Art. 8 of the Charter of Fundamental Rights of the European Union (European Fundamental Rights Charter), OJ 2010 C83, 389 (in the following CFR) states:

Article 8

Protection of personal data

1. Everyone has the right to the protection of personal data concerning him or her.

2. Such data must be processed fairly for specified purposes and on the basis of the consent of the

person concerned or some other legitimate basis laid down by law. Everyone has the right of access to

data which has been collected concerning him or her, and the right to have it rectified.

3. Compliance with these rules shall be subject to control by an independent authority

Art. 53 (1) of Directive 2013/36/EU on access to the activity of credit institutions and the prudential supervision of credit institutions and investment firms (OJ 2013 L 176, 338 in the amended version OJ 2013 L 208, 73) obliges – in line with Art. 8 (1) of the Charter -  national supervisory authorities of credit institutions to always respect professional secrecy. Art. 59 (2) of Directive 2013/36/EU entitles the national supervision authorities to transfer data to parliamentary inquiry committees, but only if the information is strictly necessary to fulfil the precise mandate of the enquiry committee (see also Art. 8 (2) of the Charter). Whether transmission of personal data to an enquiry committee is allowed in a single case has to be decided by the supervision authority, but not by the enquiry committee, also according to the European conception. Thus, one cannot state according to applicable European primary and secondary law, that keeping up obligations of confidentiality towards an enquiry committe is null and void (N. Raschauer, Rechtsgutachtliche Stellungnahme zu Rechtsfragen des Untersuchungsausschusses des Nationalrates [2015] Rz 48).

The norms of §§ 1 seq Data Protection Act 2000, Art. 8 (1) of the Charter and Art 8 (1) ECHR are not only applicable to natural persons but also legal entities. The entitlement to data protection covers all personal data and is not limited to data which is solely processed automatically. The fundamental right to secrecy therefore also entails unstructured recorded data, as well as mere knowledge of administrative authorities (see Rosenmayr-Klemenz, Zum Schutz manuell verarbeiteter Daten durch das DSG 2000, ecolex 2001, 641; Duschanek, §1 DSG Rz 25; Dohr/Pollirer/Knyrim/Weiss, DSG2 §1 Rz 6; Kotschy, Datenschutzrechtliche Fragen zum geltenden österreichischen Gentechnikrecht, in Kopetzki/Mayer [Hrsg], Biotechnologie und Recht [2002] 76; Wieser in Korinek/Holoubek Bundesverfassungsrecht Art20 Abs3 Rz 21; DSK 31.8.2000, 120.532/22-DSK/00; 9.9.2005, K 121.041/0012-DSK/2005; zu Art8 GRC vgl. N. Raschauer/Riesz, in Holoubek/Lienbacher [Hrsg], GRC Kommentar [2014] Art8 Rz 13; aA OGH 28.6.2000, 6 Ob 148/00h).

2.2. Summed up, the Federal Minister of Finances holds the opinion that in the course of presenting files and documents to an enquiry committee the “constitutional and fundamental rights” barriers have to be respected. All constitutional norms (Art. Art53 B-VG, §1 DSG 2000 und Art8 EMRK [sowie Art8 GRC]) would systematically be on the same level and are to be applied cumulatively (next to each other). By way of the (constitutional) legal measures to reform the enquiry committee the (constitutional) legislator did not link a change within the (legal) secrecy and confidentiality norms applicable for the authority asked to transmit information (§38 BWG, §48a BAO). Art. 53 of the Constitution as of BGBl I 101/2014 did not materially derogate those other norms.

2.7. In this – limited by the tasks of the enquiry committee – scope of investigation neither § 1 Data Protection Act 2000 nor Art. 8 ECHR (as well as Art. 8 of the Charter) speak against transferring the files and documents to the enquiry committee. The same has to apply all the more to the single norms of § 38 (1) to (4) BWG and § 48a BAO, which have to be interpreted in line with constitutional law (if they had another content, they would be unconstitutional as violating Art. 53 of the Constitution, see VfSlg. 15.130/1998 regarding a procedure according to Art. 144 of the Constitution).

2.9. From the comprehensive obligation of the obliged authorities to refer to the documents, it does not follow a competence of the enquiry committee or its members to present information out of the presented files or information to the public in any case, not in the written report according to § 51 VO-UA, nor in the oral reporting according to § 52 leg. Cit. The enquiry committee has to continuously conduct a weighing of interests in its reporting (see especially § 1 Data Protection Act 2000, but also Art. 8 ECHR (as well as Art. 8 of the Charter) between privat interests of secrecy and public interests, which also includes publication of results of control (see VfGH 9.10.2014, KR1/2014 with further information regarding a procedure to Art. 126a of the Constitution). The enquiry committee  needs to consider this weighing of interests throughout its entire work (see especially the rules of the VO-UA regarding media-public and confidential meetings (§ 17), regarding consultations of the enquiry committee (§ 18), publications (§20) and information security (§ 21 together with InfOG, see also Art. 57 of the Constitution together with criminal law norm of § 18 InfOG) and extends also to dealing with information in the area of the parliament (see especially the rules of the InfOG).