imminent danger or in the public interest, or where a compelling public interest precludes it. The comments of the legal or technical supervisory authority should also describe the supervisory measures taken as a result of the notification by the authority or public body under the first sentence of subsection (2). The second sentence does not apply where the public bodies concerned are law enforcement authorities within the meaning of Article 3, point (45), of Regulation (EU) 2024/1689.
(4) In performing their tasks under Regulation (EU) 2024/1689, the market surveillance authorities shall also involve, in particular, the following other authorities in so far as their respective area of responsibility is affected:
the data protection supervisory authorities of the Federation and the Länder,
the market surveillance authority to be designated under Article 52(2) of Regulation (EU) 2024/2847, and
the Federal Cartel Office (Bundeskartellamt).
(5) The authorities referred to in subsections (1) to (4) may, within their area of responsibility and irrespective of the type of procedure chosen, exchange information with one another, including personal data and trade and business secrets, in so far as this is absolutely necessary for the performance of their respective tasks under Regulation (EU) 2024/1689 and this Act. They may use this information in their proceedings. Prohibitions on the use of evidence shall remain unaffected. The rules on mutual legal assistance in criminal matters and administrative and legal assistance agreements shall remain unaffected.
(6) Persons employed by BaFin and persons engaged by it may not, without authorisation, disclose or use facts that have come to their knowledge in the course of their activity and whose confidentiality is in the interest of a person obliged under Regulation (EU) 2024/1689, of the competent authorities or of a third party, in particular business and trade secrets, even after they have left service or their activity has ended. In particular, there is no unauthorised disclosure or use where
facts are passed on to authorities or other public bodies and passing on the information is necessary for those authorities or bodies to perform their tasks under this Act or Regulation (EU) 2024/1689, or
facts are passed on to the European Central Bank under Article 74(7) of Regulation (EU) 2024/1689, or where they are passed on to the Deutsche Bundesbank in so far as this is necessary in connection with the Deutsche Bundesbank's banking supervisory tasks.
(7) Where the facts referred to in subsection (6) are passed on to a domestic authority or body, persons employed by or engaged by that authority or body may not, without authorisation, disclose or use the facts, even after they have left service or their activity has ended. Facts may be passed on to foreign bodies only where persons employed by or engaged by that body are subject to the confidentiality obligation under Article 78 of Regulation (EU) 2024/1689 or to a duty of secrecy largely equivalent to the first sentence of subsection (6). Foreign bodies shall be advised that they may use the facts only for the purpose for which they are transmitted. Data protection provisions and powers to disclose and use information under other provisions shall remain unaffected.