1
UBS AG London Branch
5 Broadgate
London
EC2M 2QS
Allen & Overy LLP
Bockenheimer Landstraße 2
60306 Frankfurt am Main Germany
Our ref
0036335
-
0000808
22 October 2021
Dear Sir or Madam
UBS SEC registration as a non-resident security-based swap dealer
1.
BACKGROUND
1.1
We understand that UBS AG, a bank authorised in Switzerland, is seeking to register with the United
States (
US
) Securities and Exchange Commission (
SEC
) as a non-resident security-based swap (
SBS
)
dealer (
SBSD
).
1.2
To register as an SBSD with the SEC, a non-resident SBSD
1
of counsel to Form SBSE, SBSE-A or SBSE-BD affirming that the SBSD can, as a matter of law:
(a)
provide the SEC with prompt access to the relevant books and records as defined in
paragraphs
Covered Books and Records
); and
(b)
submit to on-site inspection and examination of its Covered Books and Records by the SEC
(
On-Site Inspection
).
1.3
Associated persons of UBS AG located in Germany who effect SBS transactions on behalf of UBS
AG will be employed by UBS Europe SE (
UBS ESE
), which is incorporated in Germany and
authorised to provide services in Germany (among other jurisdictions). Accordingly, UBS ESE will
maintain certain Covered Books and Records in Germany on behalf of UBS AG.
1.4
You have asked us to issue an opinion affirming that (a) UBS AG will be able to provide the SEC with
prompt access to its Covered Books and Records that are maintained by UBS ESE in Germany and
(b) UBS ESE can submit to On-Site Inspection by the SEC of UBS AG’s Covered Books and Records
it maintains on behalf of UBS AG, in each case accordance with paragraph
2
1
In the case of a corporation, an SBSD will be “non
-
resident” if it is incorporated
in or has its principal place of business in any place not in the
United States (see 17 Code of Federal Regulations (
CFR
) § 240.15Fb2-4(a)(2)). As UBS AG is incorporated in Switzerland, UBS AG fulfils this
definition of a “non-resident” SBSD.
2
In accord
ance with Assumption
, this opinion does not cover the direct provision of Covered Books and Records by UBS ESE to
the SEC as this information will instead be provided to UBS AG London Branch and sent by UBS AG London Branch to the SEC.
Allen & Overy LLP is a limited liability partnership registered in England and Wales with registered number OC306763. It is authorised and regulated by the Solicitors Regulation
Authority of England and Wales. The term partner is used to refer to a member of Allen & Overy LLP or an employee or consultant with equivalent standing and qualifications. A list
of the members of Allen & Overy LLP and of the non-members who are designated as partners is open to inspection at its registered office, One Bishops Square, London E1 6AD.
Allen & Overy LLP or an affiliated undertaking has an office in each of: Abu Dhabi, Amsterdam, Antwerp, Bangkok, Beijing, Belfast, Bratislava, Brussels, Budapest, Casablanca, Dubai,
Düsseldorf, Frankfurt, Hamburg, Hanoi, Ho Chi Minh City, Hong Kong, Istanbul, Jakarta (associated office), Johannesburg, London, Los Angeles, Luxembourg, Madrid, Milan, Moscow,
Munich, New York, Paris, Perth, Prague, Rome, São Paulo, Seoul, Shanghai, Silicon Valley, Singapore, Sydney, Tokyo, Warsaw, Washington, D.C. and Yangon.
2
Düsseldorf
Dreischeibenhaus 1
40211 Düsseldorf
Tel +49 (0)211 2806 7000
Fax +49 (0)211 2806 7800
Ellen Birkemeyer
Dr. Hans Diekmann
Dr. Christian Eichner
Dr. Jens Matthes
Dr. Stephan Neuhaus
Dr. Jan Schröder
Counsel
Kyrill Chilevych
Dr. Michael Fink
Anne Fischer
Dr. Achim Schmid
Frankfurt
Haus am OpernTurm
Bockenheimer Landstraße 2
60306 Frankfurt am Main
Tel +49 (0)69 2648 5000
Fax +49 (0)69 2648 5800
Dr. Alexander Behrens
Dr. Wolf R. Bussian
John Coburn
Dr. Michael H. Ehret
Dr. Stefan Henkelmann
Dr. Franz Bernhard Herding
Dr. Matthias Horn
Dr. Michiel Huizinga
Dr. Hartmut Krause
Dr. Hans-Peter Löw
Anna Masser
Dr. Olaf Meisen
Wolfgang Melzer
Thomas Neubaum
Dr. Udo H. Olgemöller
Marc O. Plepelits
Dr. Sven Prüfer
Dr. Knut Sauer
Martin Scharnke
Dr. Jochen Scheel
Thomas Ubber
Dr. Heike Weber
Dr. Michael Weiß
Jan Erik Windthorst
Dr. Marc Zimmerling
Senior Counsel
Peter H. Hoegen
Counsel
Boris Alexander Blunck
Dr. Jan-Hendrik Bode
Lennart Dahmen
Matthias Fischer
Dr. Mark Hallett
Woldemar Häring
Dr. Roman A. Kasten
Christian Klöpfer
Stefan Kuhm
Dr. Tim Nikolas Müller
Jens Nollmann
Dr. David T. Schmid
Dr. Esther Schmidt-Naumann
Dr. Sebastian Schulz
Tim Spranger
Dr. Katharina Stüber
Dr. Andre P. H. Wandt
Peter Wehner
Alexander Wüpper
Of Counsel
Stephan Funck
Frank Herring
Hamburg
Hanseatic Trade Center
Kehrwieder 12
20457 Hamburg
Tel +49 (0)40 82221 20
Fax +49 (0)40 82221 2200
Dr. Börries Ahrens
Dr. Nicolaus Ascherfeld
Markulf Behrendt
Dr. Ellen Braun
Dr. Christian Hilmes
Dr. Nils Koffka
Max Landshut
Dr. Helge Schäfer
Dr. Hans Schoneweg
Counsel
Marie-Luise von Buchwaldt
Dr. René Galle
Dr. Rüdiger Klüber
Dr. Jonas Wittgens
München
Maximilianstraße 35
80539 München
Tel +49 (0)89 71043 3000
Fax +49 (0)89 71043 3800
Dr. Gottfried E. Breuninger
Dr. Jan Ebersohl
Dr. Joachim Feldges
Dr. Astrid Krüger
Dr. Magnus Müller
Dr. Hendrik Röhricht
Dr. Walter Uebelhoer
Dr. Alexander Veith
Counsel
Dr. Ilja Baudisch
Dr. Alice Broichmann
Christina Habermayr
Dr. Dirk Schade
Dr. Bettina Scharff
Dr. Jens Wagner
Eda Zhuleku
0036335-0000808 UKO1: 2005527215.20
3
1.5
This opinion is structured as follows:
(a)
Section
:
(b)
Section
:
;
(c)
Section
:
(d)
Section
:
(e)
: Opinion; and
(f)
: Assumptions.
1.6
For the purposes of this opinion, the legal or natural person imparting the information subject to the
duty of confidentiality will be the
Rights Holder
and the person receiving that information, in this
case UBS ESE, will be the
Recipient.
2.
SUMMARY OF OPINION
Subject to the assumptions and qualifications below, it is our opinion that:
2.1
UBS ESE can, as matter of applicable German law, submit to On-Site Inspection by the SEC. There
is no restriction or general blocking statute on UBS ESE submitting to On-Site Inspection by the SEC.
The remainder of this opinion focuses on UBS ESE’s ability to disclose information contained in
Covered Books and Records to the SEC in the course of On-Site Inspection in Germany and the ability
to provide UBS AG London Branch with prompt access to Covered Books and Records.
2.2
UBS ESE can, as a matter of applicable German law, provide the SEC with prompt access to Covered
Books and Records held by UBS ESE in Germany either by disclosure of Covered Books and Records
to UBS AG London Branch for the purpose of providing information to the SEC or to the SEC in the
course of On-Site Inspections in Germany.
3
Data Protection
4
2.3
Disclosures of personal data (particularly special categories of data or criminal data) relating to UBS
ESE’s clients and staff are subject to certain restrictions under the Data Protection Laws, particularly
where this involves a cross-border transfer to a country or territory the European Commission has not
found to have an ‘adequate’ data protection regime.
5
disclosures, and derogations from the prohibition on international transfers, that would be available to
UBS ESE were it to be required by the SEC to make available personal data either by disclosure of
Covered Books and Records to UBS AG London Branch for the purpose of providing information to
the SEC or to the SEC in the course of On-Site Inspections in Germany. We note that these legal
restrictions and derogations that UBS ESE would rely on when making disclosures to the SEC are the
same legal requirements as referred to and reflected in the “Memorandum of Understanding
concerning consultation, cooperation and the exchange of information related to the supervision and
oversight of certain cross-border over-the-counter derivatives entities in connection with the use of
substituted compliance by such entities” entered into between the SEC and the German Federal
Financial Supervisory Authority (
Bundesanstalt für Finanzdienstleistungsaufsicht
–
BaFin
) (the
3
Where a restriction on the ability to
grant access to,
transfer
or other disclose
personal data or to disclose confidential information applies, consent
from the Rights Holder, validly given in accordance with the relevant standard for consent under each applicable legal obligation, would allow
for such information to be lawfully transferred to the SEC or disclosed to the SEC during On-Site Inspection. Please note that valid consent is
assumed in Assumption
4
Please refer to section
5
According to Article
44 of the EU GDPR, any transfer of personal data to third countries or international organizations must, in addition to
complying with Chapter V of the EU GDPR, also meet the conditions of the other provisions of the EU GDPR.
0036335-0000808 UKO1: 2005527215.20
4
BaFin MoU
).
6
European Central Bank (
ECB
)
7
ECB MoU
).
8
2.4
We anticipate that the legitimate interests legal basis for processing would provide an applicable
grounds under the EU GDPR to enable disclosure of Covered Books and Records to UBS AG London
Branch for the purpose of providing information to the SEC and to permit On-Site Inspection.
Banking Secrecy Principle
2.5
The German banking secrecy principle (the
German Banking Secrecy Principle
) applies in respect
of all business and private information on the client obtained by a bank on the basis or within the
context of its client business pursuant to a contractual relationship with the client. In Germany, the
banking secrecy principle is primarily a matter of contract law. Against this background, the German
Banking Secrecy Principle does not differentiate between (i) customer data; and (ii) data of natural
persons or legal entities, provided that the data are obtained on the basis or within the context of a
customer business pursuant to a contractual relationship with a client governed by German law.
2.6
UBS ESE may share information contained in the Covered Books and Records or obtained by the SEC
through On-Site Inspections either (i) where they are not in the scope of application of the German
Banking Secrecy Principle or (ii) where the sharing is legally justified as it is either required by law
or the relevant clients have consented to the disclosure. A client’s consent can be expressed implicitly.
2.7
German laws and orders of German authorities clearly justify a sharing of information covered by the
German Banking Secrecy Principle. There is, however, no case law or administrative practice or clear
legal literature as regards the “conflict” between foreign statutes and foreign orders on the one hand
and the German Banking Secrecy Principle on the other hand. Hence, the legal situation is unclear.
That said, in our view there are good reasons to believe that data sharing can be justified in relation to
the German Banking Secrecy Principle by either (i) implied consent or (ii) a combination of the US
statutes / the SEC orders in combination with the BaFin MoU / ECB MoU.
Principle of territoriality
2.8
According to the general territorial principle of international law, a state that wishes to take action
outside its sovereign borders is, as a general rule, referred to private law, because the territorial
principle of international law limits the validity of its sovereign acts to its national territory. In this
respect, the SEC is in principle not authorized to take sovereign action, including On-Site Inspection
of and obtaining access to Covered Books and Records, in Germany. However, such a permission can
be found in the BaFin MoU between BaFin and SEC and also in the ECB MoU between ECB and
SEC.
9
actions to be taken without a breach of the general principle of territoriality.
Privacy and Human Rights
2.9
Protection for the general fundamental right to “
respect for private and family life, home and
correspondence
” is enshrined in Article 8 of the European Convention on Human Rights (
ECHR
).
This right is directly applicable in Germany. Actions in respect of Article 8 ECHR require a separate
cause of action, such as an action arising from a wrongful act or other legal obligation, such as under
the Data Protection Laws. However, we note that the ECHR only confers rights on private law subjects
6
Available at
https://www.sec.gov/files/15122020-substituted-compliance-mou-germany-final-signatures.pdf.
7
As UBS ESE qualifies as
a “significant institution
” within the meaning of
Art.
6(4) of the Regulation der (EU) No. 1024/2013 (the
Single
Supervisory Mechanism Regulation
), it is, as regards prudential supervision, also subject to direct supervision by the ECB.
8
The Memorandum of Understanding between the United States
Securities and Exchange Commission and the European Central Bank concerning
consultation, cooperation and the exchange of information related to the supervision and oversight of certain cross-border over-the-counter
derivatives entities in connection with
the use of substituted compliance by such entities dated 16 August 2021 (available at
https://www.bankingsupervision.europa.eu/legalframework/mous/html/ssm.mou_2021_sec~220403db9b.en.pdf
).
9
Article II paragraph 25
et seq
. of the ECB MoU and Article II paragraph 26
et seq.
of the BaFin MoU.
0036335-0000808 UKO1: 2005527215.20
5
vis-à-vis the state and not among themselves. Consequently, the ECHR is not directly applicable to
UBS ESE.
2.10
Article 8 ECHR is, as it were, the legal foundation on which the GDPR has been based. The GDPR is
detailing the fundamental right laid down in Article 8 ECHR. Thus, Article 8 ECHR and the GDPR
are intertwined with each other. As long as the provision of information to the SEC by UBS ESE falls
entirely within the scope of and is in compliance with the Data Protection Laws, we consider the
general fundamental right set out in Article 8 ECHR will be protected.
This summary opinion is not a substitute for the full expression of our views set out in
3.
SCOPE, ASSUMPTIONS AND QUALIFICATIONS
3.1
This opinion relates solely to access provided to the SEC by UBS AG, through its London Branch, of
Covered Books and Records held on its behalf by UBS ESE in Germany and On-Site Inspection of
UBS ESE by the SEC in Germany. This opinion applies equally to remote access from the United
States to Covered Books and Records held in the Federal Republic of Germany. This opinion excludes
books and records held in the US.
3.2
This opinion has been prepared in accordance with UBS AG’s specific instructions as to the scope of
the opinion. For this purpose you have issued us with guidance from a third party US law firm which
we have used to inform the scope of our opinion.
3.3
This opinion covers data relating to:
(a)
SBS transactions concluded between UBS AG (through its associated persons employed by
UBS ESE) and US Person counterparties, insofar as this data is held on behalf of UBS AG by
UBS ESE (e.g. voice recordings and client communications) (these transactions will be
concluded by staff of UBS ESE acting in the name and for the account of UBS AG London
Branch and so some data relating to such transactions will be held by UBS AG London Branch
in the United Kingdom (
UK
) – access to Covered Books and Records and On-Site Inspections
by the SEC of data that is held in the UK is not within scope of this opinion); and
(b)
the activities of the staff of UBS ESE pertaining to UBS AG’s SBS transactions that are also
arranged, negotiated, or executed by personnel of UBS AG located in a US branch or office
or by personnel of an agent of UBS AG located in a US branch or office (irrespective of
whether UBS AG’s counterparty is a US Person or a non-US Person).
This opinion only covers transactions entered into by UBS AG where UBS ESE is acting on behalf of
UBS AG. This opinion does not cover data relating to SBS transactions concluded between UBS ESE
and its own counterparties (even though UBS ESE may be relying on the counting exemption set out
in 17 CFR § 240.3a71-3(d) for such transactions, we are instructed that this data is not relevant for the
purposes of 17 CFR § 240.15Fb2-4(c) and so this data is not within scope of this opinion.
0036335-0000808 UKO1: 2005527215.20
6
3.4
This opinion only covers access to and the On-site Inspection of Covered Books and Records. Covered
Books and Records include only those books and records which:
(a)
relate to the US business
10
11
SBS that is either:
(i)
entered into, or offered to be entered into, by or on behalf of the non-resident SBSD,
with a “U.S. Person” as defined in 17 CFR § 240.3a71-3(a)(4)
12
US Person
) (other
than an SBS conducted through a foreign branch of such US Person
13
); or
(ii)
arranged, negotiated, or executed by personnel of the non-resident SBSD located in a
branch in the United States (
US branch
) or office or by personnel of an agent of the
non-resident SBSD located in a US branch or office;
14
(b)
constitute financial records necessary for the SEC to assess the non-resident SBSD’s
compliance with the SEC’s margin and capital requirements, if applicable.
15
3.5
Further to Assumption
, this opinion is limited to those types of records that are relevant to
prudentially regulated SBSDs, which excludes financial records as noted in paragraph
.
For this opinion, the term “Covered Books and Records” extends to these record types alone.
3.6
The issues addressed in this opinion apply equally across the different document types which constitute
the Covered Books and Records based upon the information actually contained in each of the relevant
Covered Books and Records. We have not examined any such documents or records.
3.7
In giving this opinion, we have made the further assumptions set out in
.
3.8
No opinion is expressed on matters of fact.
3.9
As a practical matter, it may be particularly difficult to establish that consent is freely given where
information relates to UBS ESE staff because consent is very difficult to rely on in an employment
context, due to the inherent imbalance of power between an employer and its staff (for example, staff
may believe there could be negative consequences should they refuse to give consent). Further,
consent will only be valid if UBS ESE offers its staff a genuine choice over how the data is used and
will only continue to be an appropriate legal basis if UBS ESE also offers its staff the opportunity to
withdraw consent at any time. Where consent is relied upon in this opinion, it is on the basis that this
practical matter has been overcome. Where consent is not available as a legal basis for disclosure
(including where valid consent cannot be obtained), UBS ESE may be able to rely on an alternative
basis for disclosure (e.g. the legitimate interest basis or another exception for international transfer of
personal data).
10
As defined in 17 CFR §240.3a71
-
3
(a)(8).
11
Cross
-
Border Application of Certain [SBS] Requirements, 85 Fed.
Reg. 6270, 6296 (Feb. 4, 2020) (the
SEC Guidance
).
12
A “U.S. person” means any person that is “(i) a natural person resident in the U.S.; (ii) a partnership, corporation, trust,
i
nvestment vehicle, or
other legal person organized, incorporated, or established under the laws of the United States or having its principal place of business in the
United States; (iii) an account (whether discretionary or non-discretionary) of a U.S. person; or (iv) an estate of a decedent who was a resident
of the United States at the time of death.” 17 CFR § 240.3a71-3(a)(4).
13
A “foreign branch” means “any branch of a U.S. bank if: (i) the branch is located outside of the United States; (ii) the bran
c
h operates for valid
business reasons; and (iii) the branch is engaged in the business of banking and is subject to substantive banking regulation in the jurisdiction
where located.” (17 CFR § 240.3a71-3(a)(2)). An “SBS conducted through a foreign branch” means an SBS that is “arranged, negotiated, and
executed by a U.S. person through a foreign branch of such U.S. person if: (A) the foreign branch is the counterparty to such security-based swap
transaction; and (B) the security-based swap transaction is arranged, negotiated, and executed on behalf of the foreign branch solely by persons
located outside the United States.” (17 CFR § 240.3a71-3(a)(3)(i)).
14
17 CFR
§
240.3a71
-
3(a)(8)(i)(B).
15
The requirement set out in this paragraph
as it is assumed that UBS AG has a prudential regulator – please see Assumptions
0036335-0000808 UKO1: 2005527215.20
7
4.
REVISIONS TO APPLICABLE LAW
4.1
We note that the SEC rules
16
changes in the legal or regulatory framework that would:
(a)
impact the ability of the SBSD to provide prompt access to its Covered Books and Records;
(b)
impact the manner in which it would provide prompt access to its Covered Books and Records;
or
(c)
impact the ability of the SEC to conduct On-Site Inspections.
4.2
Upon a change in law or regulatory framework of the sort outlined in paragraph
is required to submit a revised opinion describing how, as a matter of law, the SBSD will continue to
meet its obligations.
4.3
This opinion relates solely to the laws of the Federal Republic of Germany and European Union (
EU
)
law that is directly applicable in Germany (i.e. regulations pursuant to Art. 288(2) of the Treaty on the
Functioning of the European Union), in each case, in force as at the date of this opinion. We have no
obligation to notify any addressee of any change in any applicable law or its application after the date
of this opinion.
5.
RELIANCE AND CONFIDENTIALITY
5.1
This opinion is given for the sole benefit of the addressee. It may not be relied upon by anyone else
without our prior written consent.
5.2
This opinion is not to be disclosed to any person outside of UBS AG’s group or used, circulated,
quoted or otherwise referred to for any other purpose. However, we agree that a copy of this opinion
letter may be disclosed:
(a)
where disclosure is required or requested by any governmental, banking, taxation or other
regulatory authority or similar body having jurisdiction over UBS AG (including to the SEC
as part of UBS AG’s SBSD registration application) or by the rules of any relevant stock
exchange or pursuant to any applicable law or regulation; and
(b)
to UBS AG’s affiliates, and any of their officers, directors, employees, auditors, insurers,
reinsurers, insurance brokers and professional advisors (in their capacity as such).
5.3
Any such disclosure must be made on the basis that it is for information purposes only, no recipient
may rely on this advice, no client-lawyer relationship between us and the recipient arises following,
or as a result of, any such disclosure. We assume no duty or liability to any recipient, and any recipient
under paragraph
5.4
We assume no obligation to advise you or any other person or to make any investigations as to any
legal developments or factual matters arising subsequent to the date hereof that might affect the
opinions expressed herein.
16
17 CFR § 240
.15Fb2
-
4(c)(2).
0036335-0000808 UKO1: 2005527215.20
8
Yours faithfully,
Allen & Overy LLP
0036335-0000808 UKO1: 2005527215.20
9
ANNEX 1
OPINION
1.
DATA PROTECTION
1.1
The General Data Protection Regulation 2016/679 (
EU GDPR
), and the German Federal Data
Protection Act (
Bundesdatenschutzgesetz
BDSG
) (together, the
Data Protection Laws
) will apply
to UBS ESE’s disclosure of Covered Books and Records to UBS AG London Branch for the purpose
of providing information to the SEC and to the SEC in the course of On-Site Inspections, to the extent
that these comprise or contain personal data. Personal data is data relating to an identified or
identifiable living individual, so may extend to information on UBS ESE staff as well as clients.
1.2
Under the Data Protection Laws, specific additional restrictions apply for personal data relating to
criminal convictions and offences.
17
of ‘special category personal data’ – this is personal data that reveals racial or ethnic background,
political opinions, religious or philosophical beliefs, or trade union membership, genetic data,
biometric data when used for ID purposes, health information, data concerning sex life or sexual
orientation
18
. As special category personal data are less likely to be relevant in the context of UBS
ESE’s disclosures to the SEC, the laws applicable to this data have not been considered in detail in
this opinion.
1.3
Key restrictions in the Data Protection Laws relating to UBS ESE’s ability to disclose personal data
to the SEC are set out below.
Legal basis for the disclosure
1.4
UBS ESE requires a legal basis under Article 6 of the EU GDPR to disclose personal data to the SEC
in the course of On-Site Inspections and to provide UBS AG London Branch with access to its Covered
Books and Records for the purpose of providing information to the SEC. Personal data cannot be
disclosed if doing so would breach another legal requirement (e.g. banking secrecy – please see section
). Whilst there are a number of Article 6 legal bases on which UBS ESE may seek to rely,
none of its own is so comprehensive as to cover all disclosures of personal data to the SEC, so UBS
ESE will need to consider the most appropriate legal basis to apply to any given situation on a case-
by-case basis.
1.5
The Article 6 legal bases most applicable to UBS ESE, together with their respective limitations, are
as follows:
(a)
Consent (Article 6(1)(a) EU GDPR)
: In order for consent to be valid under the Data Protection
Laws, it must satisfy the high standard of being a freely-given, specific, informed and
unambiguous indication of wishes.
19
(b)
Legitimate interests (Article 6(1)(f) EU GDPR)
: This is one of the most flexible legal bases
for processing that can apply to a multitude of business purposes, including with respect to
ensuring compliance with regulatory obligations. To rely on the legitimate interests ground,
UBS ESE must:
17
Article
10 of the EU GDPR.
18
Article
9(1) of the EU GDPR.
19
Please also refer to limitations on the applicability of consent discussed in paragraph
:
note that German data protection authorities are in practice particularly strict in relation to accepting employee consent as freely given and that
under Section 26(2) of the BDSG, the employee’s level of dependence in the employment relationship and the circumstances under which consent
was given must be taken into account in assessing whether such consent was freely given. That said, it may prove almost impossible in practice
to obtain valid employee consent from UBS ESE’s staff for the purpose of disclosing their personal data to a non-EU based authority. Consent
might therefore not generally be considered as a valid legal basis for disclosure of UBS ESE’s staff data and UBS ESE should rely on an
alternative basis for disclosure (e.g. the legitimate interests). Please note that valid consent is assumed in Assumption
0036335-0000808 UKO1: 2005527215.20
10
(i)
identify its, or a third party’s legitimate interest (this can include commercial interests,
individual interests or broader societal benefits) in complying with the SEC’s
disclosure request;
(ii)
show that the disclosure of documents to the SEC is necessary for achieving these
interests; and
(iii)
balance these interests against the competing interests, rights and freedoms of the
individuals concerned, and satisfy itself that those interests do not outweigh its own.
If individuals would not reasonably expect the disclosure, or if the disclosure would
cause unjustified harm to the individuals, the interests of those individuals would
likely override the interests of UBS ESE or the third party.
An individual has the right to object to the disclosure of their personal data to the SEC under
this basis for processing, and UBS ESE would need to demonstrate ‘compelling’ legitimate
grounds to process the data that override the rights, freedoms and interests of that individual.
The balancing of legitimate interests against the competing interests, rights and freedoms of
the individuals concerned should be made on a case-by-case basis and should consider all
available facts. In particular, Recital 47 of the GDPR states that, when balancing their interests
against those of the
individuals concerned, controllers should take into account
“
the
reasonable expectations of data subjects based on their relationship with the controller
”. With
this in mind, UBS ESE may argue that its interests are not outweighed by those of its clients
or its employees on the basis that:
(i)
clients are aware, due to statements contained in their terms of business with UBS
AG, the US nexus when they engage in SBS transactions and, their understanding as
sophisticated investors, that regulatory oversight will be exercised by the SEC, which
may entail certain information regarding their transactions, including in some cases
their personal data, to be disclosed to the SEC; and
(ii)
the employees whose personal data may be disclosed to the SEC understand their role
will involve SEC oversight due to their being classified as ‘associated persons’ for the
purposes of SBS transactions and understand that, as a result, certain of their personal
data may be disclosed to the SEC. More specifically, each associated person is
required to complete an ‘SBS associated person questionnaire’, which provides
advance notice that their activities may involve the disclosure of their personal data
to the SEC and potentially require them to undertake interviews with the SEC. Each
employee that is an associated person is also required to agree or acknowledge their
understanding that their data may be provided to the SEC in connection with the
SEC’s oversight of SBS transactions.
In addition, while focused on the relationship between the SEC and BaFin, the existence of
the BaFin MoU arguably reflects an acceptance in Germany that the SEC has a duty to regulate
SBS markets and may need to access information maintained by financial institutions located
in Germany for this purpose. This argument is further supported by the ECB MoU, which
similarly reflects an understanding of the SEC’s duties and an acceptance regarding the need
for information, including personal data, to be provided to the SEC.
20
Also relevant to this balancing of interests are that the SEC will:
20
For the avoidance of doubt, we note however that neither the BaFin MoU nor the ECB MoU stipulates any exemptions from the com
pliance with
applicable data protection rules under the GDPR, including from the international transfer rules.
0036335-0000808 UKO1: 2005527215.20
11
(i)
restrict its information requests for, and use of, any information to only the
information that it requires for the legitimate and specific purpose of fulfilling its
regulatory mandate and responsibilities and to prevent and/or enforce against potential
illegal behaviour, with the type and amount of personal data requested being targeted
based on risk and related to specific clients and accounts, and employees;
21
(ii)
information, data and documents received by the SEC are maintained in a secure
manner and only disclosed pursuant to strict US confidentiality laws.
22
(c)
Disclosure is necessary for compliance
with a legal obligation to which UBS ESE is subject
(Article 6(1)(c) EU GDPR)
: There must be a German or EU law nexus in order for UBS ESE
to be able to rely on this legal basis. Article 6(3) of the EU GDPR requires that the legal
obligation must be laid down by EU law or EU Member State law, to which the controller is
subject to, although this does not have to be an explicit statutory obligation, as long as the
application of the law is foreseeable to UBS ESE as the person subject to it.
23
In the context of this legal basis for processing, an SEC request in the absence of a German or
EU legal requirement (e.g. a lawful request from BaFin in the exercise of its powers) would
not justify the disclosure as being necessary for compliance with such an obligation.
We further note that neither the BaFin MoU nor the ECB MoU create any legally binding
obligations.
24
(d)
Disclosure is necessary for the performance of a task carried out in the public interest (Article
6(1)(e) EU GDPR)
: According to German data protection authorities’ and legal literature’s
interpretation of this legal basis, only entities who or are officially entrusted with performing
public tasks or are vested with public authority are able to rely on this legal basis.
25
it is not possible for UBS ESE to rely on this legal basis for the disclosure of personal data
contained in the Covered Books and Records from a German data protection law perspective.
(e)
Disclosure is necessary for the establishment, exercise or defence of legal claims unless the
data subject has an overriding interest in not having the data processed (Section 24(1) no.2
BDSG)
:
The effects of the disclosure on the data subject must be assessed on a case-by-case
basis, taking into account in particular if the disclosure of personal data is truly necessary or
if there are less intrusive ways to fulfil UBS ESE’s interest in the establishment, exercise or
defence of legal claims.
Based upon the above, the legitimate interests basis for processing is likely to be the most appropriate
Article 6 EU GDPR grounds on which UBS ESE could rely in relation to its disclosure of Covered
Books and Records to the SEC and to permit On-Site Inspection.
1.6
It is considered very unlikely that personal data included in Covered Books and Records or disclosed
to the SEC during On-Site Inspections will include special categories of personal data. Further, UBS
ESE might not hold all information described in 17 C.F.R. §§.18a-5(b)(8)(i)(A) through (H) or
240.18a-5(a)(10)(i)(A) through (H), as the case may be an associated person who is not a US Person.
26
However, to the extent that this does occur, and such information is held by UBS ESE, in addition to
an Article 6 EU GDPR legal basis, UBS ESE will need to establish an additional condition for
processing under Article 9 of the EU GDPR if it discloses special categories of personal data to the
21
Please refer to Assumptions
, as well as Article II paragraphs 44, 54 of the BaFin MoU and Article II paragraph 49 of the ECB
MoU.
22
Please refer to Assumption
, as well as paragraph 60 of the BaFin MoU and paragraph 56 of the ECB MoU.
23
Recital 41
E
U GDPR
.
24
Article II paragraph
28 of the BaFin MoU / Article II paragraph 27 of the ECB MoU.
25
See DSK short paper no.
4 (
Kurzpapier Nr. 4 Datenübermittlung in Drittländer
), available at
https://www.datenschutzkonferenz
-
online.de/media/kp/dsk_kpnr_4.pdf
26
As we understand is as defined in 17 C.F.R. §240.3a71
-
3(a)(4)(i)(A).
0036335-0000808 UKO1: 2005527215.20
12
SEC, such as where it is necessary for the establishment, exercise or defence of legal claims. Other
than valid consent,
27
special categories of personal data contained in the Covered Books and Records are:
(a)
processing is necessary for the establishment, exercise or defence of legal claims or whenever
courts are acting in their judicial capacity
Article 9(2)(f) EU GDPR and Section 24(1) no.
2
BDSG)
; and
(b)
processing is necessary for reasons of substantial interest, on the basis of domestic or Member
State
law
Article 9(2)(g) EU GDPR)
.
1.7
Although Sections 22 and 26(3) BDSG provides for additional legal bases for the processing of special
categories of personal data, none of these additional bases is likely to be available for disclosing special
categories of personal data to the SEC by UBS ESE, as these legal bases refer to the processing for
purposes of preventive medicine or where the processing is required under employment or social laws.
1.8
Similarly, UBS ESE’s processing of personal data relating to criminal convictions and offences or
related security measures is highly restricted, and can only be disclosed based on Article 6(1) EU
GDPR under the control of official authority or when the processing is authorised by EU or EU
Member State law providing for appropriate safeguards for the rights and freedoms of data subjects.
28
It is recognised by the legislative memorandum
29
Member State law that allows processing of criminal data without the control of official authority.
That is, to the extent that the disclosure of criminal data is
necessary for the performance of the
employment relationship
, Section 26 BDSG could allow on a case-by-case assessment the disclosure
of UBS ESE staff’s criminal data.
30
Data protection principles
1.9
In addition to establishing a legal basis for the disclosure, UBS ESE would need to ensure that its
disclosures are compliant with the remaining requirements under the Data Protection Laws, including
the data protection principles set out in Article 5 of the EU GDPR. For example, UBS ESE must:
(a)
be transparent with those whose personal data is to be disclosed to the SEC, who must be
provided with fair processing information (usually in the form of a privacy notice or
statement);
(b)
with respect to the data itself, ensure that it only provides personal data that is adequate,
relevant and limited to what is necessary in relation to the purposes of its regulatory activities;
(c)
be careful to avoid participating in ‘data dumps’ and should consider withholding documents,
anonymising personal data (or pseudonymising data where full anonymisation is not possible)
and redacting personal data from documents as appropriate;
(d)
ensure that the data is accurate and, where necessary, kept up to date;
(e)
keep the personal data in a form that enables identification of individuals for no longer than is
necessary for the purposes for which the personal data is processed; and
(f)
ensure that the confidentiality and integrity of personal data is maintained, and as such,
implement appropriate security measures (e.g. encryption) to protect the personal data.
27
Article 9(2)(a) EU GDPR
–
please also refer to l
imitations on the applicability of consent discussed in paragraph
:
28
Article
10 sent.
1 EU GDPR.
29
BT
-
Drs. 18/11325, p.
97.
30
W
e note, however, that in our experience German data protection authorities tend to apply the necessi
ty test rather strictly in the employment
context in practice.
0036335-0000808 UKO1: 2005527215.20
13
1.10
Whilst it is possible that the SEC has taken these principles into account in its request for access to the
Covered Books and Records, responsibility remains with UBS ESE to ensure that any disclosure of
personal data in the Covered Books and Records comply with all requirements under the Data
Protection Laws and to verify this and implement its own compliance measures.
International transfers
1.11
The general principle in the EU GDPR is that UBS ESE may not transfer personal data to a jurisdiction
outside the European Economic Area, unless it can satisfy a condition for the transfer as set out in
Chapter V of the EU GDPR.
1.12
Article 45 of the EU GDPR allows for UBS ESE to transfer personal data to a recipient outside the
EEA where the transfer is based on an adequacy decision of the European Commission. For the
purposes of providing Covered Books and Records to UBS AG London Branch, the adequacy decision
of the European Commission currently in effect in respect of the UK
31
data from the EEA, including Germany, to the UK to be made freely. Any transfer from UBS ESE to
UBS AG London Branch would therefore be permitted without limitation (provided that the disclosure
otherwise complied with the EU GDPR).
1.13
It should be noted that under Article 44 sent. 1, Recital 101 of the EU GDPR any onward transfer of
UBS ESE’s Covered Books and Records by UBS AG London Branch to the SEC is still subject to the
transfer requirements of the EU GDPR. In this regard it is helpful that the European Commission’s
adequacy decision for the UK addresses onward transfers from the UK and notes that the regime on
international transfers under the UK GDPR and UK DPA 2018 is “
in
substance identical
” to the
transfer regime under the EU GDPR.
32
pursuant to this EU GDPR restriction applicable to data originating from UBS ESE when disclosing
the UBS ESE’s Covered Books and Records to the SEC in the US are as follows:
(a)
Derogations (Article 49 EU GDPR)
: Where a transfer mechanism adopted by the European
Commission in respect of the US is not available (as is currently the case), derogations for
specific situations from the transfer prohibition are potentially available under EU GDPR for
facilitating UBS AG London Branch’s transfer of personal data contained in UBS ESE’s
Covered Books and Records to the SEC.
These derogations include:
(i)
Consent
: relying on consent to enable an international transfer requires that UBS ESE
has (A) explicitly stated to the Rights Holder that the data protection level at the
recipient is not comparable to the data protection level in Germany, noting that the
controller will not be able to ensure that an adequate level data protection level is
achieved by using a transfer mechanism available under the EU GDPR, with the result
that their personal data will not be subject to data protection that is equivalent to that
established under the EU GDPR, and (B) included in the consent form a description
of the data protection laws and practices in the recipient country (i.e. in this case, the
US), so that the data subject is in a position to make an informed decision
33
;
34
(ii)
legitimate interests:
place if (A) the transfer is not repetitive, (B) concerns only a limited number of data
subjects, (C) is necessary for the purposes of compelling legitimate interests pursued
31
Commission Implementing Decision
of 28.6.2021
pursuant to Regulation (EU) 2016/679 of the European Parliament and of the
Council
on the
adequate protection of personal data by the United Kingdom. Please note that in the future the adequacy decision may be withdrawn, not
prolonged or restricted and that the current adequacy decision is limited to four years.
32
Paragraph 2.5
.7, recitals
(74) and (75) of
the
Commission Implementing Decision
of 28.6.2021
pursuant to Regulation (EU) 2016/679 of the
European Parliament and of the Council on the adequate protection of personal data by the United Kingdom.
33
[
Local guidance – source to be added
]
34
Please note that valid consent is assumed in Assumption
0036335-0000808 UKO1: 2005527215.20
14
by UBS ESE, (D) UBS ESE’s legitimate interests are not overridden by the interests
or rights and freedoms of the Rights Holder, (E) UBS ESE has assessed all the
circumstances surrounding the data transfer and (F) UBS ESE has, on the basis of that
assessment, provided suitable safeguards with regard to the protection of personal
data. UBS ESE must inform the Data Protection Authority of the State of Hesse (being
UBS ESE’s supervisory authority for data protection) of the transfer. UBS ESE must,
in addition to providing the information referred to in Articles 13 and 14 EU GDPR,
inform the data subject of the transfer and of the compelling legitimate interests
pursued.
Each of the consent and legitimate interest derogations need to be applied on a case-by-case
basis.
35
We note that the derogation that the transfer is strictly necessary for important reasons of
public interest will likely not be applicable from a German data protection perspective.
(b)
BaFin route
: In certain situations, for example where UBS ESE considers the transfer of data
to UBS AG London Branch for the purpose of providing information to the SEC to be high
risk, it may be possible to arrange for the disclosure to be made to BaFin, which could then
transfer the data to the SEC in the US.
36
responsible for ensuring the international onward transfer was fully compliant with Article 44
sent. 1, Recital 101 of the EU GDPR.
1.14
Access to Covered Books and Records granted to the SEC in the course of On-Site Inspections would
not entail UBS ESE effecting an international transfer and so restrictions in Chapter V of the EU
GDPR would not apply to that situation.
2.
BANKING SECRECY PRINCIPLE (
BANKGEHEIMNIS
)
General considerations
2.1
Note that the banking secrecy principle is only relevant for UBS ESE where the contractual
relationships with the customers are governed by German law.
2.2
According to the German banking secrecy principle (the
German Banking Secrecy Principle
), a
credit institution, such as UBS ESE, is obliged to treat any client-related information as being
confidential and to disclose this information only on a need to know basis
by
applying strict
safeguarding measures. In Germany, the banking secrecy principle is primarily a matter of contract
law. It is not codified in the German civil code (
Bürgerliches Gesetzbuch
) or other laws. However,
according to the jurisprudence of the German Federal High Court (
Bundesgerichtshof
), the German
Banking Secrecy Principle constitutes an ancillary obligation of the banking contract between the bank
and its customer and forms therefore part of each contractual banking relationship between a German
bank and its customers governed by German law. In recognition of that fact, the duty to observe the
German Banking Secrecy Principle has been incorporated in No. 2(1) of the standard General Terms
and Conditions for Banks (
Allgemeine Geschäftsbedingungen
AGB-Banken
).
2.3
Against this background, the German Banking Secrecy Principle does not differentiate between
(i) customer data; and (ii) data of natural persons or legal entities, provided that the data are obtained
by UBS ESE on the basis or within the context of its customer business/contractual relationship.
2.4
Though, on the one hand, it is undisputed that each bank can generally modify the AGB-Banken for
their own purposes, it is on the other hand unclear to what extent the German Banking Secrecy
Principle can be waived by such modification. It can be expected that there is a customary law
35
Article 49(1) EU GDPR at sentence
1 paragraph (a) and sentence
2, respectively.
36
See
Article
48 EU GDPR.
0036335-0000808 UKO1: 2005527215.20
15
foundation (
Gewohnheitsrecht
) to the German Banking Secrecy Principle, according to which such
principle is such an essential part of the relationship between a bank and its client that it cannot be
carved out. For clarification purposes, we would therefore like to highlight that a mere deletion of
No. 2(1) AGB-Banken would not result in the German Banking Secrecy Principle being inapplicable.
Scope of protection under the German Banking Secrecy Principle
2.5
The German Banking Secrecy Principle applies in respect of all business and private information on
the client obtained by a bank on the basis or within the context of its client business/contractual
relationship, i.e. not only personal data. Furthermore, the German Banking Secrecy Principle applies
to all outward as well as inward processes of the bank. Hence, even inside the bank only those
individuals which have a legitimate interest may have access to the data subject to the German Banking
Secrecy Principle (“need to know” principle).
2.6
Anonymised data (i.e. data that has been amended in such a way that it is technically impossible to
trace it back to specific persons or is only possible with disproportionate effort) or redacted data are
not included in the scope of the German Banking Secrecy Principle and can be transferred to third
parties without further restrictions related to the bank secrecy.
2.7
Consequently, where Covered Books and Records do not contain any relevant forms of business and
private information on the client obtained by UBS ESE on the basis or within the context of its client
business/contractual relationship (e.g. transaction data such as volumes and prices) the German
Banking Secrecy Principle will not apply, and hence UBS ESE can share the information without
customer consent.
Sharing of information – general limitations on sharing of information within the scope of the German
Banking Secrecy Principle
2.8
As a general remark, it should be noted that there is neither case law nor legal literature discussing in
detail the limits of the German Banking Secrecy Principle if it comes to sharing information with US
authorities such as the SEC. This is probably mainly due to the fact that traditionally data protection
rules were stricter than the banking secrecy limits and that there are few instances where data sharing
results in damages to the customer which would justify a legal proceeding. Therefore, it seems very
difficult to precisely determine to what extent data may be shared with SEC for the purpose of the
registration as an SBSD in the US.
2.9
According to No. 2(1) of the AGB-Banken which incorporates the general principles developed on the
German Banking Secrecy Principle UBS ESE may share information falling within the scope of the
German Banking Secrecy Principle only if:
(a)
required by law,
(b)
the client has consented to the disclosure, or
(c)
the bank is authorised to provide a bank notification requested by another bank (
Bankauskunft
)
(cf. No. 2(1) sent. 1 AGB-Banken).
37
Sharing of information if “required by law” – assessment
2.10
Although information contained in the Covered Books and Records or obtained through On-Site
Inspections is covered by the German Banking Secrecy Principle, it may be shared if there is a legal
obligation/requirement to do so, i.e. where a law to which the bank is subject to requires that the
information shall be disclosed (
Legal Requirement
). Such Legal Requirements are included, inter
37
As the third option mentioned in the AGB
-
Banken, disclosing data
on the basis of a bank notification
, is not relevant in the case at hand, it is not
further discussed in this opinion.
0036335-0000808 UKO1: 2005527215.20
16
alia, in German tax, criminal law, AML and regulatory law provisions (c.f.
Kümpel/Mülbert/Früh/Seyfried, Bank- und Kapitalmarktrecht, No. 2 AGB-Banken: Bankgeheimnis
und Bankauskunft, Recital 3_254).
2.11
As far as it is based on Legal Requirements, a data-sharing request does not contradict the German
Banking Secrecy Principle. However, the question is whether these considerations can also be applied
in the case at hand where the information request is not
per se
law:
Sec 44(1) of the German Banking Act as Legal Requirement
2.12
Pursuant to Sec. 44(1) of the German Banking Act (
Kreditwesengesetz
–
KWG
), BaFin and the ECB
have the power to request from institutions information about all business activities, documentation
and, if necessary, copies, and also to perform on-site inspections. Consequently, the disclosure of
information based on this provision does not contradict the German Banking Secrecy Principle.
2.13
However, this specific power is only available to BaFin and the ECB to oblige UBS ESE to disclose
client-related information vis-à-vis BaFin and the ECB themselves. It is not clear whether this power
applies equally to investigations conducted by the ECB to support foreign regulators such as SEC
because
BaFin and
the
ECB
are
subject to professional secrecy requirements when sharing
information. In any event, Sec. 44(1) KWG would only allow measures undertaken by BaFin and the
ECB to support SEC, but by no means measures undertaken by SEC directly. As this opinion is
focussed on the latter, Sec. 44(1) KWG will not constitute a sufficient legal basis in the case at hand.
17 CFR 240.18a-6(g)
as Legal Requirement
2.14
Pursuant to 17 CFR 240.18a-6(g)a non-resident security-based swap dealer and non-resident major
security-based swap participant applying for registration must provide the SEC access to Books and
Records and must allow for On-Site Inspections. This might justify the sharing of information with
UBS AG London Branch for the purpose of providing information to the SEC or with the SEC in the
course of On-Site Inspections in Germany.
2.15
In general, only legal requirements to which UBS ESE is directly subjected may justify the disclosure
and sharing of client-related information with UBS AG London Branch for the purpose of providing
information to the SEC or with the SEC in the course of On-Site Inspections in Germany. UBS ESE
is primarily authorised and supervised in Germany and therefore subject to local rules. We are not
aware of any legal literature or case law dealing with the question of whether foreign statute may
justify the disclosure of information subjected to the German Banking Secrecy Principle. Therefore, it
is uncertain, whether such a US rule may justify the disclosure of client-related information.
Order of a court / administrative order as Legal Requirement
2.16
Legal literature considers an order of a foreign court to be sufficient to override the legal duties of the
German Banking Secrecy Principle. This should also apply to the disclosure of information in the
event of a request for information from a foreign authority, provided that this is enforceable in
Germany or where for example, the foreign authority has prosecutorial powers (c.f. Wech, das
Bankgeheimnis, p. 458; Canaris, Bankvertragsrecht, Recital 62).
0036335
-
0000808 UKO1: 2005527215.20
17
2.17
In the case of the SEC, SEC measures are generally not enforceable in Germany and the SEC does not
have prosecutorial powers in Germany. Therefore, as in the case of US law, it is unclear whether an
SEC order can justify sharing of data. However, in any event, to rely on this exception, UBS ESE
would need to balance its interests in complying with the SEC’s disclosure request against the German
Banking Secrecy Principle and UBS ESE must satisfy itself that the customer interests do not outweigh
its own; this needs to be assessed in practice on a case-by-case basis (c.f. Canaris, Bankvertragsrecht,
Recital 62).
BaFin
MoU as Legal Requirement
38
2.18
Pursuant to Article IV paragraph 44 of the BaFin MoU, the SEC is able do directly request Books and
Records when necessary to fulfil its regulatory mandate or to conduct On-Site Inspections. However,
in this regard we note the following: (i) The BaFin MoU is a public law arrangement. It is unclear
whether it can have an effect on the German Banking Secrecy Principle which is, as set out above,
rooted in civil law. (ii) More importantly, pursuant to Article II paragraph 28 of the BaFin MoU, the
BaFin MoU “
does not create any legally binding obligations, confer any rights or supersede domestic
laws, nor should it be construed as an agreement to limit the protection and safeguards provided by
the laws applicable to the authorities and does not confer upon any person the right or ability, directly
or indirectly, to obtain, suppress, or exclude any information or to challenge the exchange of
information under this MoU
”
.
Consequently, the BaFin MoU lacks the authority of statue.
2.19
Nevertheless, whilst the position is not free from doubt, in our view one could well argue that the
combination of the BaFin MoU, the US laws and the SEC orders justify the sharing of data from a
banking secrecy perspective.
2.20
Sharing of information in case of “consent” – assessment
2.21
In case there is no Legal Requirement on the basis of which client-related information sharing can be
justified, sharing of client data protected by the German Banking Secrecy Principle may only be based
on customer consent.
2.22
Customer consent exists in the form of implied or explicit consent: There are recognised circumstances
in which the sharing and disclosure of client-related data is in the interest of the relevant client. In such
cases, the German Banking Secrecy Principle shall not prevent the disclosure or sharing of client-
related data as the sharing of customer data is justified by implied consent (
konkludente Einwilligung
).
Otherwise, explicit consent would be required.
Explicit consent
2.23
Generally speaking, explicit consent can always justify information sharing. Such explicit consent
must be provided on a case-by-case basis for the duration of the contractual relationship. This means,
that a consent in form of a more general consent, i.e. consent allowing the transfer of information to
the US in any circumstance may not be sufficient. Please note that we have assumed at Assumption
of
Implied
consent (disclosure of information in the clients’ interest)
2.24
In an economy of scale with regard to the provision of services by UBS ESE and the receipt of services
by the customers, the sharing of information is a key requirement for the efficient running of a banking
business. The German Banking Secrecy Principle shall not compromise this (c.f. WM 2000, p. 503).
Therefore, it is recognised that the sharing of information can be justified by implied consent where
such sharing of information is, from a broader perspective, in the interest of the customers. This
requires, however, a balancing of interests.
38
The ECB MoU contains similar rules.
0036335-0000808 UKO1: 2005527215.20
18
2.25
As a consequence of the registration of UBS AG as a SBSD in the US, we understand that the customer
benefits by having access to a wider range of products. While not being a typical case of sharing of
information for an economy of scale, we nevertheless believe that one can well argue that such benefits
can form the basis of an implied consent.
2.26
However, as mentioned, to rely on this exception, UBS ESE must balance its interests in complying
with the SEC’s disclosure request against the principle of the German Banking Secrecy Principle and
UBS ESE must satisfy itself that those interests do not outweigh its own. While this would need to be
assessed on a case-by-case basis, it seems that, as a matter of principle, for those clients who personally
make use of the opportunities resulting from the access to SBS transactions, such benefits may
outweigh the data sharing.
Potential sanctions in case of a breach of the German Banking Secrecy Principle – Overview
2.27
A breach of banking secrecy has civil law consequences for UBS ESE. It entitles the customer to
terminate the contract with UBS ESE without notice (c.f. No. 18(2) AGB-Banken) as well as to claims
for damages, injunctive relief and claims for restitution or deletion of the data.
2.28
Note that a successful claim for breach of banking secrecy must demonstrate that there has been an
unauthorised use of confidential information to the detriment of the Rights Holder, i.e. the customer.
3.
PRINCIPLE OF TERRITORIALITY
3.1
According to the general territorial principle of international law, a state that wishes to take action
outside its sovereign borders is, as a general rule, referred to private law, because the territorial
principle of international law limits the validity of its sovereign acts to its national territory. In this
respect, the SEC is in principle not authorized to take sovereign action, including On-Site Inspection
and obtaining access to Covered Books and Records, in Germany. However, such a permission can be
found in an MoU between BaFin and the SEC. While this MoU is non-binding, in our view it should
allow those actions to be taken without a breach of the general territorial principle.
***
0036335-0000808 UKO1: 2005527215.20
19
ANNEX 2
ASSUMPTIONS
This opinion relies on the following assumptions:
1.
UBS AG has a “prudential regulator” as defined by Section 3 of the US Securities Exchange Act of
1934 (the
Securities Exchange Act
). As such, the Covered Books and Records considered in this
opinion are limited to what a prudentially regulated SBSD must be able to share with the SEC.
2.
Additionally, in accordance with SEC Guidance at 85 FR 6297, books and records pertaining to SBS
transactions entered into prior to the date that UBS AG submits an application for registration are not
Covered Books and Records.
3.
Where transfers of personal data are made to the SEC in the absence of an adequacy determination,
such disclosure will be made in compliance with Articles 44
et seq.
what is necessary for the purpose of the transfer (i.e. compliance with the principle of data
minimisation, e.g. by applying less intrusive processing activities such as redaction).
4.
UBS ESE or, as the case may be, UBS AG has obtained any necessary prior consent of the persons
(e.g
.
, counterparties, employees) whose information is or will be included in Covered Books and
Records in order to provide the SEC with access to its Covered Books and Records or to allow On-
Site Inspections, to the extent, as considered in this opinion, such consent would constitute valid
consent and such consent has not been withdrawn. Insofar as Covered Books and Records relate to
employees of UBS ESE, such employees are “associated persons” of UBS AG for purposes of 17 CFR
§ 240.18a-5(b)(8) who have agreed to sharing of their personal/employment information with the SEC
in the event of a request for information from the SEC.
5.
Any data held by UBS ESE that is subject to a disclosure request from the SEC, either by way of
access or On-Site Inspection, will be held by UBS ESE in Germany. Whilst UBS ESE will be subject
to direct On-Site Inspection by the SEC in Germany, UBS ESE will provide access to its Covered
Books and Records (beyond On-Site Inspections) to UBS AG London Branch, rather than providing
this access directly to the SEC.
6.
The SEC will restrict its information requests for, and use of, any information pursuant to its access to
Covered Books and Records and On-Site Inspections to only the information that it requires for the
legitimate and specific purpose of fulfilling its regulatory mandate and responsibilities by evaluating
compliance with legal obligations designed to ensure the proper legal administration of SEC-regulated
firms (which includes regulating, administering, supervising, enforcing and securing compliance with
the securities or derivatives laws in its jurisdiction) and to prevent and/or enforce against potential
illegal behaviour.
7.
Similarly, UBS ESE will ensure that its disclosures are compliant with the data protection principles
set out in Article 5 of the EU GDPR.
39
information requests from the SEC (or other US and non-US regulators) leads it to maintain a belief,
which it considers to be reasonable, that UBS ESE can and (subject to any changes in applicable law
and regulation and/or the approach of relevant regulators, including the competent German data
protection authorities) will continue to be able to comply with these data protection principles in the
course of making disclosures of the sort required when providing access to Covered Books and
Records and submitting to On-Site Inspection.
40
8.
It is the SEC’s practice to limit the type and amount of personal data it requests during examinations
to targeted requests based on risk and related to specific clients and accounts, and employees. The
39
These principles are set out in
40
See the
SEC
G
uidance at 85 FR 6298
.
0036335-0000808 UKO1: 2005527215.20
20
requested information may include some limited criminal records data and ‘special category data’
under the EU GDPR (as described in paragraph
this aligns with UBS’ general experience in responding to information requests from the SEC, leading
it to maintain a belief, which it considers to be reasonable, that this assumption is, and will remain,
accurate (subject to any changes in applicable law and regulation and/or the approach of relevant
regulators, including the competent German data protection authorities).
41
9.
Information, data and documents received by the SEC are maintained in a secure manner and, under
strict US laws of confidentiality, information about individuals cannot be onward shared save for
certain uses publicly disclosed by the SEC, including in an enforcement proceeding, pursuant to a
valid and non-exempt US Freedom of Information Act (
FOIA
) request,
42
of the US Congress or a properly issued subpoena, or to other regulators who have demonstrated a
need for the information and provide assurances of confidentiality.
10.
UBS ESE has policies in place directing its staff not to UBS ESE’s communication services
(e.g. business e-mail accounts, telephones, chat services, etc.) for private purposes, and directing its
staff not to use private communication services for business purposes.
11.
All terms of business entered into with clients conducting SBS transactions contain clear statements
such that clients are aware that that regulatory oversight will be exercised by regulatory authorities
and that information regarding their transactions, including their personal data, can be disclosed to
regulatory authorities (for example, clause 10, and in particular clause 10(b) of the terms of business
for professional clients and eligible counterparties (March 2019)
43
).
12.
UBS AG does not include the information described in 17 C.F.R. §§.18a-5(b)(8)(i)(A) through (H) or
240.18a-5(a)(10)(i)(A) through (H), as the case may be, in questionnaires or applications for
employment executed by an associated person who is not a US Person (as defined in 17 C.F.R.
§240.3a71-3(a)(4)(i)(A)), unless UBS AG is required to obtain such information under applicable law
in the jurisdiction in which the associated person is employed or located or obtains such information
in conducting a background check that is customary for UBS AG in that jurisdiction and the creation
or maintenance of records reflecting that information would not result in a violation of applicable law
in the jurisdiction in which the associated person is employed or located.
***
41
See the
SEC
G
uidance at 85 FR 6298
.
42
We do not give any views in the opinion to matters of US law, though we understand that information can be
made public pursuant to requests
under the US FOIA, and that certain information is exempt from such requests, including (among others): (1) a trade secret or privileged or
confidential commercial or financial information obtained from a person; (2) a personnel, medical, or similar file the release of which would
constitute a clearly unwarranted invasion of personal privacy; (3) information compiled for law enforcement purposes, the release of which (a)
could reasonably be expected to interfere with law enforcement proceedings; (b) would deprive a person of a right to a fair trial or an impartial
adjudication; (c) could reasonably be expected to constitute an unwarranted invasion of personal privacy; (d) could reasonably be expected to
disclose the identity of a confidential source; (e) would disclose techniques, procedures, or guidelines for investigations or prosecutions; or (f)
could reasonably be expected to endanger an individual's life or physical safety; (4) contained in or related to examination, operating, or condition
reports about financial institutions that the SEC regulates or supervises.
43
Available at:
https://www.ubs.com/global/en/investment-bank/regulatory/_jcr_content/mainpar/toplevelgrid/col1/linklist_1815406319/
link.1894740908.file/PS9jb250ZW50L2RhbS9JbnZlc3RtZW50QmFuay9kb2N1bWVudHMvaWJ0ZXJtcy90ZXJtcy1vZi1idXNpbmVzcy5wZ
GY=/terms-of-business.pdf
.
0036335-0000808 UKO1: 2005527215.20