Cap. 376 чл. 25Confidentiality.

(1) Nothing in this Act or any regulations and Rules issued thereunder shall authorise the competent authority to enquire or cause an enquiry to be made in a financial institution into the affairs of any individual customer of a financial institution except -

(a) for the purpose of ensuring compliance with any of the provisions of this Act; or

(b) where it is believed that the customer’s exposure could contribute a threat to the integrity of the country’s financial system.

(2) No person, including past and present officers of a financial institution or of a branch thereof, and agents of a financial institution, shall disclose any information relating to the affairs of that institution or of a customer of that institution which he has acquired in the performance of his duties or in the exercise of his functions under this Act and any regulations and, or Rules issued thereunder except:

(a) when authorised to do so under any of the provisions of this Act;

(b) for the purpose of the performance of his duties or in the exercise of his functions;

(c) when lawfully required to do so by any court or under a provision of any law.

(3) Where an officer of a financial institution has reason to believe that a transaction or a proposed transaction could involve money laundering, or the funding of terrorism, he shall act in compliance with the reporting and other obligations set out in any anti-money laundering and combating the funding of terrorism legislation and such disclosure shall not constitute a breach of confidentiality.

(4) Without prejudice to the provisions of article 20, persons who work or who have worked for the competent authority, as well as experts acting on behalf of the competent authority, without prejudice to cases falling within the ambit of criminal law, are bound by the duty of professional secrecy. The said persons and experts shall not disclose information obtained from financial institutions in the course of carrying out supervisory and other duties and which is governed by the duty of professional secrecy, unless such disclosure of information be done in summary or collective form, so as not to enable the identity of the financial institution, to whom such information relates, to be ascertained: Provided that the said officers, auditors or experts may divulge such information, for the purpose of the performance of their duties, or the exercise of their functions, or when lawfully required to do so by any court or under a provision of any law.

(5) Notwithstanding the provisions of any other law, a financial institution may, if circumstances so warrant, communicate any information which is in its possession and which relates to the affairs of a customer, to other members of the group of which that financial institution forms part.

(6) For the purposes of sub-article (5), the term "group" shall include any body corporate registered or operating in Malta or in a foreign jurisdiction and forming part of the group, and that is further licensed or otherwise authorised under the laws of Malta or of that jurisdiction to carry out any activity equivalent to the business of banking, or of the issuing of electronic money, or any of the activities referred to in the First Schedule annexed to the Banking Act.

(7) Exchange of information on mutual or connected customers between the financial institution, its holding company or its subsidiaries where a credit facility has been or may be granted to that customer shall not constitute a breach of confidentiality.

(8) Without prejudice to the provisions of article 20, any exchange of information between the competent authority and any European regulatory authority, the ECB, the Central Bank, national central banks of other Member States, the EBA or any other relevant authorities designated under European Union or national law applicable to payment services providers in accordance with article 20(1A) and (2) shall, in order to ensure the protection of individual and business rights, also be subject to the obligation of professional secrecy.

(9) The provisions of sub-articles (4) and (8) shall be applied taking into account, mutatis mutandis, Articles 53 to 61 of the CRD. DATA PROTECTION