1
 
UBS AG London Branch
5 Broadgate
London
EC2M 2QS
 
Allen & Overy LLP
52, avenue Hoche
75379 Paris Cedex 08
Tel
+33
(0)1 40 06 54 00
Fax
+33 (0)1 40 06 54 54
Our ref
0036335
-
0000808
29 October
2021
Dear Sir or Madam
 
UBS SEC registration as a non-resident security-based swap dealer
 
1.
 
BACKGROUND
1.1
 
We understand that UBS AG, a bank authorised in Switzerland, is seeking to register with the United
States (
US
) Securities and
 
Exchange Commission (
SEC
) as a non-resident
 
security-based swap (
SBS
)
dealer (
SBSD
).
1.2
 
To register as an SBSD with the SEC, a non-resident SBSD
1
 
such as UBS AG must attach an opinion
of counsel to Form SBSE, SBSE-A or SBSE-BD affirming that the SBSD can, as
 
a matter of law:
(a)
 
provide the
 
SEC with
 
prompt access
 
to the
 
relevant books
 
and records
 
as defined
 
in paragraphs
3.3 to 3.5 (
Covered Books and Records
); and
 
(b)
 
submit to on-site
 
inspection and examination
 
of its Covered
 
Books and Records by
 
the SEC
(
On-Site Inspection
).
1.3
 
UBS Europe
 
SE FR
 
is a branch
 
of UBS
 
Europe SE incorporated
 
in Germany and
 
authorized to
 
provide
services in Germany and France (among other jurisdictions).
We
 
understand that French Branch
 
of UBS Europe
 
SE (
UBS ESE FR
) and respectively
 
“associated
persons”
2
 
employed by it are effecting SBS Transactions in the name and for the account of UBS AG
(
SBS Transactions
). These
 
SBS Transactions,
 
being entered
 
into with
 
UBS AG,
 
are booked
 
with UBS
AG, London Branch, and the underlying relevant clients are clients
 
of UBS AG, London Branch.
Accordingly,
 
UBS ESE
 
FR will
 
maintain certain
 
Covered Books
 
and Records
 
in
 
UBS ESE
 
FR
 
on
behalf of UBS AG.
Given that UBS
 
ESE FR is
 
acting in the
 
name and for
 
the account of
 
UBS AG, UBS
 
ESE FR and
 
UBS
AG
 
have
 
agreed
 
that
 
in
 
the
 
context
 
of
 
UBS
 
AG’s
 
business
 
as
 
an
 
SBSD,
 
the
 
Covered
 
Books
 
and
Records in relation
 
to the SBS Transactions will
 
be shared with UBS
 
AG, London Branch,
 
in London,
in particular for group-risk management purposes.
 
1.4
 
You
 
have asked us to issue an opinion affirming that
 
under applicable French law, UBS ESE FR
 
can
share with
 
and make
 
available to
 
UBS AG,
 
London Branch
 
the Covered
 
Books and
 
Records in
 
relation
to
 
the
 
SBS
 
Transactions,
 
such
 
that
 
this
 
information
 
will
 
be
 
held
 
by
 
UBS
 
AG,
 
London
 
Branch,
 
in
London.
1
 
 
In the case of a corporation, an SBSD will be “non
-
resident” if it is incorporated
 
in or has its principal place of business in any place not in
the United States (see 17 Code of Federal Regulations (
CFR
) § 240.15Fb2-4(a)(2)). As UBS AG is incorporated in Switzerland, UBS AG
fulfils this definition of a “non-resident” SBSD.
2
 
 
We do
not give any views regarding this assumption.
 
 
 
2
 
1.5
 
This opinion is structured as follows:
(a)
 
Section 2:
 
Summary of opinion;
 
(b)
 
Section 3:
 
Scope, assumptions and qualifications;
 
(c)
 
Section 4:
 
Revisions to applicable law;
(d)
 
Section 5:
 
Reliance and confidentiality;
(e)
 
Annex 1: Opinion; and
(f)
 
Annex 2: Assumptions.
2.
 
SUMMARY OF OPINION
2.1
 
Subject
 
to
 
the
 
assumptions and
 
qualifications below,
 
it
 
is
 
our
 
opinion that
 
UBS ESE
 
FR
 
can, as
 
a
matter of applicable
 
French law, share with and
 
make available to
 
the London Branch
 
of UBS AG,
 
the
Covered Books and Records in relation to the SBS Transactions.
Data Protection
3
 
2.2
 
Disclosure of personal
 
data (particularly special
 
categories of data
 
or criminal data)
 
relating to UBS
ESE FR’s
 
counterparties and staff
 
are subject to
 
certain restrictions under the
 
Data Protection Laws,
particularly where it involves a cross-border transfer to a country or territory the EU has not found to
have an ‘adequate’ data
 
protection regime (bearing in
 
mind that the
 
UK has now been
 
recognised as
being an ‘adequate’
 
territory for the
 
transfer of personal
 
data). In addition,
 
there are certain
 
legal bases
for making disclosures, and derogations from the prohibition
 
on international transfers that would be
available to UBS
 
ESE FR, should
 
UBS AG, London
 
Branch require UBS
 
ESE FR to
 
disclose Covered
Books
 
and
 
Records
 
containing
 
personal
 
data
 
to
 
UBS
 
AG
 
London
 
Branch
 
for
 
the
 
purposes
 
of
 
risk
management.
 
2.3
 
Our view
 
is that
 
the ‘legitimate
 
interests’ legal
 
basis for
 
processing personal
 
data would
 
provide an
applicable ground
 
under the
 
EU GDPR,
 
to enable
 
the disclosure
 
of Covered
 
Books and
 
Records to
UBS AG London Branch for the purpose of risk management.
 
Secrecy Rules
2.4
 
Article L. 511-33
et seq
. of the
 
French Monetary and
 
Financial Code (the
MFC
) govern the
 
disclosure
by a
 
credit institution,
inter alia
, of
 
confidential information
 
regarding any
 
existing or
 
former customer
(the
Secrecy Rules
).
2.5
 
The
 
Secrecy
 
Rules
 
notably
 
apply
 
to
 
branches
 
of
 
credit
 
institutions
 
operating
 
in
 
France
 
under
 
a
European passport, such as UBS ESE FR.
2.6
 
Information protected under the Secrecy Rules generally includes any information received by
 
credit
institutions in the course of their activities, provided that such information is sufficiently confidential
and
 
specific.
 
The
 
scope
 
of
 
the
 
Secrecy
 
Rules
 
is
 
broad
 
and
 
includes
 
any
 
information
 
related
 
to
 
a
customer, including their name and
 
any details regarding
 
their assets, debts,
 
transactions or operations
carried out on their account (even transactions contemplated but not executed).
 
2.7
 
French law
 
provides for
 
a few
 
exceptions to
 
the Secrecy
 
Rules, including
 
for risk
 
management and
consolidated supervision purposes
 
of institutions established
 
in France, in
 
the event of
 
a written and
case-specific waiver from the customer
 
or of a request from French
 
criminal or regulatory authorities.
 
3
 
 
Please refer to section
 
of
 
for definitions of Data Protection Laws, EU GDPR,
 
and the French Data Protection Act.
 
 
3
 
2.8
 
Failing any
 
such exceptions,
 
breaches of
 
the
 
Secrecy Rules
 
could result
 
in
 
criminal and
 
regulatory
sanctions and trigger risks of civil litigation.
2.9
 
We consider that Secrecy Rules do not prevent UBS ESE FR
 
from sharing with and making available
to the
 
London branch
 
of UBS
 
AG, the
 
Covered Books
 
and Records
 
in relation
 
to the
 
SBS Transactions.
Blocking Statute
 
2.10
 
The French
 
Statute No.
 
68-678 dated
 
26 July
 
1968, as
 
amended, governs
 
the request,
 
search for
 
or
disclosure of information of an
 
economic, commercial, industrial, financial
 
or technical nature, with a
view to
 
establishing evidence in
 
foreign judicial
 
or administrative proceedings
 
or in
 
relation thereto
(the
Blocking Statute
).
2.11
 
As
 
its
 
title
 
suggests,
 
the
 
Blocking
 
Statute
 
applies
 
to
 
“
documents
 
or
 
information
 
of
 
an
 
economic,
commercial,
 
industrial,
 
financial
 
or
 
technical
 
nature
”
 
that
 
are
 
located
 
in
 
France.
 
It
 
prohibits
 
the
request, investigation
 
or communication
 
of such
 
documents or
 
information in
 
the context
 
or with
 
a
view to foreign administrative or judicial proceedings.
 
2.12
 
Breaches of the Blocking Statute may lead to criminal sanctions and trigger
 
risks of civil litigation.
2.13
 
We
 
consider that the Blocking Statute does
 
not prevent UBS ESE FR from
 
sharing with and making
available to
 
the London
 
branch of UBS
 
AG, the Covered
 
Books and Records
 
in relation
 
to the
 
SBS
Transactions.
 
Privacy and Human Rights
2.14
 
Protection
 
for
 
the
 
general
 
fundamental
 
right
 
to
 
“
respect
 
for
 
private
 
and
 
family
 
life,
 
home
 
and
correspondence
” is
 
enshrined in
 
Article 8
 
of the
 
European Convention
 
on Human
 
Rights (
ECHR
).
This
 
right is
 
directly applicable
 
in
 
France. However,
 
it
 
is to
 
be highlighted
 
that, in
 
France, if
 
legal
persons have a right
 
to see their
 
correspondence protected, only natural persons
 
can rely on /
 
benefit
from a right to privacy
 
4
.
2.15
 
Actions in
 
respect of
 
Article 8
 
of the ECHR
 
require a
 
separate cause
 
of action,
 
such as
 
an action
 
arising
from a wrongful act or other legal obligation, such as under the Data Protection
 
Laws.
 
2.16
 
Article 8 ECHR is, as it were, the
 
legal foundation on which the GDPR
 
has been based. The GDPR is
detailing the
 
fundamental right
 
laid down
 
in Article
 
8 of
 
the ECHR.
 
Thus, Article
 
8 ECHR
 
and the
GDPR are
 
intertwined with each
 
other.
 
As long as
 
the provision
 
of information
 
by UBS ESE
 
FR to
the London branch
 
of UBS AG
 
falls entirely within
 
the scope of
 
and is in
 
compliance with the Data
Protection Laws, we consider the
 
general fundamental right set out in
 
Article 8 of the
 
ECHR will be
protected.
 
This summary opinion is not a substitute for the full expression of our views
 
set out in Annex 1.
3.
 
SCOPE, ASSUMPTIONS AND QUALIFICATIONS
3.1
 
This opinion
 
relates solely
 
to access
 
provided to
 
UBS AG,
 
through its
 
London Branch,
 
of Covered
Books and Records held on its behalf by UBS ESE FR in France.
 
3.2
 
This opinion has been prepared in accordance with UBS AG’s specific instructions as to the scope of
the opinion.
 
4
 
Cour de Cassation (French Supreme Court), Civ 1ère, 17 March 2016
 
 
 
4
 
3.3
 
This opinion only covers the provision and sharing by UBS ESE FR to UBS AG, London
 
Branch, of
the Covered Books and Records held in France by UBS ESE FR in
 
relation to the SBS Transactions.
Covered Books and Records include only those books and records which:
(a)
 
relate to the
 
US business
5
 
of the non-resident
 
SBSD.
6
 
These are the
 
records that relate
 
to an
SBS Transaction that is either:
(i)
 
entered into, or offered to be entered into, by or on behalf of the
 
non-resident SBSD,
with a
 
“U.S. Person” as
 
defined in
 
17 CFR
 
§ 240.3a71-3(a)(4)
7
 
(
US Person
) (other
than an SBS conducted through a foreign branch of such US Person
8
); or
(ii)
 
arranged, negotiated, or executed by
 
personnel of the non-resident SBSD
 
located in a
branch in the United States (
US branch
) or office or by personnel
 
of an agent of the
non-resident SBSD located in a US branch or office;
9
 
or
(b)
 
constitute
 
financial
 
records
 
necessary
 
for
 
the
 
SEC
 
to
 
assess
 
the
 
non-resident
 
SBSD’s
compliance with the SEC’s margin and capital requirements, if applicable.
10
 
3.4
 
Further
 
to
 
Assumption
 
1,
 
this
 
opinion
 
is
 
limited
 
to
 
those
 
types
 
of
 
records
 
that
 
are
 
relevant
 
to
prudentially regulated SBSDs,
 
which excludes financial
 
records as noted
 
in paragraph 3.3(b)
 
above.
 
For this opinion, the term “Covered Books and Records” extends to these
 
record types alone.
3.5
 
This opinion covers data relating
 
to SBS Transactions concluded
 
between UBS AG, London Branch
through UBS ESE FR employees qualifying as associated persons.
 
These SBS Transactions will only
be concluded by authorised
 
UBS ESE FR personnel,
 
with UBS ESE
 
FR acting in
 
the name and
 
for the
account
 
of
 
UBS
 
AG,
 
London
 
Branch.
 
The
 
Covered
 
Books
 
and
 
Records
 
in
 
relation
 
to
 
those
 
SBS
Transactions
 
will be,
 
as
 
agreed between
 
UBS ESE
 
FR
 
and UBS
 
AG, London
 
Branch, also
 
held in
London.
This opinion only covers SBS Transactions entered into by UBS AG where UBS ESE FR
 
is acting in
the
 
name
 
and
 
for
 
the
 
account
 
of
 
UBS
 
AG.
 
This
 
opinion
 
does
 
not
 
cover
 
data
 
relating
 
to
 
SBS
Transactions concluded between UBS ESE FR
 
and its own counterparties
 
(even though UBS ESE FR
may be
 
relying on
 
the counting exemption
 
set out in
 
17 CFR
 
§ 240.3a71-3(d) for
 
such transactions,
we are instructed
 
that this data
 
is not relevant
 
for the purposes
 
of 17 CFR
 
§ 240.15Fb2-4(c) and
 
so this
data is not within scope of this opinion).
3.6
 
The issues
 
addressed in
 
this opinion
 
apply equally
 
across the
 
different document
 
types which
 
constitute
the Covered Books and
 
Records based upon the
 
information actually contained
 
in each of the relevant
Covered Books and Records. We have not examined any such documents or records.
 
3.7
 
In giving this opinion, we have made the further assumptions set out
 
in Annex 2.
 
3.8
 
No opinion is expressed on matters of fact.
 
5
 
 
As defined in 17 CFR §240.3a71
-
3(a)(8).
 
6
 
 
Cross
-
Border Application of Certain
[SBS] Requirements, 85 Fed.
 
Reg. 6270, 6296 (Feb. 4, 2020) (the
SEC Guidance
).
 
7
 
 
A “
U.S. person
” means any person
 
that is “
(i) a natural person
 
resident in the U.S.; (ii)
 
a partnership, corporation,
 
trust, investment vehicle,
or other legal person organized,
 
incorporated, or established under the laws of the
 
United States or having its principal place of
 
business
in the United States; (iii) an account (whether
 
discretionary or non-discretionary) of a U.S. person; or (iv) an estate of
 
a decedent who was
a resident of the United States at the time of death.
” 17 CFR § 240.3a71-3(a)(4).
8
 
 
A “
foreign branch
” means “
any branch of a U.S. bank if: (i) the branch is located outside of the United States; (ii) the branch operates for
valid business reasons;
 
and (iii) the
 
branch is engaged
 
in the business
 
of banking and
 
is subject to
 
substantive banking regulation
 
in the
jurisdiction where located.
” (17 CFR § 240.3a71-3(a)(2)). An “
SBS conducted through a foreign branch
” means an SBS that is “
arranged,
negotiated, and executed by
 
a U.S. person
 
through a foreign
 
branch of such
 
U.S. person if:
 
(A) the foreign
 
branch is the
 
counterparty to
such security-based swap transaction; and (B) the
 
security-based swap transaction is arranged, negotiated, and executed on
 
behalf of the
foreign branch solely by persons located outside the United States.
” (17 CFR § 240.3a71-3(a)(3)(i)).
9
 
 
17 CFR
 
§
 
240.3a71
-
3(a)(8)(i)(B).
 
10
 
 
The requirement
 
set out
 
in this
 
paragraph
 
does not
 
apply to
 
UBS AG
 
because it
 
is not
 
subject to
 
the SEC’s
 
margin and
 
capital
requirements as it is assumed that UBS AG has a prudential
 
regulator – please see Assumption
 
set out in
 
lofrancep5i0.gif
 
5
4.
 
REVISIONS TO APPLICABLE LAW
 
4.1
 
This opinion relates solely to French law and
 
European Union (
EU
) law that is directly applicable in
France
 
(i.e.
 
regulations
 
pursuant
 
to
 
Art.
 
288(2)
 
of
 
the
 
Treaty
 
on
 
the
 
Functioning
 
of
 
the
 
European
Union),
 
in
 
each
 
case,
 
in
 
force
 
as
 
at
 
the
 
date
 
of
 
this
 
opinion.
 
We
 
have
 
no
 
obligation
 
to
 
notify
 
any
addressee of any change in any applicable law or its application after the date of
 
this opinion.
5.
 
RELIANCE AND CONFIDENTIALITY
5.1
 
This opinion is
 
given for the
 
sole benefit of
 
the addressee. It
 
may not be
 
relied upon by
 
anyone else
without our prior written consent.
5.2
 
This
 
opinion
 
is
 
not
 
to
 
be
 
disclosed
 
to
 
any
 
person
 
outside
 
of
 
UBS
 
AG’s
 
group
 
or
 
used,
 
circulated,
quoted or otherwise referred to for any
 
other purpose. However, we agree that
 
a copy of this opinion
letter may be disclosed:
 
(a)
 
where
 
disclosure is
 
required
 
or
 
requested
 
by
 
any
 
governmental, banking,
 
taxation
 
or
 
other
regulatory authority or similar body having jurisdiction over
 
UBS AG (including to the SEC
as
 
part
 
of
 
UBS
 
AG’s
 
SBSD
 
registration
 
application) or
 
by
 
the
 
rules
 
of
 
any
 
relevant
 
stock
exchange or pursuant to any applicable law or regulation; and
 
(b)
 
to
 
UBS
 
AG’s
 
affiliates,
 
and
 
any
 
of
 
their
 
officers,
 
directors,
 
employees,
 
auditors,
 
insurers,
reinsurers, insurance brokers and professional advisors (in their capacity
 
as such).
5.3
 
Any such disclosure
 
must be made
 
on the basis
 
that it is
 
for information purposes only,
 
no recipient
may rely
 
on this advice,
 
no client-lawyer relationship between
 
us and the
 
recipient arises following,
or as a
 
result of, any
 
such disclosure. We assume no
 
duty or liability
 
to any recipient,
 
and any recipient
under paragraph 5.2(b) above will be subject to the same restrictions on disclosure
 
as set out above.
5.4
 
We
 
assume no obligation
 
to advise
 
you or
 
any other person
 
or to
 
make any
 
investigations as to
 
any
legal
 
developments
 
or
 
factual
 
matters
 
arising
 
subsequent
 
to
 
the
 
date
 
hereof
 
that
 
might
 
affect
 
the
opinions expressed herein.
 
Yours
 
faithfully,
 
 
 
Allen & Overy LLP
 
 
6
ANNEX 1
 
OPINION
1.
 
DATA
 
PROTECTION
 
1.1
 
The General
 
Data Protection
 
Regulation 2016/679
 
(
EU GDPR
),
 
and the
 
Act n°78-17
 
of
 
6 January
1978 on information
 
technology, data files and
 
civil liberties
 
as modified
 
(
French DPA
) (together, the
Data Protection
 
Laws
) will
 
apply to
 
UBS ESE
 
FR’s
 
disclosure of
 
Covered Books
 
and Records
 
to
UBS AG
 
London Branch
 
for the
 
purpose of
 
risk management,
 
to the
 
extent that
 
these comprise
 
or
contain personal data.
 
Personal data is
 
data relating to
 
an identified or
 
identifiable living individual,
and may
 
therefore extend
 
to information
 
on UBS
 
ESE FR’s staff
 
and US
 
Person counterparties
 
of UBS
AG, London Branch with whom UBS ESE FR concludes SBS Transactions.
 
1.2
 
Under
 
the
 
Data
 
Protection Laws,
 
specific
 
additional restrictions
 
apply
 
for
 
data
 
relating
 
to
 
criminal
convictions and offences.
 
These laws also
 
impose heightened restrictions
 
on the processing
 
of ‘special
category data’
 
– this
 
is data
 
that reveals
 
racial or
 
ethnic background,
 
political opinions,
 
religious or
philosophical
 
beliefs,
 
or
 
trade
 
union
 
membership,
 
genetic
 
data,
 
biometric
 
data
 
when
 
used
 
for
 
ID
purposes, health information, data concerning sex life
 
or sexual orientation. As special category
 
data
are
 
less
 
likely
 
to
 
be
 
relevant
 
in
 
the
 
context
 
of
 
UBS
 
ESE
 
FR’s
 
disclosures
 
of
 
Covered
 
Books
 
and
Records, the laws applicable to these data have not been considered
 
in detail in this opinion.
1.3
 
Key restrictions
 
in the
 
Data Protection
 
Laws relating
 
to UBS
 
ESE FR’s
 
ability to
 
disclose personal
data to UBS AG, London Branch are set out below.
Legal basis for the disclosure
1.4
 
UBS ESE FR requires a legal basis
 
under Article 6 of the EU
 
GDPR to disclose personal data to UBS
AG
 
London
 
Branch
.
 
Data
 
cannot
 
be
 
disclosed
,
 
should
 
such
 
disclosure
 
breach
 
a
nother
 
legal
requirement under applicable French law (e.g. the Secrecy Rules – please see section 2). Whilst there
are a number of Article 6
 
legal bases on which UBS ESE FR
 
may seek to rely,
 
none on its own is so
comprehensive as
 
to cover
 
all actions
 
falling within
 
the scope of
 
risk management
 
activities.
 
UBS ESE
FR will therefore need to consider the most appropriate legal basis
 
to apply to any given situation.
1.5
 
The Article 6
 
legal bases that
 
seem the most
 
relevant and applicable
 
to UBS ESE
 
FR, together with
their respective limitations, are as follows:
(a)
 
Consent (Article 6(1)(a))
: In order for consent
 
to be valid under the
 
Data Protection Laws, it
must satisfy
 
the high
 
standard of
 
being a
 
freely-given, specific,
 
informed and
 
unambiguous
indication of
 
wishes. As
 
a practical
 
matter,
 
in France, it
 
would be
 
very difficult
 
to establish
that consent
 
is freely given
 
where information relates
 
to UBS ESE
 
FR staff,
 
in an employment
context,
 
due
 
to
 
the
 
inherent
 
imbalance
 
of
 
power
 
between
 
an
 
employer
 
and
 
its
 
staff
 
(for
example, staff
 
may believe there
 
could be negative
 
consequences should they
 
refuse to give
consent). Further, consent will only be
 
valid if UBS ESE FR offers its
 
staff a genuine choice
over how the data is used, and will only
 
continue to be an appropriate legal basis if
 
UBS ESE
FR also offers its staff the opportunity to withdraw consent at any time.
 
Consent might therefore not generally be
 
considered as a valid legal
 
basis for disclosure and
UBS ESE FR should rely on
 
an alternative basis for disclosure (e.g. the legitimate interests).
Please note that valid consent is assumed at Assumption 5.
(b)
 
Legitimate interests (Article
 
6(1)(f))
: This is
 
a more flexible
 
legal basis for
 
processing that
 
can
apply to a multitude of business purposes,
 
including with a view to ensuring compliance
 
with
regulatory obligations. To rely on the legitimate interests ground, UBS ESE FR must:
 
 
 
7
 
(i)
 
identify its,
 
or a
 
third party’s (e.g. UBS
 
AG, London
 
Branch’s) legitimate
 
interest (this
can include commercial interests, individual interests or
 
broader societal benefits) in
complying with UBS AG, London Branch’s disclosure request;
 
(ii)
 
show that the
 
disclosure of documents to
 
UBS AG, London
 
Branch is necessary
 
for
achieving these interests; and
 
(iii)
 
balance
 
these
 
interests
 
against
 
the
 
competing
 
interests,
 
rights
 
and
 
freedoms
 
of
 
the
individuals concerned, and satisfy itself that those
 
interests do not outweigh its own.
If individuals would not
 
reasonably expect the disclosure, or
 
if the disclosure would
cause
 
unjustified
 
harm
 
to
 
the
 
individuals,
 
the
 
interests
 
of
 
those
 
individuals
 
would
likely override the interests of UBS ESE FR or the third party.
An
 
individual
 
has
 
the
 
right
 
to
 
object
 
to
 
the
 
disclosure
 
of
 
their
 
personal
 
data
 
to
 
UBS
 
AG,
London Branch under this basis for processing,
 
and UBS ESE FR would need
 
to demonstrate
‘compelling’
 
legitimate
 
grounds
 
to
 
process
 
the
 
data
 
that
 
override
 
the
 
rights,
 
freedoms
 
and
interests of that individual.
The balancing of
 
legitimate interests against
 
the competing interests,
 
rights and freedoms
 
of
the
 
individuals
 
concerned should
 
be
 
made
 
on
 
a
 
case-by-case
 
basis
 
and
 
should
 
consider all
available facts.
 
In particular, Recital
 
47 of
 
the GDPR
 
states that,
 
when balancing
 
their interests
against
 
those
 
of
 
the
 
individuals
 
concerned,
 
controllers
 
should
 
take
 
into
 
account
 
“
the
reasonable expectations
 
of data
 
subjects based
 
on their
 
relationship with
 
the controller
”. With
this in mind, UBS ESE FR may argue that its interests are not outweighed
 
by those of the US
Person counterparties of UBS AG, London Branch with whom UBS ESE FR concludes SBS
Transactions or UBS ESE FR’s employees on the basis that:
(A)
 
US
 
Person
 
counterparties
 
of
 
UBS
 
AG,
 
London
 
Branch
 
with
 
whom
 
UBS
 
ESE
 
FR
concludes
 
SBS
 
Transactions
 
are
 
aware,
 
due
 
to
 
statements
 
contained
 
in
 
their
 
client
terms
 
of
 
business
 
with
 
UBS
 
AG,
 
and
 
due
 
to
 
their
 
understanding
 
as
 
sophisticated
investors,
 
that
 
client
 
management
 
(including
 
risk
 
management)
 
will
 
conducted
 
by
UBS
 
on
 
a
 
group-wide
 
basis,
 
and
 
so
 
certain
 
information
 
regarding
 
their
 
SBS
Transactions, including
 
in some
 
cases their personal
 
data, may
 
be disclosed to
 
UBS
AG, London Branch; and
(B)
 
the
 
employees whose
 
personal data
 
may
 
be disclosed
 
to
 
UBS AG,
 
London Branch
understand their role
 
will involve risk management
 
conducted by UBS
 
AG, London
Branch and understand
 
that, as
 
a result, certain
 
of their personal
 
data may
 
be disclosed
to UBS AG, London Branch.
 
(c)
 
Disclosure
 
is
 
necessary
 
for
 
compliance
 
with
 
a
 
legal
 
obligation
 
to
 
which
 
UBS
 
ESE
 
FR
 
is
subject (Article 6(1)(c))
: There must be
 
a French nexus in
 
order for UBS ESE
 
FR to be
 
able
to rely on this legal basis. Article 6(3) requires that the legal obligation must be laid down by
French or EU law,
 
although this does
 
not have to
 
be an explicit
 
statutory obligation, as long
as the application of
 
the law is
 
foreseeable to UBS ESE
 
FR as the
 
person subject to
 
it.
11
 
We
have not identified a relevant
 
French or EU law obligation
 
and so we do not consider
 
that it is
possible
 
for
 
UBS
 
ESE
 
FR
 
to
 
rely
 
on
 
this
 
legal
 
basis
 
for
 
the
 
disclosure
 
of
 
personal
 
data
contained in the Covered Books and Records from a French data protection
 
law perspective.
1.6
 
It is possible that information contained in Covered Books and Records provided by UBS ESE FR to
UBS AG, London Branch, including personal
 
data, might be disclosed to
 
the SEC in the course of
 
the
conduct of supervision
 
of UBS AG,
 
London Branch (in its
 
capacity as an
 
SEC-registered SBSD) by
the SEC. In this context, it is also relevant that:
11
 
 
Recital 41
EU GDPR.
 
 
 
8
 
(a)
 
Consent (Article 6(1)(a))
: The considerations set out in paragraph 1.5(a) above
 
relating to the
validity of consent apply in this context.
 
(b)
 
Legitimate interests (Article
 
6(1)(f))
: In this
 
context, to rely
 
on the legitimate
 
interests ground,
UBS ESE
 
FR must
 
conduct the
 
same balancing
 
of competing
 
factors as
 
described in
 
paragraph
1.5(b) above. In this context, it is relevant that:
 
(A)
 
US
 
Person
 
counterparties
 
of
 
UBS
 
AG,
 
London
 
Branch
 
with
 
whom
 
UBS
 
ESE
 
FR
concludes
 
SBS
 
Transactions
 
are
 
aware,
 
due
 
to
 
statements
 
contained
 
in
 
their
 
client
terms
 
of
 
business
 
with
 
UBS
 
AG,
 
of
 
the
 
US
 
nexus
 
when
 
they
 
engage
 
in
 
SBS
Transactions and, due
 
to their understanding
 
as sophisticated
 
investors, that
 
regulatory
oversight
 
will
 
be
 
exercised
 
by
 
the
 
SEC,
 
which
 
may
 
entail
 
certain
 
information
regarding their
 
SBS Transactions,
 
including in
 
some cases
 
their personal
 
data, to
 
be
disclosed to the SEC by UBS AG London Branch; and
(B)
 
the employees whose personal
 
data may be disclosed
 
to the SEC understand
 
their role
will involve SEC oversight due
 
to their status as ‘associated
 
persons’ for the purposes
of SBS Transactions
 
and understand
 
that, as a
 
result, certain
 
of their personal
 
data may
be
 
disclosed
 
to
 
the
 
SEC.
 
More
 
specifically,
 
each
 
associated
 
person
 
is
 
required
 
to
complete an
 
‘SBS associated
 
person questionnaire’,
 
which provides
 
advance notice
that their
 
activities may involve
 
the disclosure of
 
their personal data
 
to the
 
SEC and
potentially require them to undertake interviews with the SEC. Each employee that
 
is
an associated person is
 
also required to agree
 
or acknowledge their understanding
 
that
their data may be provided
 
to the SEC in connection
 
with the SEC’s oversight of SBS
Transactions.
It is also relevant to this balancing of interests that:
(1)
 
the SEC is expected to restrict
 
its information requests for, and use of, any information
 
to
only the information that
 
it requires for the
 
legitimate and specific
 
purpose of fulfilling
 
its
regulatory
 
mandate
 
and
 
responsibilities,
 
with
 
the
 
type
 
and
 
amount
 
of
 
personal
 
data
requested being targeted
 
based on risk
 
and related to
 
specific transactions, accounts
 
and
employees;
12
 
and
(2)
 
information, data and documents received by the SEC are expected to be maintained in a
secure manner and only disclosed pursuant to strict US confidentiality
 
laws
13
.
(c)
 
Disclosure
 
is
 
necessary
 
for
 
compliance
 
with
 
a
 
legal
 
obligation
 
to
 
which
 
UBS
 
ESE
 
FR
 
is
subject (Article 6(1)(c))
: For the
 
same reason as
 
described in paragraph
 
1.5(c) above, we
 
do
not consider that it is
 
possible for UBS ESE FR
 
to rely on this legal basis
 
for the disclosure of
personal data by UBS AG, London Branch to the SEC.
1.7
 
Based upon the
 
above, the legitimate
 
interests legal basis
 
for processing is
 
therefore likely to
 
be the
most appropriate Article
 
6 ground on which
 
UBS ESE FR
 
could rely in order
 
to disclose personal
 
data
included in Covered Books and Records.
 
1.8
 
It is considered very unlikely that
 
data included in Covered Books
 
and Records provided to UBS
 
AG,
London
 
Branch
 
will
 
include
 
special
 
categories
 
of
 
data.
 
Further,
 
UBS
 
ESE
 
FR
 
might
 
not
 
hold
 
all
information
 
described
 
in
 
17
 
C.F.R.
 
§§.18a-5(b)(8)(i)(A)
 
through
 
(H)
 
or
 
240.18a-
 
5(a)(10)(i)(A)
through (H), as the
 
case may be, for an
 
associated person who is not
 
a US Person.
14
 
However, to the
12
 
 
Please refer to Assumption
 
in Annex 2, as
 
well as Article
 
IV of the
 
Memorandum of Understanding
 
Concerning Consultation, Cooperation
and the Exchange of Information Related to the Supervision and Oversight of Certain
 
Cross-Border Over-the-Counter Derivatives Entities
In Connection with the Use
 
of Substituted Compliance by Such
 
Entities entered into among the SEC,
 
the FCA and the PRA (the
UK MoU
).
13
 
 
Please refer to Assumption
 
in Annex 2, as well as Article VII of the UK
 
MoU.
14
 
 
As we understand is as defined in 17 C.F.R. §240.3a71
-
3(a)(4)(i)(A)
.
 
 
 
 
9
 
extent that this
 
does occur, and
 
such information is held
 
by UBS ESE FR
 
in addition to
 
an Article 6
legal basis, UBS ESE FR will need to
 
establish an additional legal basis for processing under Article
9 of the EU GDPR and the French DPA
 
if it discloses special categories of data to UBS AG, London
Branch. Other than valid consent
15
 
and public interest, the Article
 
9 legal basis that may be applicable
to disclosure of Covered Books
 
and Records is processing
 
is necessary for the establishment,
 
exercise
or
 
defence of
 
legal claims
 
or
 
whenever courts
 
are acting
 
in their
 
judicial capacity
 
(Article 9(2)(f)).
However,
 
please
 
note
 
that
 
there
 
is
 
no
 
guidance
 
from
 
the
 
French
 
data
 
protection
 
authority
 
(the
“Commission Nationale de
 
l’Informatique et des Libertés”)
 
on the applicability of
 
this particular legal
basis and that it is uncertain whether this legal basis can be extended
 
to this case.
 
1.9
 
Similarly, processing of
 
personal data
 
relating to
 
criminal convictions
 
and offences
 
is highly
 
restricted,
and can
 
only be
 
disclosed where
 
is authorised
 
by a
 
rule of
 
EU law,
 
by the
 
French DPA
 
or by
 
other
French laws or rules that have the
 
force of law.
 
In the absence of such rule of
 
EU law,
 
by the French
DPA
 
or by other French laws or rules – and we are aware of no such law or rule that would authorise
this disclosure to UBS AG, London Branch –
 
UBS ESE FR could not disclose these personal data to
the
 
UBS
 
AG,
 
London
 
Branch.
 
In
 
practice,
 
this
 
restriction
 
on
 
UBS
 
ESE
 
FR
 
is
 
dealt
 
with
 
by
 
this
information being provided and/or transferred directly by the individual (here, staff of UBS ESE FR)
to the requesting party (here, UBS AG, London Branch).
 
 
Data protection principles
1.10
 
In addition to establishing a legal basis for the disclosure, UBS ESE FR would need to ensure that its
disclosures are compliant with the remaining
 
requirements under the Data Protection
 
Laws, including
the data protection principles set out in Article 5 of the EU GDPR.
 
For example, UBS ESE FR must:
(a)
 
be transparent with those whose personal
 
data is to be disclosed to UBS
 
AG, London Branch,
who must
 
be provided
 
with fair
 
processing information
 
(usually in
 
the form
 
of a
 
privacy notice
or statement);
(b)
 
with
 
respect
 
to
 
the
 
data
 
itself,
 
ensure
 
that
 
it
 
only
 
provides
 
personal
 
data
 
that
 
is
 
adequate,
relevant and limited
 
to what is
 
necessary in relation
 
to the purposes
 
of its regulatory
 
activities;
 
(c)
 
be careful to avoid participating
 
in ‘data dumps’ and should
 
consider withholding documents,
anonymising personal data
 
(or pseudonymising
 
data where full
 
anonymisation is not
 
possible)
and redacting personal data from documents as appropriate;
(d)
 
ensure that the data is accurate and, where necessary, kept up to date;
(e)
 
keep the personal data
 
in a form that enables
 
identification of individuals for
 
no longer than is
necessary for the purposes for which the personal data is processed;
 
and
(f)
 
ensure
 
that
 
the
 
confidentiality
 
and
 
integrity
 
of
 
personal
 
data
 
is
 
maintained,
 
and
 
as
 
such,
implement appropriate security measures (e.g. encryption) to protect
 
the personal data.
1.11
 
UBS AG,
 
London Branch is
 
bound by the
 
requirements of
 
the EU GDPR
 
(even though
 
it is established
outside the
 
EEA),
16
 
as well
 
as the
 
General Data
 
Protection Regulation
 
2016/679 as
 
it forms
 
part of
15
 
 
Article 9(2)(a) of the EU GDPR
.
 
16
 
 
Per Article 71 of the EU
-
UK Withdrawal Agreement
, the EU GDPR remains applicable in the UK
 
following the end on 31 December 2020
of the transition period
 
effecting the UK’s
 
exit from the EU
 
in respect of the
 
processing of personal data of
 
data subjects outside the
 
UK,
provided that the personal data: (a) were processed under EU law in
 
the UK before the end of the transition period;
 
or (b) are processed in
the UK
 
after the
 
end of
 
the transition period
 
on the
 
basis of
 
the EU-UK
 
Withdrawal Agreement.
 
In particular,
 
EU GDPR
 
applies in
 
the
absence of
 
an adequacy decision
 
made by
 
the European Commission
 
in respect
 
of the
 
UK. On
 
28 June
 
2021 the
 
European Commission
adopted adequacy decisions
 
for the UK, including Commission
 
Implementing Decision of 28.6.2021
 
pursuant to Regulation (EU) 2016/679
of
 
the
 
European
 
Parliament
 
and
 
of
 
the
 
Council
 
on
 
the
 
adequate
 
protection
 
of
 
personal
 
data
 
by
 
the
 
United
 
Kingdom
 
(the
European
Commission’s UK Adequacy Decision
), thereby enabling the free-flow of personal data from the
 
EU to the UK.
 
However, for the first time, the adequacy decisions each include a so-called ‘sunset clause', which strictly limits their duration. This means
that the decisions will automatically
 
expire four years after their
 
entry into force. After that
 
period, the adequacy findings might
 
be renewed,
but only if the UK
 
continues to ensure an
 
adequate level of data
 
protection. During these four
 
years, the European Commission
 
will continue
 
 
10
 
“retained EU law” in the UK as defined in the UK’s European Union (Withdrawal)
 
Act 2018 and the
UK’s
 
Data Protection Act
 
2018. Accordingly,
 
UBS AG, London
 
Branch must take
 
these EU GDPR
principles
 
into
 
account
 
when
 
requesting
 
access
 
to
 
the
 
Covered
 
Books
 
and
 
Records
 
(albeit
 
that
 
the
responsibility remains with UBS ESE
 
FR to ensure that
 
its disclosures comply with all
 
requirements
under the Data Protection Laws and to implement its own compliance
 
measures to that end).
International transfers
1.12
 
The
 
general
 
principle
 
in
 
the
 
EU
 
GDPR
 
is
 
that
 
UBS
 
ESE
 
FR
 
may
 
not
 
transfer
 
personal
 
data
 
to
 
a
jurisdiction outside the EEA, unless
 
it can satisfy a
 
condition for the transfer
 
as set out in
 
Chapter V
of the EU GDPR.
 
1.13
 
Article 45 of the
 
EU GDPR allows
 
for UBS ESE
 
FR to transfer
 
personal data to
 
a recipient outside
 
the
EEA
 
where
 
the
 
transfer
 
is
 
based
 
on
 
an
 
adequacy
 
decision
 
of
 
the
 
European
 
Commission.
 
For
 
the
purposes
 
of
 
providing
 
Covered
 
Books
 
and
 
Records
 
to
 
UBS
 
AG
 
London
 
Branch,
 
the
 
European
Commission’s
 
UK
 
Adequacy
 
Decision
 
allows
 
transfers
 
of
 
personal
 
data
 
from
 
the
 
EEA,
 
including
France, to
 
the UK
 
to be
 
made freely.
 
Any transfer
 
from UBS
 
ESE FR
 
to UBS
 
AG London
 
Branch
would therefore be
 
permitted without limitation
 
(provided that the
 
disclosure otherwise
 
complied with
the EU GDPR).
1.14
 
As noted above, it
 
is possible that UBS
 
AG, London Branch
 
might share information
 
provided to it by
UBS ESE FR with
 
the SEC. This
 
might involve an
 
international transfer of
 
this personal data from
 
the
UK to
 
the US.
 
Where this
 
occurs, such
 
personal data
 
would remain
 
subject to
 
the Data
 
Protection Laws
when held by
 
UBS AG, London
 
Branch and so
 
an international transfer made
 
by UBS AG,
 
London
Branch must comply with the Data Protection Laws.
17
 
1.15
 
In this regard it is helpful that the European
 
Commission’s UK Adequacy Decision addresses onward
transfers from the UK and notes that the regime on international transfers under the
 
UK GDPR
18
 
and
UK
 
Data
 
Protection
 
Act
 
2018
 
is
 
“
in
 
substance
 
identical
”
 
to
 
the
 
transfer
 
regime
 
under
 
the
 
EU
GDPR.
19
The primary
 
options available to
 
UBS AG London
 
Branch under the
 
Data Protection Laws
when making such a transfer are set out below.
1.16
 
Derogations
 
(Article
 
49)
20
:
 
Where
 
a
 
transfer
 
mechanism
 
adopted
 
by
 
the
 
European
 
Commission
 
in
respect of a transfer of personal data to the
 
US is not available (as is currently the case),
 
a transfer or
a set
 
of transfers to
 
the SEC of
 
personal data contained
 
in Covered Books
 
and Records provided
 
by
UBS ESE FR to UBS AG London Branch may take place pursuant to a derogation under EU
 
GDPR,
provided
 
that
 
the
 
conditions
 
of
 
such
 
a
 
derogation
 
are
 
met.
 
These
 
derogations
 
include
 
consent
 
and
legitimate interests,
 
which are
 
the derogations
 
most likely
 
applicable in
 
this situation,
 
together with
their respective conditions.
 
 
(a)
 
Consent
:
 
the
 
data
 
subject
 
would
 
have
 
to
 
explicitly
 
consent
 
to
 
the
 
proposed
 
transfer,
 
after
having been
 
informed of
 
the possible
 
risks of
 
such transfers
 
for the
 
data subject
 
due to
 
the
absence
 
of
 
an
 
adequacy
 
decision
 
and
 
appropriate
 
safeguards.
 
In
 
practice,
 
it
 
would
 
be
 
very
difficult to
 
establish that
 
consent is
 
freely given
 
where information
 
relates to
 
UBS ESE
 
FR
staff in an employment context, due
 
to the inherent imbalance of power
 
between an employer
and its staff (for
 
example, staff may believe
 
there could be negative
 
consequences should they
refuse to
 
give consent). Further,
 
consent will only
 
be valid if
 
UBS ESE
 
FR offers
 
its staff
 
a
genuine choice over how the data
 
is used as part of the
 
transfer, and will
 
only continue to be
to monitor the legal situation in the UK and could intervene at any point, if the UK deviates from the level of protection currently in place.
Should the Commission decide to renew the adequacy finding,
 
the adoption process would start again.
17
 
 
Article 44 sent. 1, Recital 101 of the EU GDPR
.
 
18
 
 
The
General Data Protection Regulation
 
2016/679 as it forms part
 
of “retained EU law” as
 
defined in the European Union
 
(Withdrawa
l) Act
2018 in the UK (
UK GDPR
).
19
 
 
Paragraph 2.5.7, recitals (74) and (75) of the
European Commission’s UK Adequacy Decision
.
 
20
 
 
The European
 
Data Protection
 
Board has
 
issued guidelines
 
to provide
 
guidance as
 
to the
 
application of
 
Article 49
 
of the
 
EU GD
PR on
derogations in the context of transfers of personal data to
 
third countries.
 
 
11
 
a valid derogation if UBS ESE FR also offers its staff the opportunity to withdraw consent at
any time. Consent
 
should therefore not
 
be considered as
 
a valid derogation
 
for disclosure of
personal data relating
 
to such staff and
 
UBS AG, London
 
Branch should rely
 
on an alternative
basis for transfers of personal data (e.g. the legitimate interests).
 
(b)
 
Legitimate interests
: In case consent
 
and none of the
 
other derogations are applicable, and
 
if
the transfer
 
(i) is not
 
repetitive, (ii) concerns
 
only a
 
limited number
 
of data
 
subjects, (iii) is
necessary for
 
the purposes
 
of compelling
 
legitimate interests
 
pursued by
 
UBS AG,
 
London
Branch, (iv) UBS
 
AG, London
 
Branch’s legitimate interests
 
are not
 
overridden by
 
the interests
or rights and freedoms of the data subjects, (v) UBS AG, London Branch has assessed all the
circumstances surrounding
 
the data
 
transfer,
 
and (vi) UBS
 
AG, London
 
Branch has,
 
on the
basis of
 
that assessment,
 
provided suitable
 
safeguards with
 
regard to
 
the protection
 
of personal
data, the
 
legitimate interests
 
derogation may
 
be relied
 
upon. In
 
such a
 
case, the
 
controller shall,
in addition
 
to providing
 
the information
 
referred to
 
in Articles
 
13 and
 
14 of
 
the EU
 
GDPR,
inform the data subject of the transfer and of the compelling
 
legitimate interests pursued.
Each of the consent and legitimate interest derogations need to be applied
 
on a case-by-case basis.
21
 
1.17
 
Access to Covered
 
Books and
 
Records granted
 
to the SEC
 
in the course
 
of On-Site
 
Inspections of
 
UBS
AG, London Branch
 
would not entail
 
UBS AG, London
 
Branch effecting an international
 
transfer and
so restrictions in Chapter V of the EU GDPR would not apply
 
to that situation.
2.
 
SECRECY RULES
2.1
 
Article
 
L.
 
511-33
et
 
seq
.
 
of
 
the
 
MFC
 
govern
 
the
 
disclosure
 
by
 
a
 
credit
 
institution,
inter
 
alia
,
 
of
confidential information regarding any existing or former customer (the
Secrecy Rules
).
2.2
 
Articles L.
 
511-33
 
I and
 
L. 511
 
-34 of
 
the MFC
 
apply to
 
branches of
 
credit institutions
 
operating in
France under a European passport, pursuant to Article L. 511-24 5° of the MFC.
Scope of protection
2.3
 
Information protected under the Secrecy Rules generally includes any information received by
 
credit
institutions in the course of their activities, provided that such information is sufficiently confidential
and
 
specific.
 
The
 
scope
 
of
 
the
 
Secrecy
 
Rules
 
is
 
broad
 
and
 
includes
 
any
 
information
 
related
 
to
 
a
customer, including their name and
 
any details regarding
 
their assets, debts,
 
transactions or operations
carried out on their account (even transactions contemplated but not executed).
 
2.4
 
The
 
Secrecy
 
Rules
 
apply
 
equally
 
to
 
individual
 
and
 
corporate
 
customers,
 
including
 
managers,
employees
 
and
 
counterparts of
 
corporate
 
customers. Anonymized
 
transaction
 
data,
 
which does
 
not
enable the direct or indirect identification of a customer, is not protected by the Secrecy Rules.
 
2.5
 
The view
 
of most
 
scholars and
 
practitioners is
 
that pursuant
 
to the
 
French principle
 
of territoriality,
the Secrecy Rules apply to information collected by
 
institutions established in France in the course of
their business
 
relationships with
 
a customer
 
or potential
 
customer, regardless of
 
their citizenship.
 
Thus,
information collected
 
by a
 
French branch
 
of a
 
foreign credit
 
institution operating
 
under a
 
European
passport in France
 
and transmitted
 
to its foreign
 
head office or
 
another foreign
 
branch remains covered
by the Secrecy Rules.
 
Application and relevant exceptions
2.6
 
We understand that UBS ESE FR will be acting in the name and for the account of UBS AG,
 
London
Branch in relation to the SBS
 
Transactions. In principle, information relating to the
 
SBS Transactions
21
 
 
Article 49(1) EU GDPR at sentence 1 paragr
aph (a) and sentence 2, respectively.
 
 
 
 
 
12
 
carried out in the name and for
 
the account of UBS AG, London Branch, by UBS ESE
 
FR should be
disclosed by UBS ESE FR to UBS AG, London Branch.
 
2.7
 
The information held by UBS ESE FR in relation to the SBS Transactions may contain details which
do not need to be disclosed to UBS
 
AG, London Branch or belong to UBS
 
AG, London Branch (such
as information pertaining
 
to the US
 
Person counterparty
 
of UBS AG,
 
London Branch); which
 
may fall
within the ambit of the Secrecy Rules applicable to UBS ESE FR.
 
Risk management and consolidated supervision
2.8
 
Pursuant to Article L.
 
511-34 of the
 
MFC, institutions established in
 
France belonging to a
 
financial
group
 
are
 
allowed
 
to
 
share
 
certain
 
information
 
with
 
foreign
 
entities
 
belonging
 
to
 
the
 
same
 
group,
provided that the headquarters of these
 
foreign entities are located in an
 
EU or EEA Member State, or
in
 
a
 
State
 
whose
 
authorities
 
have
 
entered
 
into
 
a
 
cooperation
 
agreement
 
with
 
the
 
French
 
Financial
Markets Authority (the
AMF
) or the French Banking Regulator (the
ACPR
).
2.9
 
This
 
exception
 
to
 
the
 
Secrecy
 
Rules
 
is
 
limited
 
to
 
information
 
which
 
is
 
deemed
 
necessary
 
for
 
the
purposes of:
●
 
Supervising the group entities on a consolidated basis;
●
 
Assisting the fight against money laundering and terrorism financing;
●
 
Detecting and preventing market abuse; or,
●
 
Managing conflicts of interest.
2.10
 
To that extent, we note that:
●
 
UBS AG,
 
London Branch and UBS ESE FR belong to the same group;
●
 
In relation
 
to the
 
SBS Transactions,
 
UBS AG
 
is subject
 
to regulatory
 
supervision by
 
Swiss
supervisory
 
authorities
 
(e.g. the
 
Financial
 
Market
 
Supervisory
 
Authority
 
(
FINMA
));
 
for
activities carried
 
out in
 
the London
 
Branch of
 
UBS AG,
 
also by
 
the UK
 
supervisory authorities
(the
 
Prudential Regulation
 
Authority
 
(
PRA
)
 
and
 
the
 
Financial
 
Conduct
 
Authority (
FCA
));
and, pursuant to UBS
 
AG’s status
 
as an SEC-registered SBSD (which includes
 
the activities
of UBS AG, London Branch),
 
the SEC;
●
 
UBS AG,
 
London Branch, is located in
 
the United Kingdom, whose authorities, for
 
instance
the PRA and
 
the FCA, executed
 
a MoU with
 
the ACPR
 
“
to formalise supervisory
 
cooperation
and information
 
sharing arrangements
 
[…]
in
 
order
 
to
 
promote
 
the integrity,
 
stability and
efficiency of the supervised entities and financial system
” on 10 April 2019
22
.
●
 
The headquarters of
 
UBS AG are
 
located in Switzerland,
 
whose authorities, for instance
 
the
Commission
 
fédérale
 
des
 
banques
(the
 
predecessor
 
to
 
FINMA)
 
executed
 
a
 
MoU
 
with
 
the
Commission bancaire
(the predecessor to
 
the ACPR) with
 
a view “
to cooperate and
 
exchange
all relevant
 
information for the
 
effective supervision of supervision
 
of financial markets
 
and
banking and financial institutions
”, on 2 December 2002
23
;
●
 
UBS ESE FR will
 
be effecting SBS Transactions
 
in the name and
 
for the account
 
of UBS AG,
London
 
Branch,
 
which
 
may
 
give
 
rise
 
to
 
a
 
variety
 
of
 
risks,
 
including
 
potential
 
money
laundering, market abuse or conflict of interest risks.
 
22
 
 
Available of the FCA website:
https://www.fca.org.uk/publication/mou/mou-acpr-boe-fca.pdf
.
23
 
 
A
vailable on the
ACPR
’s website
 
in French onl
y
:
https://acpr.banque-france.fr/sites/default/files/20021206-accord-entre-cb-cfb-suisse.pdf
.
 
 
 
13
 
2.11
 
Whilst the very purpose
 
of this exception is
 
to enable intra-group exchange
 
of information for internal
risk management
 
purposes, our
 
view is
 
that UBS
 
ESE FR
 
would be
 
able to
 
share information
 
with
UBS AG
 
London Branch
 
on the
 
basis of
 
such exception,
 
subject to
 
such information
 
being strictly
limited to
 
information obtained
 
or collected
 
by UBS
 
ESE FR
 
when acting
 
in the
 
name and
 
for the
account of UBS AG,
 
in the context of the SBS Transactions.
 
Waiver
2.12
 
Should it obtain a written waiver from the relevant customer,
 
UBS ESE FR would be in a position to
disclose protected
 
information
24
 
revolving around
 
that customer
 
to UBS AG
 
London Branch.
 
Pursuant
to Article
 
L. 511-33
 
of the
 
MFC, such
 
waiver must
 
be granted
 
on a
 
case-by-case basis
 
(i.e. general
consent allowing the transfer of information in any circumstance
 
may not be sufficient).
Request from French criminal or regulatory authorities
2.13
 
A branch of a credit institution operating under
 
a European passport in France cannot use the Secrecy
Rules to oppose disclosure to the French criminal and regulatory authorities.
25
 
Potential sanctions
2.14
 
Breaches of the
 
Secrecy Rules could
 
result in criminal
 
and regulatory sanctions,
 
and trigger risks
 
of
civil litigation.
Criminal sanctions
2.15
 
In the event of a breach
 
of the Secrecy Rules, the entity’s
 
directors and employees may incur up to 1
year’s imprisonment
 
and/or a
 
fine of
 
up to
 
EUR 15 000.
 
The entity
 
itself may
 
incur a
 
fine of
 
up to
EUR
 
75 000
 
as
 
well
 
as
 
additional
 
penalties,
 
such
 
as
 
the
 
temporary
 
or
 
definitive
 
closure
 
of
 
the
establishment that was used to commit the breach.
26
 
Regulatory sanctions
2.16
 
The ACPR
 
is in
 
charge of
 
monitoring compliance
 
by credit
 
institutions operating in
 
France under
 
a
European
 
passport
 
with
 
the
 
provisions
 
that
 
are
 
applicable
 
to
 
them
 
under
 
French
 
law,
 
taking
 
into
account the supervision performed
 
by the relevant authorities
 
of the Member State
 
in which they have
their
 
head
 
office
 
(which
 
are
 
solely
 
responsible,
 
in
 
particular,
 
for
 
the
 
assessment
 
of
 
their
 
financial
situation, their
 
operating conditions,
 
solvability,
 
liquidity and
 
their ability
 
to fulfil
 
at all
 
times their
commitments
 
with
 
respect
 
to
 
their
 
policy
 
holders,
subscribers
,
beneficiaries
 
and
 
reinsured
companies).
27
 
2.17
 
In this
 
context, the
 
ACPR has
 
inspection and sanction
 
powers, including
 
the power
 
to prohibit
 
such
credit institutions
 
from continuing to provide banking services on French territory.
28
 
2.18
 
If the ACPR notices
 
that a credit institution
 
operating in France under a
 
European passport breaches
or
 
may
 
breach
 
the
 
provisions of
 
Chapter
 
1
 
of
 
Title
 
1 of
 
Book
 
5
 
of
 
the
 
MFC
 
–
 
which
 
includes
 
the
Secrecy Rules –, it should
 
inform the relevant authorities
 
of the Member State
 
of the country in which
the credit institution has
 
its registered office, so
 
that the latter can
 
immediately take any measures
 
to
ensure compliance with these provisions.
 
Should it consider that
 
the latter have not fulfilled
 
or are not
going fulfil their obligations, it can make a request
 
for assistance to the European Banking Authority
in accordance with
 
Article 19 of
 
Regulation (EU) no.
 
1093/2010 of the
 
European Parliament and
 
of
24
 
 
See Article L. 511
-
33
 
I
 
of the MFC.
 
25
 
 
See
Article L. 511
-
33
I
of the MFC.
 
26
 
 
See Articles L. 571
-
1 and 571
-
4 of the MFC and Articles 226
-
13, 131
-
38 and 131
-
39 of the French Criminal Code.
 
27
 
 
See
Article L. 612
-
2 III of the MFC.
 
28
 
 
See Article L. 613
-
33 of the MFC.
 
 
 
 
 
 
 
14
 
the Council of 24
 
November 2010 establishing
 
a European Supervisory
 
Authority (European Banking
Authority).
29
 
Risk of litigation
 
2.19
 
Customers
 
and
 
third
 
parties
 
whose
 
protected
 
data
 
would
 
be
 
illicitly
 
transferred
 
could
 
seek
compensatory damages under French law. Punitive damages are not available.
2.20
 
To
 
seek compensation before the
 
French courts, the alleged
 
victims would need to
 
demonstrate (i) a
failure by UBS ESE FR (i.e. a breach of the Secrecy Rules), (ii) the damages they have
 
suffered, and
(iii) a direct link of causation between such failure and damages.
 
3.
 
BLOCKING STATUTE
 
3.1
 
The
 
Blocking
 
Statute
 
governs the
 
request,
 
search
 
for or
 
disclosure of
 
information of
 
an
 
economic,
commercial, industrial, financial
 
or technical nature,
 
with a view
 
to establishing evidence
 
in foreign
judicial or administrative proceedings or in relation thereto.
 
Scope of protection
3.2
 
The Blocking
 
Statute applies to
 
“
documents or information
 
of an
 
economic, commercial,
 
industrial,
financial
 
or technical
 
nature
”
 
that are
 
located
 
in
 
France and
 
prohibits the
 
request, investigation
 
or
communication of documents
 
or information in the
 
context or with a
 
view to foreign administrative
 
or
judicial proceedings.
 
Application and relevant exceptions
 
3.3
 
The prohibitions imposed by the Blocking Statute do not apply to transfers
 
of documents,
 
which:
●
 
are not made
 
in the context
 
or with a
 
view to foreign administrative
 
or judicial proceedings;
or,
●
 
are
 
made
 
in
 
compliance
 
with
 
applicable
 
French
 
law,
 
an
 
applicable
 
international
 
treaty
 
or
agreement (e.g. the
 
Hague Convention,
 
a Memorandum of
 
Understanding (
MoU
) entered into
by the ACPR or the AMF,
30
 
or a mutual legal assistance treaty)
31
.
3.4
 
In the case
 
at hand,
 
we understand
 
that the provision
 
and sharing
 
by UBS
 
ESE FR
 
to UBS
 
AG, London
Branch, of
 
the Covered
 
Books and
 
Records held
 
in France
 
by UBS
 
ESE FR
 
in relation
 
to the
 
SBS
Transactions:
●
 
would
 
be
 
made
 
for
 
risk
 
management
 
purposes,
 
given
 
the
 
role
 
of
 
UBS
 
ESE
 
FR,
 
and
respectively associated persons employed by UBS ESE
 
FR, to effect SBS Transactions in the
name and for the account of UBS AG,
and therefore,
 
●
 
would
 
not
 
be
 
made
 
in
 
the
 
context
 
or
 
with
 
a
 
view
 
to
 
foreign
 
administrative
 
or
 
judicial
proceedings.
 
3.5
 
In this context, we
 
believe that the Blocking
 
Statute should not prevent the
 
provision and sharing by
UBS ESE FR to
 
UBS AG, London
 
Branch, of the
 
Covered Books and
 
Records held in
 
France by UBS
ESE FR in relation to the SBS Transactions.
29
 
 
See Article R. 613
-
34 of
the MFC.
 
 
 
 
 
15
 
Potential sanctions
3.6
 
Breaches to
 
the Blocking
 
Statute may
 
lead to
 
criminal sanctions,
 
of up
 
to
 
6 months’
 
imprisonment
and/or a fine of up to EUR 18 000 for individuals or a fine of up to EUR 90
 
000 for entities.
 
3.7
 
A risk of civil
 
litigation may also
 
arise where parties
 
could evidence a
 
direct link of
 
causation between
the violation of the Blocking Statute and the damages they have suffered.
 
4.
 
PRIVACY
 
AND HUMAN RIGHTS
4.1
 
Article 8 of the
 
European Convention on Human
 
Rights (
ECHR
) confers a
 
general right to “
respect
for his private and
 
family life, his home
 
and his correspondence
”. This right is
 
directly applicable in
the
 
France
.
32
 
The
 
right
 
to
 
privacy
 
clearly
 
applies
 
to
 
natural
 
persons.
 
However,
 
in
 
France,
 
if
 
legal
persons have a right
 
to see their
 
correspondence protected, only natural persons
 
can rely on /
 
benefit
from a right to privacy
33
.
4.2
 
Article 8 ECHR
 
does not in
 
itself give rise
 
to a free-standing
 
cause of action
 
– instead an
 
action arising
from a wrongful act,
 
a breach of agreement
 
or other legal obligation,
 
such as under the
 
GDPR, must
be brought, and the court will then be obliged to consider the application
 
of Article 8 ECHR.
 
4.3
 
Article 8 ECHR is, as it were, the fundamental legal foundation on
 
which the GDPR has been based.
The GDPR elaborates
 
on the applicable
 
principles of and
 
the rules on the
 
protection of natural
 
persons
when it
 
comes to
 
processing of
 
personal data.
34
 
The ECHR
 
can further
 
be relied
 
upon when
 
interpreting
these
 
GDPR
 
principles
 
and
 
rules
 
if
 
necessary.
 
The
 
GDPR
 
can
 
therefore
 
be
 
seen
 
as
 
the
 
regulation
detailing the right laid down in Article 8 ECHR, when it comes to the processing
 
of personal data.
Application and exceptions
4.4
 
There shall be no interference
 
by a public authority with
 
the exercise of the right
 
to respect for private
and family life,
 
his home and
 
his correspondence, except
 
in situations
 
where the specific
 
conditions
set out under Article 8(2) of
 
the ECHR are met. Article
 
8 is therefore a qualified right,
 
meaning that it
can be breached in accordance with Article 8(2) – that is, where doing
 
so is:
(a)
 
in accordance with the law;
This
 
criterion
 
has
 
two
 
aspects:
 
the
 
measure
 
complained
 
about
 
must
 
have
 
some
 
basis
 
in
domestic law,
 
and secondly,
 
that the
 
domestic law
 
has to
 
be sufficiently
 
precise so
 
that an
individual can foresee with a reasonable degree of certainty the
 
consequences of their actions
or the circumstances in which the authority may take a particular course
 
of action.
35
 
(b)
 
is necessary in a democratic society;
 
This criterion
 
is intended
 
to ensure
 
the proportionality
 
of an
 
intrusion into
 
private life.
 
To meet
this criterion, there must be a “
pressing social need
” for the interference, and the interference
must be proportionate to that need.
36
 
and
(c)
 
in the interests
 
of national security,
 
public safety or the
 
economic well-being of the
 
country,
for
 
the
 
prevention
 
of
 
disorder
 
or
 
crime,
 
for
 
the
 
protection
 
of
 
health
 
or
 
morals,
 
or
 
for
 
the
protection of the rights and freedoms of others (i.e. a legitimate aim).
32
 
 
Article 9 of the French Civil Code and Article 226
-
15 of the French Criminal Code
 
33
 
Cour de Cassation (French Supreme Court), Civ 1ère, 17 March 2016
 
34
 
 
See also Whereas (1) and (2) GDPR.
 
35
 
 
Malone v UK [1984] ECHR 10 at 68.
 
36
 
Dudgeon v UK
 
(1982) 4 E.H.R.R. 149 at 164.
 
16
This
 
criterion
 
is
 
intended
 
to
 
ensure
 
that
 
the
 
purpose
 
of
 
an
 
intrusion
 
into
 
private
 
life
 
is
adequately serious so as to justify the intrusion.
 
 
 
 
 
 
17
 
ANNEX 2
 
ASSUMPTIONS
This opinion relies on the following assumptions:
1.
 
In the context of the SBS Transactions, UBS ESE FR will provide investment services in accordance
with all applicable French laws and regulations.
2.
 
UBS AG has
 
a “prudential regulator”
 
as defined by
 
Section 3 of
 
the US Securities
 
Exchange Act of
1934
 
(the
Securities Exchange
 
Act
).
 
As
 
such,
 
the
 
Covered Books
 
and
 
Records considered
 
in
 
this
opinion are limited to what a prudentially regulated SBSD must be able to
 
share with the SEC.
 
3.
 
Additionally, in accordance with SEC Guidance at
 
85 FR 6297, books and records pertaining to SBS
Transactions entered into prior to
 
the date that UBS
 
AG submits an application
 
for registration are not
Covered Books and Records.
 
4.
 
Where transfers
 
of personal
 
data are
 
made by
 
UBS ESE
 
FR to
 
UBS AG,
 
London Branch,
 
in the
 
absence
of an adequacy determination, such disclosure will be made in compliance with Articles 44
et seq
. of
the EU
 
GDPR and limited
 
to what
 
is necessary for
 
the purpose
 
of the
 
transfer (i.e. compliance
 
with
the
 
principle
 
of
 
data
 
minimisation,
 
e.g.
 
by
 
applying
 
less
 
intrusive
 
processing
 
activities
 
such
 
as
redaction).
5.
 
UBS AG or, as
 
the case may
 
be, UBS ESE
 
FR has obtained any
 
necessary prior consent
 
of the persons
(e.g
.
,
 
counterparties,
 
employees)
 
whose
 
information
 
is
 
or
 
will
 
be
 
included
 
in
 
Covered
 
Books
 
and
Records, to the extent, as considered in this opinion, such consent would constitute valid consent and
such consent has not
 
been withdrawn. Insofar as Covered Books
 
and Records relate to employees
 
of
UBS
 
ESE
 
FR,
 
such
 
employees
 
are
 
“associated
 
persons”
37
 
of
 
UBS
 
AG
 
for
 
purposes
 
of
 
17
 
CFR
 
§
240.18a-5(b)(8).
6.
 
Similarly,
 
UBS
 
ESE
 
FR
 
will
 
ensure
 
that
 
its
 
disclosures
 
are
 
compliant
 
with
 
the
 
data
 
protection
principles set out in Article 5 of the EU GDPR and the French DPA
38
.
 
7.
 
All terms
 
of business
 
entered into
 
by UBS
 
AG, London
 
Branch with
 
its clients
 
that are
 
US Person
counterparties
 
conducting
 
SBS
 
Transactions
 
contain
 
clear
 
statements
 
such
 
that
 
counterparties
 
are
aware
 
that
 
that
 
their
 
data
 
may
 
be
 
shared
 
with
 
UBS
 
group
 
affiliates
 
for
 
the
 
purposes
 
of
 
client
management
 
and
 
that
 
regulatory
 
oversight
 
will
 
be
 
exercised
 
by
 
regulatory
 
authorities
 
and
 
that
information regarding their transactions, including their personal data, can
 
be disclosed to regulatory
authorities
 
(for
 
example,
 
clause
 
10
 
of
 
the
 
terms
 
of
 
business
 
for
 
professional
 
clients
 
and
 
eligible
counterparties (March 2019)
39
).
8.
 
UBS AG
 
and UBS
 
ESE FR do
 
not include
 
the information
 
described in 17
 
C.F.R. §§.18a-5(b)(8)(i)(A)
through
 
(H)
 
or
 
240.18a-5(a)(10)(i)(A)
 
through
 
(H),
 
as
 
the
 
case
 
may
 
be,
 
in
 
questionnaires
 
or
applications for employment executed by an associated person who is not a US Person (as defined in
17
 
C.F.R.
 
§240.3a71-3(a)(4)(i)(A)),
 
unless
 
UBS
 
AG
 
or
 
UBS
 
ESE
 
FR
 
are
 
required
 
to
 
obtain
 
such
information under
 
applicable law
 
in
 
the jurisdiction
 
in which
 
the associated
 
person is
 
employed or
located or obtains such information in conducting a background check that is customary
 
for UBS AG
or
 
UBS
 
ESE
 
FR
 
in
 
that
 
jurisdiction
 
and
 
the
 
creation
 
or
 
maintenance
 
of
 
records
 
reflecting
 
that
information would not
 
result in a
 
violation of applicable
 
law in the
 
jurisdiction in which
 
the associated
person is employed or located.
37
 
 
We do not give any views regarding this assumption.
 
 
38
 
 
These principles are set out in
 
at section 1.
39
 
 
Available at:
 
https://www.ubs.com/global/en/investment-
bank/regulatory/_jcr_content/mainpar/toplevelgrid/col1/linklist_1815406319/link.1894740908.file/PS9jb250ZW50L2RhbS9JbnZlc3RtZ
W50QmFuay9kb2N1bWVudHMvaWJ0ZXJtcy90ZXJtcy1vZi1idXNpbmVzcy5wZ%20GY=/terms-of-business.pdf
.
 
 
18
 
9.
 
The SEC will,
 
as a matter
 
of practice, restrict
 
its information requests
 
to UBS AG,
 
London Branch for,
and use of, any information pursuant to its access to
 
UBS AG, London Branch’s Covered Books and
Records and
 
On-Site Inspections of
 
UBS AG, London
 
Branch to
 
only the
 
information that the
 
SEC
requires for the
 
legitimate and specific
 
purpose of fulfilling
 
its regulatory mandate
 
and responsibilities
by evaluating compliance with legal obligations designed to ensure the proper
 
legal administration of
SEC-regulated firms
 
(which includes
 
regulating, administering, supervising,
 
enforcing and
 
securing
compliance with the securities or derivatives laws in its jurisdiction).
10.
 
Information, data
 
and documents
 
received by
 
the SEC
 
are,
 
as a
 
matter of
 
practice, maintained
 
in
 
a
secure manner
 
and, under
 
strict US
 
laws of
 
confidentiality,
 
information about individuals
 
cannot be
onward
 
shared
 
save
 
for
 
certain
 
uses
 
publicly
 
disclosed
 
by
 
the
 
SEC,
 
including
 
in
 
an
 
enforcement
proceeding, pursuant
 
to a
 
valid and
 
non-exempt US
 
Freedom of
 
Information Act
 
(
FOIA
) request,
40
 
pursuant to a lawful request of the US Congress or a
 
properly issued subpoena, or to other regulators
who have demonstrated a need for the information and provide assurances
 
of confidentiality.
40
 
 
We
 
do not
 
give any
 
views in
 
the opinion
 
to matters
 
of US
 
law,
 
though we
 
understand that
 
information can
 
be
made public
 
pursuant to
requests under
 
the US
 
FOIA,
 
and that
 
certain information
 
is exempt
 
from such
 
requests, including
 
(among others):
 
(1) a
 
trade secret
 
or
privileged or confidential commercial or financial information
 
obtained from a person; (2) a
 
personnel, medical, or similar file the
 
release
of which would constitute a clearly unwarranted invasion of personal privacy; (3) information compiled for law enforcement purposes, the
release of which (a) could reasonably be expected to interfere with law enforcement proceedings;
 
(b) would deprive a person of a right to a
fair trial or an impartial adjudication; (c) could reasonably be expected to constitute an unwarranted
 
invasion of personal privacy; (d) could
reasonably
 
be
 
expected
 
to
 
disclose
 
the
 
identity
 
of
 
a
 
confidential
 
source;
 
(e)
 
would
 
disclose
 
techniques,
 
procedures,
 
or
 
guidelines
 
for
investigations or prosecutions;
 
or (f) could
 
reasonably be expected
 
to endanger an
 
individual's life or
 
physical safety; (4)
 
contained in or
related to examination, operating, or condition reports about financial
 
institutions that the SEC regulates or supervises.