1

UBS AG London Branch

5 Broadgate

London

EC2M 2QS

Allen & Overy LLP

Bockenheimer Landstraße 2

60306 Frankfurt am Main Germany

Our ref

0036335

-

0000808

22 October 2021

Dear Sir or Madam

UBS SEC registration as a non-resident security-based swap dealer

1.

BACKGROUND

1.1

We understand that UBS AG, a bank authorised in Switzerland, is seeking to register with the United

States (

US

) Securities and Exchange Commission (

SEC

) as a non-resident security-based swap (

SBS

)

dealer (

SBSD

).

1.2

To register as an SBSD with the SEC, a non-resident SBSD

1

 such as UBS AG must attach an opinion

of counsel to Form SBSE, SBSE-A or SBSE-BD affirming that the SBSD can, as a matter of law:

(a)

provide the SEC with prompt access to the relevant books and records as defined in

paragraphs

 to

 (

Covered Books and Records

); and 

(b)

submit to on-site inspection and examination of its Covered Books and Records by the SEC

(

On-Site Inspection

).

1.3

Associated persons of UBS AG located in Germany who effect SBS transactions on behalf of UBS

AG will be employed by UBS Europe SE (

UBS ESE

), which is incorporated in Germany and

authorised to provide services in Germany (among other jurisdictions). Accordingly, UBS ESE will

maintain certain Covered Books and Records in Germany on behalf of UBS AG.

1.4

You have asked us to issue an opinion affirming that (a) UBS AG will be able to provide the SEC with

prompt access to its Covered Books and Records that are maintained by UBS ESE in Germany and

(b) UBS ESE can submit to On-Site Inspection by the SEC of UBS AG’s Covered Books and Records

it maintains on behalf of UBS AG, in each case accordance with paragraph

2

1

In the case of a corporation, an SBSD will be “non

-

resident” if it is incorporated

in or has its principal place of business in any place not in the

United States (see 17 Code of Federal Regulations (

CFR

) § 240.15Fb2-4(a)(2)). As UBS AG is incorporated in Switzerland, UBS AG fulfils this

definition of a “non-resident” SBSD.

2

In accord

ance with Assumption

 in

, this opinion does not cover the direct provision of Covered Books and Records by UBS ESE to

the SEC as this information will instead be provided to UBS AG London Branch and sent by UBS AG London Branch to the SEC.

Allen & Overy LLP is a limited liability partnership registered in England and Wales with registered number OC306763. It is authorised and regulated by the Solicitors Regulation

Authority of England and Wales. The term partner is used to refer to a member of Allen & Overy LLP or an employee or consultant with equivalent standing and qualifications. A list

of the members of Allen & Overy LLP and of the non-members who are designated as partners is open to inspection at its registered office, One Bishops Square, London E1 6AD.

Allen & Overy LLP or an affiliated undertaking has an office in each of: Abu Dhabi, Amsterdam, Antwerp, Bangkok, Beijing, Belfast, Bratislava, Brussels, Budapest, Casablanca, Dubai,

Düsseldorf, Frankfurt, Hamburg, Hanoi, Ho Chi Minh City, Hong Kong, Istanbul, Jakarta (associated office), Johannesburg, London, Los Angeles, Luxembourg, Madrid, Milan, Moscow,

Munich, New York, Paris, Perth, Prague, Rome, São Paulo, Seoul, Shanghai, Silicon Valley, Singapore, Sydney, Tokyo, Warsaw, Washington, D.C. and Yangon.

2

Düsseldorf

Dreischeibenhaus 1 

40211 Düsseldorf 

Tel +49 (0)211 2806 7000 

Fax +49 (0)211 2806 7800 

Ellen Birkemeyer 

Dr. Hans Diekmann 

Dr. Christian Eichner 

Dr. Jens Matthes 

Dr. Stephan Neuhaus 

Dr. Jan Schröder 

Counsel 

Kyrill Chilevych 

Dr. Michael Fink 

Anne Fischer 

Dr. Achim Schmid 

Frankfurt

Haus am OpernTurm 

Bockenheimer Landstraße 2 

60306 Frankfurt am Main 

Tel +49 (0)69 2648 5000 

Fax +49 (0)69 2648 5800 

Dr. Alexander Behrens 

Dr. Wolf R. Bussian 

John Coburn 

Dr. Michael H. Ehret 

Dr. Stefan Henkelmann 

Dr. Franz Bernhard Herding 

Dr. Matthias Horn 

Dr. Michiel Huizinga 

Dr. Hartmut Krause 

Dr. Hans-Peter Löw 

Anna Masser 

Dr. Olaf Meisen 

Wolfgang Melzer 

Thomas Neubaum 

Dr. Udo H. Olgemöller 

Marc O. Plepelits 

Dr. Sven Prüfer 

Dr. Knut Sauer 

Martin Scharnke 

Dr. Jochen Scheel 

Thomas Ubber 

Dr. Heike Weber 

Dr. Michael Weiß 

Jan Erik Windthorst 

Dr. Marc Zimmerling 

Senior Counsel 

Peter H. Hoegen 

Counsel 

Boris Alexander Blunck 

Dr. Jan-Hendrik Bode 

Lennart Dahmen 

Matthias Fischer 

Dr. Mark Hallett 

Woldemar Häring 

Dr. Roman A. Kasten 

Christian Klöpfer 

Stefan Kuhm 

Dr. Tim Nikolas Müller 

Jens Nollmann 

Dr. David T. Schmid 

Dr. Esther Schmidt-Naumann 

Dr. Sebastian Schulz 

Tim Spranger 

Dr. Katharina Stüber 

Dr. Andre P. H. Wandt 

Peter Wehner 

Alexander Wüpper 

Of Counsel 

Stephan Funck 

Frank Herring 

Hamburg

Hanseatic Trade Center 

Kehrwieder 12 

20457 Hamburg 

Tel +49 (0)40 82221 20 

Fax +49 (0)40 82221 2200 

Dr. Börries Ahrens 

Dr. Nicolaus Ascherfeld 

Markulf Behrendt 

Dr. Ellen Braun 

Dr. Christian Hilmes 

Dr. Nils Koffka 

Max Landshut 

Dr. Helge Schäfer 

Dr. Hans Schoneweg 

Counsel 

Marie-Luise von Buchwaldt 

Dr. René Galle 

Dr. Rüdiger Klüber 

Dr. Jonas Wittgens 

München

Maximilianstraße 35 

80539 München 

Tel +49 (0)89 71043 3000 

Fax +49 (0)89 71043 3800 

Dr. Gottfried E. Breuninger 

Dr. Jan Ebersohl 

Dr. Joachim Feldges 

Dr. Astrid Krüger 

Dr. Magnus Müller 

Dr. Hendrik Röhricht 

Dr. Walter Uebelhoer 

Dr. Alexander Veith 

Counsel 

Dr. Ilja Baudisch 

Dr. Alice Broichmann 

Christina Habermayr 

Dr. Dirk Schade 

Dr. Bettina Scharff 

Dr. Jens Wagner 

Eda Zhuleku 

0036335-0000808 UKO1: 2005527215.20

3

1.5

This opinion is structured as follows:

(a)

Section

:

(b)

Section

:

; 

(c)

Section

:

(d)

Section

:

(e)

: Opinion; and

(f)

: Assumptions. 

1.6

For the purposes of this opinion, the legal or natural person imparting the information subject to the

duty of confidentiality will be the

Rights Holder

and the person receiving that information, in this

case UBS ESE, will be the

Recipient.

2.

SUMMARY OF OPINION

Subject to the assumptions and qualifications below, it is our opinion that:

2.1

UBS ESE can, as matter of applicable German law, submit to On-Site Inspection by the SEC. There

is no restriction or general blocking statute on UBS ESE submitting to On-Site Inspection by the SEC. 

The remainder of this opinion focuses on UBS ESE’s ability to disclose information contained in

Covered Books and Records to the SEC in the course of On-Site Inspection in Germany and the ability

to provide UBS AG London Branch with prompt access to Covered Books and Records.

2.2

UBS ESE can, as a matter of applicable German law, provide the SEC with prompt access to Covered

Books and Records held by UBS ESE in Germany either by disclosure of Covered Books and Records

to UBS AG London Branch for the purpose of providing information to the SEC or to the SEC in the

course of On-Site Inspections in Germany.

3

Data Protection

4

2.3

Disclosures of personal data (particularly special categories of data or criminal data) relating to UBS

ESE’s clients and staff are subject to certain restrictions under the Data Protection Laws, particularly

where this involves a cross-border transfer to a country or territory the European Commission has not

found to have an ‘adequate’ data protection regime.

5

 However, there are certain legal bases for making

disclosures, and derogations from the prohibition on international transfers, that would be available to

UBS ESE were it to be required by the SEC to make available personal data either by disclosure of

Covered Books and Records to UBS AG London Branch for the purpose of providing information to

the SEC or to the SEC in the course of On-Site Inspections in Germany. We note that these legal

restrictions and derogations that UBS ESE would rely on when making disclosures to the SEC are the

same legal requirements as referred to and reflected in the “Memorandum of Understanding

concerning consultation, cooperation and the exchange of information related to the supervision and

oversight of certain cross-border over-the-counter derivatives entities in connection with the use of

substituted compliance by such entities” entered into between the SEC and the German Federal

Financial Supervisory Authority (

Bundesanstalt für Finanzdienstleistungsaufsicht

–

BaFin

) (the

3

Where a restriction on the ability to

grant access to,

transfer

or other disclose

personal data or to disclose confidential information applies, consent

from the Rights Holder, validly given in accordance with the relevant standard for consent under each applicable legal obligation, would allow

for such information to be lawfully transferred to the SEC or disclosed to the SEC during On-Site Inspection. Please note that valid consent is

assumed in Assumption

4

Please refer to section

 of

 for definitions of Data Protection Laws, EU GDPR and the BDSG.

5

According to Article

44 of the EU GDPR, any transfer of personal data to third countries or international organizations must, in addition to

complying with Chapter V of the EU GDPR, also meet the conditions of the other provisions of the EU GDPR.

0036335-0000808 UKO1: 2005527215.20

4

BaFin MoU

).

6

 A similar Memorandum of Understanding was entered into by the SEC and the

European Central Bank (

ECB

)

7

 (the

ECB MoU

).

8

2.4

We anticipate that the legitimate interests legal basis for processing would provide an applicable

grounds under the EU GDPR to enable disclosure of Covered Books and Records to UBS AG London

Branch for the purpose of providing information to the SEC and to permit On-Site Inspection. 

Banking Secrecy Principle

2.5

The German banking secrecy principle (the

German Banking Secrecy Principle

) applies in respect

of all business and private information on the client obtained by a bank on the basis or within the

context of its client business pursuant to a contractual relationship with the client. In Germany, the

banking secrecy principle is primarily a matter of contract law. Against this background, the German

Banking Secrecy Principle does not differentiate between (i) customer data; and (ii) data of natural

persons or legal entities, provided that the data are obtained on the basis or within the context of a

customer business pursuant to a contractual relationship with a client governed by German law.

2.6

UBS ESE may share information contained in the Covered Books and Records or obtained by the SEC

through On-Site Inspections either (i) where they are not in the scope of application of the German

Banking Secrecy Principle or (ii) where the sharing is legally justified as it is either required by law

or the relevant clients have consented to the disclosure. A client’s consent can be expressed implicitly. 

2.7

German laws and orders of German authorities clearly justify a sharing of information covered by the

German Banking Secrecy Principle. There is, however, no case law or administrative practice or clear

legal literature as regards the “conflict” between foreign statutes and foreign orders on the one hand

and the German Banking Secrecy Principle on the other hand. Hence, the legal situation is unclear.

That said, in our view there are good reasons to believe that data sharing can be justified in relation to

the German Banking Secrecy Principle by either (i) implied consent or (ii) a combination of the US

statutes / the SEC orders in combination with the BaFin MoU / ECB MoU.

Principle of territoriality

2.8

According to the general territorial principle of international law, a state that wishes to take action

outside its sovereign borders is, as a general rule, referred to private law, because the territorial

principle of international law limits the validity of its sovereign acts to its national territory. In this

respect, the SEC is in principle not authorized to take sovereign action, including On-Site Inspection

of and obtaining access to Covered Books and Records, in Germany. However, such a permission can

be found in the BaFin MoU between BaFin and SEC and also in the ECB MoU between ECB and

SEC.

9

 While the BaFin MoU and the ECB MoU are non-binding, in our view it should allow those

actions to be taken without a breach of the general principle of territoriality.

Privacy and Human Rights

2.9

Protection for the general fundamental right to “

respect for private and family life, home and

correspondence

” is enshrined in Article 8 of the European Convention on Human Rights (

ECHR

).

This right is directly applicable in Germany. Actions in respect of Article 8 ECHR require a separate

cause of action, such as an action arising from a wrongful act or other legal obligation, such as under

the Data Protection Laws. However, we note that the ECHR only confers rights on private law subjects

6

Available at

https://www.sec.gov/files/15122020-substituted-compliance-mou-germany-final-signatures.pdf.

7

As UBS ESE qualifies as

a “significant institution

” within the meaning of

Art.

6(4) of the Regulation der (EU) No. 1024/2013 (the

Single

Supervisory Mechanism Regulation

), it is, as regards prudential supervision, also subject to direct supervision by the ECB.

8

The Memorandum of Understanding between the United States

Securities and Exchange Commission and the European Central Bank concerning

consultation, cooperation and the exchange of information related to the supervision and oversight of certain cross-border over-the-counter

derivatives entities in connection with

the use of substituted compliance by such entities dated 16 August 2021 (available at

https://www.bankingsupervision.europa.eu/legalframework/mous/html/ssm.mou_2021_sec~220403db9b.en.pdf

).

9

Article II paragraph 25

et seq

. of the ECB MoU and Article II paragraph 26

et seq.

of the BaFin MoU.

0036335-0000808 UKO1: 2005527215.20

5

vis-à-vis the state and not among themselves. Consequently, the ECHR is not directly applicable to

UBS ESE.

2.10

Article 8 ECHR is, as it were, the legal foundation on which the GDPR has been based. The GDPR is

detailing the fundamental right laid down in Article 8 ECHR. Thus, Article 8 ECHR and the GDPR

are intertwined with each other. As long as the provision of information to the SEC by UBS ESE falls

entirely within the scope of and is in compliance with the Data Protection Laws, we consider the

general fundamental right set out in Article 8 ECHR will be protected.

This summary opinion is not a substitute for the full expression of our views set out in

3.

SCOPE, ASSUMPTIONS AND QUALIFICATIONS

3.1

This opinion relates solely to access provided to the SEC by UBS AG, through its London Branch, of

Covered Books and Records held on its behalf by UBS ESE in Germany and On-Site Inspection of

UBS ESE by the SEC in Germany. This opinion applies equally to remote access from the United

States to Covered Books and Records held in the Federal Republic of Germany. This opinion excludes

books and records held in the US.

3.2

This opinion has been prepared in accordance with UBS AG’s specific instructions as to the scope of

the opinion. For this purpose you have issued us with guidance from a third party US law firm which

we have used to inform the scope of our opinion.

3.3

This opinion covers data relating to:

(a)

SBS transactions concluded between UBS AG (through its associated persons employed by

UBS ESE) and US Person counterparties, insofar as this data is held on behalf of UBS AG by

UBS ESE (e.g. voice recordings and client communications) (these transactions will be

concluded by staff of UBS ESE acting in the name and for the account of UBS AG London

Branch and so some data relating to such transactions will be held by UBS AG London Branch

in the United Kingdom (

UK

) – access to Covered Books and Records and On-Site Inspections

by the SEC of data that is held in the UK is not within scope of this opinion); and

(b)

the activities of the staff of UBS ESE pertaining to UBS AG’s SBS transactions that are also

arranged, negotiated, or executed by personnel of UBS AG located in a US branch or office

or by personnel of an agent of UBS AG located in a US branch or office (irrespective of

whether UBS AG’s counterparty is a US Person or a non-US Person).

This opinion only covers transactions entered into by UBS AG where UBS ESE is acting on behalf of

UBS AG. This opinion does not cover data relating to SBS transactions concluded between UBS ESE

and its own counterparties (even though UBS ESE may be relying on the counting exemption set out

in 17 CFR § 240.3a71-3(d) for such transactions, we are instructed that this data is not relevant for the

purposes of 17 CFR § 240.15Fb2-4(c) and so this data is not within scope of this opinion.

0036335-0000808 UKO1: 2005527215.20

6

3.4

This opinion only covers access to and the On-site Inspection of Covered Books and Records. Covered

Books and Records include only those books and records which:

(a)

relate to the US business

10

 of the non-resident SBSD.

11

 These are the records that relate to an

SBS that is either:

(i)

entered into, or offered to be entered into, by or on behalf of the non-resident SBSD,

with a “U.S. Person” as defined in 17 CFR § 240.3a71-3(a)(4)

12

 (

US Person

) (other

than an SBS conducted through a foreign branch of such US Person

13

); or

(ii)

arranged, negotiated, or executed by personnel of the non-resident SBSD located in a

branch in the United States (

US branch

) or office or by personnel of an agent of the

non-resident SBSD located in a US branch or office;

14

 or

(b)

constitute financial records necessary for the SEC to assess the non-resident SBSD’s

compliance with the SEC’s margin and capital requirements, if applicable.

15

3.5

Further to Assumption

, this opinion is limited to those types of records that are relevant to

prudentially regulated SBSDs, which excludes financial records as noted in paragraph

. 

For this opinion, the term “Covered Books and Records” extends to these record types alone.

3.6

The issues addressed in this opinion apply equally across the different document types which constitute

the Covered Books and Records based upon the information actually contained in each of the relevant

Covered Books and Records. We have not examined any such documents or records. 

3.7

In giving this opinion, we have made the further assumptions set out in

. 

3.8

No opinion is expressed on matters of fact. 

3.9

As a practical matter, it may be particularly difficult to establish that consent is freely given where

information relates to UBS ESE staff because consent is very difficult to rely on in an employment

context, due to the inherent imbalance of power between an employer and its staff (for example, staff

may believe there could be negative consequences should they refuse to give consent). Further,

consent will only be valid if UBS ESE offers its staff a genuine choice over how the data is used and

will only continue to be an appropriate legal basis if UBS ESE also offers its staff the opportunity to

withdraw consent at any time. Where consent is relied upon in this opinion, it is on the basis that this

practical matter has been overcome. Where consent is not available as a legal basis for disclosure

(including where valid consent cannot be obtained), UBS ESE may be able to rely on an alternative

basis for disclosure (e.g. the legitimate interest basis or another exception for international transfer of

personal data).

10

As defined in 17 CFR §240.3a71

-

3

(a)(8).

11

Cross

-

Border Application of Certain [SBS] Requirements, 85 Fed.

Reg. 6270, 6296 (Feb. 4, 2020) (the

SEC Guidance

). 

12

A “U.S. person” means any person that is “(i) a natural person resident in the U.S.; (ii) a partnership, corporation, trust,

i

nvestment vehicle, or

other legal person organized, incorporated, or established under the laws of the United States or having its principal place of business in the

United States; (iii) an account (whether discretionary or non-discretionary) of a U.S. person; or (iv) an estate of a decedent who was a resident

of the United States at the time of death.” 17 CFR § 240.3a71-3(a)(4).

13

A “foreign branch” means “any branch of a U.S. bank if: (i) the branch is located outside of the United States; (ii) the bran

c

h operates for valid

business reasons; and (iii) the branch is engaged in the business of banking and is subject to substantive banking regulation in the jurisdiction

where located.” (17 CFR § 240.3a71-3(a)(2)). An “SBS conducted through a foreign branch” means an SBS that is “arranged, negotiated, and

executed by a U.S. person through a foreign branch of such U.S. person if: (A) the foreign branch is the counterparty to such security-based swap

transaction; and (B) the security-based swap transaction is arranged, negotiated, and executed on behalf of the foreign branch solely by persons

located outside the United States.” (17 CFR § 240.3a71-3(a)(3)(i)).

14

17 CFR

§

240.3a71

-

3(a)(8)(i)(B).

15

The requirement set out in this paragraph

 does not apply to UBS AG because it is not subject to the SEC’s margin and capital requirements

as it is assumed that UBS AG has a prudential regulator – please see Assumptions

 set out in

0036335-0000808 UKO1: 2005527215.20

7

4.

REVISIONS TO APPLICABLE LAW 

4.1

We note that the SEC rules

16

 require a non-resident SBSD to re-certify within 90 days after any

changes in the legal or regulatory framework that would:

(a)

impact the ability of the SBSD to provide prompt access to its Covered Books and Records; 

(b)

impact the manner in which it would provide prompt access to its Covered Books and Records;

or

(c)

impact the ability of the SEC to conduct On-Site Inspections.

4.2

Upon a change in law or regulatory framework of the sort outlined in paragraph

 above, the SBSD

is required to submit a revised opinion describing how, as a matter of law, the SBSD will continue to

meet its obligations. 

4.3

This opinion relates solely to the laws of the Federal Republic of Germany and European Union (

EU

)

law that is directly applicable in Germany (i.e. regulations pursuant to Art. 288(2) of the Treaty on the

Functioning of the European Union), in each case, in force as at the date of this opinion. We have no

obligation to notify any addressee of any change in any applicable law or its application after the date

of this opinion.

5.

RELIANCE AND CONFIDENTIALITY

5.1

This opinion is given for the sole benefit of the addressee. It may not be relied upon by anyone else

without our prior written consent.

5.2

This opinion is not to be disclosed to any person outside of UBS AG’s group or used, circulated,

quoted or otherwise referred to for any other purpose. However, we agree that a copy of this opinion

letter may be disclosed: 

(a)

where disclosure is required or requested by any governmental, banking, taxation or other

regulatory authority or similar body having jurisdiction over UBS AG (including to the SEC

as part of UBS AG’s SBSD registration application) or by the rules of any relevant stock

exchange or pursuant to any applicable law or regulation; and 

(b)

to UBS AG’s affiliates, and any of their officers, directors, employees, auditors, insurers,

reinsurers, insurance brokers and professional advisors (in their capacity as such).

5.3

Any such disclosure must be made on the basis that it is for information purposes only, no recipient

may rely on this advice, no client-lawyer relationship between us and the recipient arises following,

or as a result of, any such disclosure. We assume no duty or liability to any recipient, and any recipient

under paragraph

 will be subject to the same restrictions on disclosure as set out above.

5.4

We assume no obligation to advise you or any other person or to make any investigations as to any

legal developments or factual matters arising subsequent to the date hereof that might affect the

opinions expressed herein.

16

17 CFR § 240

.15Fb2

-

4(c)(2).

0036335-0000808 UKO1: 2005527215.20

8

Yours faithfully,

Allen & Overy LLP

0036335-0000808 UKO1: 2005527215.20

9

ANNEX 1

OPINION

1.

DATA PROTECTION

1.1

The General Data Protection Regulation 2016/679 (

EU GDPR

), and the German Federal Data

Protection Act (

Bundesdatenschutzgesetz

 –

BDSG

) (together, the

Data Protection Laws

) will apply

to UBS ESE’s disclosure of Covered Books and Records to UBS AG London Branch for the purpose

of providing information to the SEC and to the SEC in the course of On-Site Inspections, to the extent

that these comprise or contain personal data. Personal data is data relating to an identified or

identifiable living individual, so may extend to information on UBS ESE staff as well as clients. 

1.2

Under the Data Protection Laws, specific additional restrictions apply for personal data relating to

criminal convictions and offences.

17

 These laws also impose heightened restrictions on the processing

of ‘special category personal data’ – this is personal data that reveals racial or ethnic background,

political opinions, religious or philosophical beliefs, or trade union membership, genetic data,

biometric data when used for ID purposes, health information, data concerning sex life or sexual

orientation

18

. As special category personal data are less likely to be relevant in the context of UBS

ESE’s disclosures to the SEC, the laws applicable to this data have not been considered in detail in

this opinion.

1.3

Key restrictions in the Data Protection Laws relating to UBS ESE’s ability to disclose personal data

to the SEC are set out below.

Legal basis for the disclosure

1.4

UBS ESE requires a legal basis under Article 6 of the EU GDPR to disclose personal data to the SEC

in the course of On-Site Inspections and to provide UBS AG London Branch with access to its Covered

Books and Records for the purpose of providing information to the SEC. Personal data cannot be

disclosed if doing so would breach another legal requirement (e.g. banking secrecy – please see section

). Whilst there are a number of Article 6 legal bases on which UBS ESE may seek to rely,

none of its own is so comprehensive as to cover all disclosures of personal data to the SEC, so UBS

ESE will need to consider the most appropriate legal basis to apply to any given situation on a case-

by-case basis.

1.5

The Article 6 legal bases most applicable to UBS ESE, together with their respective limitations, are

as follows:

(a)

Consent (Article 6(1)(a) EU GDPR)

: In order for consent to be valid under the Data Protection

Laws, it must satisfy the high standard of being a freely-given, specific, informed and

unambiguous indication of wishes.

19

(b)

Legitimate interests (Article 6(1)(f) EU GDPR)

: This is one of the most flexible legal bases

for processing that can apply to a multitude of business purposes, including with respect to

ensuring compliance with regulatory obligations. To rely on the legitimate interests ground,

UBS ESE must: 

17

Article

10 of the EU GDPR.

18

Article

9(1) of the EU GDPR.

19

Please also refer to limitations on the applicability of consent discussed in paragraph

 of section

:

 We

note that German data protection authorities are in practice particularly strict in relation to accepting employee consent as freely given and that

under Section 26(2) of the BDSG, the employee’s level of dependence in the employment relationship and the circumstances under which consent

was given must be taken into account in assessing whether such consent was freely given. That said, it may prove almost impossible in practice

to obtain valid employee consent from UBS ESE’s staff for the purpose of disclosing their personal data to a non-EU based authority. Consent

might therefore not generally be considered as a valid legal basis for disclosure of UBS ESE’s staff data and UBS ESE should rely on an

alternative basis for disclosure (e.g. the legitimate interests). Please note that valid consent is assumed in Assumption

0036335-0000808 UKO1: 2005527215.20

10

(i)

identify its, or a third party’s legitimate interest (this can include commercial interests,

individual interests or broader societal benefits) in complying with the SEC’s

disclosure request; 

(ii)

show that the disclosure of documents to the SEC is necessary for achieving these

interests; and 

(iii)

balance these interests against the competing interests, rights and freedoms of the

individuals concerned, and satisfy itself that those interests do not outweigh its own. 

If individuals would not reasonably expect the disclosure, or if the disclosure would

cause unjustified harm to the individuals, the interests of those individuals would

likely override the interests of UBS ESE or the third party.

An individual has the right to object to the disclosure of their personal data to the SEC under

this basis for processing, and UBS ESE would need to demonstrate ‘compelling’ legitimate

grounds to process the data that override the rights, freedoms and interests of that individual.

The balancing of legitimate interests against the competing interests, rights and freedoms of

the individuals concerned should be made on a case-by-case basis and should consider all

available facts. In particular, Recital 47 of the GDPR states that, when balancing their interests

against those of the

individuals concerned, controllers should take into account

“

the

reasonable expectations of data subjects based on their relationship with the controller

”. With

this in mind, UBS ESE may argue that its interests are not outweighed by those of its clients

or its employees on the basis that:

(i)

clients are aware, due to statements contained in their terms of business with UBS

AG, the US nexus when they engage in SBS transactions and, their understanding as

sophisticated investors, that regulatory oversight will be exercised by the SEC, which

may entail certain information regarding their transactions, including in some cases

their personal data, to be disclosed to the SEC; and

(ii)

the employees whose personal data may be disclosed to the SEC understand their role

will involve SEC oversight due to their being classified as ‘associated persons’ for the

purposes of SBS transactions and understand that, as a result, certain of their personal

data may be disclosed to the SEC. More specifically, each associated person is

required to complete an ‘SBS associated person questionnaire’, which provides

advance notice that their activities may involve the disclosure of their personal data

to the SEC and potentially require them to undertake interviews with the SEC. Each

employee that is an associated person is also required to agree or acknowledge their

understanding that their data may be provided to the SEC in connection with the

SEC’s oversight of SBS transactions. 

In addition, while focused on the relationship between the SEC and BaFin, the existence of

the BaFin MoU arguably reflects an acceptance in Germany that the SEC has a duty to regulate

SBS markets and may need to access information maintained by financial institutions located

in Germany for this purpose. This argument is further supported by the ECB MoU, which

similarly reflects an understanding of the SEC’s duties and an acceptance regarding the need

for information, including personal data, to be provided to the SEC.

20

Also relevant to this balancing of interests are that the SEC will:

20

For the avoidance of doubt, we note however that neither the BaFin MoU nor the ECB MoU stipulates any exemptions from the com

pliance with

applicable data protection rules under the GDPR, including from the international transfer rules.

0036335-0000808 UKO1: 2005527215.20

11

(i)

restrict its information requests for, and use of, any information to only the

information that it requires for the legitimate and specific purpose of fulfilling its

regulatory mandate and responsibilities and to prevent and/or enforce against potential

illegal behaviour, with the type and amount of personal data requested being targeted

based on risk and related to specific clients and accounts, and employees;

21

 and

(ii)

information, data and documents received by the SEC are maintained in a secure

manner and only disclosed pursuant to strict US confidentiality laws.

22

(c)

Disclosure is necessary for compliance

with a legal obligation to which UBS ESE is subject

(Article 6(1)(c) EU GDPR)

: There must be a German or EU law nexus in order for UBS ESE

to be able to rely on this legal basis. Article 6(3) of the EU GDPR requires that the legal

obligation must be laid down by EU law or EU Member State law, to which the controller is

subject to, although this does not have to be an explicit statutory obligation, as long as the

application of the law is foreseeable to UBS ESE as the person subject to it.

23

In the context of this legal basis for processing, an SEC request in the absence of a German or

EU legal requirement (e.g. a lawful request from BaFin in the exercise of its powers) would

not justify the disclosure as being necessary for compliance with such an obligation.

We further note that neither the BaFin MoU nor the ECB MoU create any legally binding

obligations.

24

(d)

Disclosure is necessary for the performance of a task carried out in the public interest (Article

6(1)(e) EU GDPR)

: According to German data protection authorities’ and legal literature’s

interpretation of this legal basis, only entities who or are officially entrusted with performing

public tasks or are vested with public authority are able to rely on this legal basis.

25

 As a result

it is not possible for UBS ESE to rely on this legal basis for the disclosure of personal data

contained in the Covered Books and Records from a German data protection law perspective. 

(e)

Disclosure is necessary for the establishment, exercise or defence of legal claims unless the

data subject has an overriding interest in not having the data processed (Section 24(1) no.2

BDSG)

:

The effects of the disclosure on the data subject must be assessed on a case-by-case

basis, taking into account in particular if the disclosure of personal data is truly necessary or

if there are less intrusive ways to fulfil UBS ESE’s interest in the establishment, exercise or

defence of legal claims.

Based upon the above, the legitimate interests basis for processing is likely to be the most appropriate

Article 6 EU GDPR grounds on which UBS ESE could rely in relation to its disclosure of Covered

Books and Records to the SEC and to permit On-Site Inspection.

1.6

It is considered very unlikely that personal data included in Covered Books and Records or disclosed

to the SEC during On-Site Inspections will include special categories of personal data. Further, UBS

ESE might not hold all information described in 17 C.F.R. §§.18a-5(b)(8)(i)(A) through (H) or

240.18a-5(a)(10)(i)(A) through (H), as the case may be an associated person who is not a US Person.

26

However, to the extent that this does occur, and such information is held by UBS ESE, in addition to

an Article 6 EU GDPR legal basis, UBS ESE will need to establish an additional condition for

processing under Article 9 of the EU GDPR if it discloses special categories of personal data to the

21

Please refer to Assumptions

 and

 in

, as well as Article II paragraphs 44, 54 of the BaFin MoU and Article II paragraph 49 of the ECB

MoU.

22

Please refer to Assumption

 in

, as well as paragraph 60 of the BaFin MoU and paragraph 56 of the ECB MoU.

23

Recital 41

E

U GDPR

.

24

Article II paragraph

28 of the BaFin MoU / Article II paragraph 27 of the ECB MoU.

25

See DSK short paper no.

4 (

Kurzpapier Nr. 4 Datenübermittlung in Drittländer

), available at

https://www.datenschutzkonferenz

-

online.de/media/kp/dsk_kpnr_4.pdf

26

As we understand is as defined in 17 C.F.R. §240.3a71

-

3(a)(4)(i)(A).

0036335-0000808 UKO1: 2005527215.20

12

SEC, such as where it is necessary for the establishment, exercise or defence of legal claims. Other

than valid consent,

27

 the Article 9 EU GDPR conditions that are most likely to apply to disclosure of

special categories of personal data contained in the Covered Books and Records are:

(a)

processing is necessary for the establishment, exercise or defence of legal claims or whenever

courts are acting in their judicial capacity

 (

Article 9(2)(f) EU GDPR and Section 24(1) no.

2

BDSG)

; and

(b)

processing is necessary for reasons of substantial interest, on the basis of domestic or Member

State

law

 (

Article 9(2)(g) EU GDPR)

.

1.7

Although Sections 22 and 26(3) BDSG provides for additional legal bases for the processing of special

categories of personal data, none of these additional bases is likely to be available for disclosing special

categories of personal data to the SEC by UBS ESE, as these legal bases refer to the processing for

purposes of preventive medicine or where the processing is required under employment or social laws. 

1.8

Similarly, UBS ESE’s processing of personal data relating to criminal convictions and offences or

related security measures is highly restricted, and can only be disclosed based on Article 6(1) EU

GDPR under the control of official authority or when the processing is authorised by EU or EU

Member State law providing for appropriate safeguards for the rights and freedoms of data subjects.

28

It is recognised by the legislative memorandum

29

 to the BDSG that Section 26 BDSG is such EU

Member State law that allows processing of criminal data without the control of official authority.

That is, to the extent that the disclosure of criminal data is

necessary for the performance of the

employment relationship

, Section 26 BDSG could allow on a case-by-case assessment the disclosure

of UBS ESE staff’s criminal data.

30

Data protection principles

1.9

In addition to establishing a legal basis for the disclosure, UBS ESE would need to ensure that its

disclosures are compliant with the remaining requirements under the Data Protection Laws, including

the data protection principles set out in Article 5 of the EU GDPR. For example, UBS ESE must:

(a)

be transparent with those whose personal data is to be disclosed to the SEC, who must be

provided with fair processing information (usually in the form of a privacy notice or

statement);

(b)

with respect to the data itself, ensure that it only provides personal data that is adequate,

relevant and limited to what is necessary in relation to the purposes of its regulatory activities; 

(c)

be careful to avoid participating in ‘data dumps’ and should consider withholding documents,

anonymising personal data (or pseudonymising data where full anonymisation is not possible)

and redacting personal data from documents as appropriate;

(d)

ensure that the data is accurate and, where necessary, kept up to date;

(e)

keep the personal data in a form that enables identification of individuals for no longer than is

necessary for the purposes for which the personal data is processed; and

(f)

ensure that the confidentiality and integrity of personal data is maintained, and as such,

implement appropriate security measures (e.g. encryption) to protect the personal data.

27

Article 9(2)(a) EU GDPR

–

please also refer to l

imitations on the applicability of consent discussed in paragraph

 of section

:

 Please note that valid consent is assumed in Assumption

28

Article

10 sent.

1 EU GDPR.

29

BT

-

Drs. 18/11325, p.

97.

30

W

e note, however, that in our experience German data protection authorities tend to apply the necessi

ty test rather strictly in the employment

context in practice. 

0036335-0000808 UKO1: 2005527215.20

13

1.10

Whilst it is possible that the SEC has taken these principles into account in its request for access to the

Covered Books and Records, responsibility remains with UBS ESE to ensure that any disclosure of

personal data in the Covered Books and Records comply with all requirements under the Data

Protection Laws and to verify this and implement its own compliance measures.

International transfers

1.11

The general principle in the EU GDPR is that UBS ESE may not transfer personal data to a jurisdiction

outside the European Economic Area, unless it can satisfy a condition for the transfer as set out in

Chapter V of the EU GDPR. 

1.12

Article 45 of the EU GDPR allows for UBS ESE to transfer personal data to a recipient outside the

EEA where the transfer is based on an adequacy decision of the European Commission. For the

purposes of providing Covered Books and Records to UBS AG London Branch, the adequacy decision

of the European Commission currently in effect in respect of the UK

31

 allows transfers of personal

data from the EEA, including Germany, to the UK to be made freely. Any transfer from UBS ESE to

UBS AG London Branch would therefore be permitted without limitation (provided that the disclosure

otherwise complied with the EU GDPR). 

1.13

It should be noted that under Article 44 sent. 1, Recital 101 of the EU GDPR any onward transfer of

UBS ESE’s Covered Books and Records by UBS AG London Branch to the SEC is still subject to the

transfer requirements of the EU GDPR. In this regard it is helpful that the European Commission’s

adequacy decision for the UK addresses onward transfers from the UK and notes that the regime on

international transfers under the UK GDPR and UK DPA 2018 is “

in

substance identical

” to the

transfer regime under the EU GDPR.

32

 The primary options available to UBS AG London Branch

pursuant to this EU GDPR restriction applicable to data originating from UBS ESE when disclosing

the UBS ESE’s Covered Books and Records to the SEC in the US are as follows:

(a)

Derogations (Article 49 EU GDPR)

: Where a transfer mechanism adopted by the European

Commission in respect of the US is not available (as is currently the case), derogations for

specific situations from the transfer prohibition are potentially available under EU GDPR for

facilitating UBS AG London Branch’s transfer of personal data contained in UBS ESE’s

Covered Books and Records to the SEC. 

These derogations include:

(i)

Consent

: relying on consent to enable an international transfer requires that UBS ESE

has (A) explicitly stated to the Rights Holder that the data protection level at the

recipient is not comparable to the data protection level in Germany, noting that the

controller will not be able to ensure that an adequate level data protection level is

achieved by using a transfer mechanism available under the EU GDPR, with the result

that their personal data will not be subject to data protection that is equivalent to that

established under the EU GDPR, and (B) included in the consent form a description

of the data protection laws and practices in the recipient country (i.e. in this case, the

US), so that the data subject is in a position to make an informed decision

33

;

34

 and 

(ii)

legitimate interests:

 a data transfer on the basis of legitimate interests may only take

place if (A) the transfer is not repetitive, (B) concerns only a limited number of data

subjects, (C) is necessary for the purposes of compelling legitimate interests pursued

31

Commission Implementing Decision

of 28.6.2021

pursuant to Regulation (EU) 2016/679 of the European Parliament and of the

Council

on the

adequate protection of personal data by the United Kingdom. Please note that in the future the adequacy decision may be withdrawn, not

prolonged or restricted and that the current adequacy decision is limited to four years.

32

Paragraph 2.5

.7, recitals

(74) and (75) of

the

Commission Implementing Decision

of 28.6.2021

pursuant to Regulation (EU) 2016/679 of the

European Parliament and of the Council on the adequate protection of personal data by the United Kingdom.

33

[

Local guidance – source to be added

]

34

Please note that valid consent is assumed in Assumption

0036335-0000808 UKO1: 2005527215.20

14

by UBS ESE, (D) UBS ESE’s legitimate interests are not overridden by the interests

or rights and freedoms of the Rights Holder, (E) UBS ESE has assessed all the

circumstances surrounding the data transfer and (F) UBS ESE has, on the basis of that

assessment, provided suitable safeguards with regard to the protection of personal

data. UBS ESE must inform the Data Protection Authority of the State of Hesse (being

UBS ESE’s supervisory authority for data protection) of the transfer. UBS ESE must,

in addition to providing the information referred to in Articles 13 and 14 EU GDPR,

inform the data subject of the transfer and of the compelling legitimate interests

pursued. 

Each of the consent and legitimate interest derogations need to be applied on a case-by-case

basis.

35

We note that the derogation that the transfer is strictly necessary for important reasons of

public interest will likely not be applicable from a German data protection perspective. 

(b)

BaFin route

: In certain situations, for example where UBS ESE considers the transfer of data

to UBS AG London Branch for the purpose of providing information to the SEC to be high

risk, it may be possible to arrange for the disclosure to be made to BaFin, which could then

transfer the data to the SEC in the US.

36

 This route would avoid UBS ESE and UBS AG being

responsible for ensuring the international onward transfer was fully compliant with Article 44

sent. 1, Recital 101 of the EU GDPR.

1.14

Access to Covered Books and Records granted to the SEC in the course of On-Site Inspections would

not entail UBS ESE effecting an international transfer and so restrictions in Chapter V of the EU

GDPR would not apply to that situation. 

2.

BANKING SECRECY PRINCIPLE (

BANKGEHEIMNIS

)

General considerations

2.1

Note that the banking secrecy principle is only relevant for UBS ESE where the contractual

relationships with the customers are governed by German law.

2.2

According to the German banking secrecy principle (the

German Banking Secrecy Principle

), a

credit institution, such as UBS ESE, is obliged to treat any client-related information as being

confidential and to disclose this information only on a need to know basis

by

applying strict

safeguarding measures. In Germany, the banking secrecy principle is primarily a matter of contract

law. It is not codified in the German civil code (

Bürgerliches Gesetzbuch

) or other laws. However,

according to the jurisprudence of the German Federal High Court (

Bundesgerichtshof

), the German

Banking Secrecy Principle constitutes an ancillary obligation of the banking contract between the bank

and its customer and forms therefore part of each contractual banking relationship between a German

bank and its customers governed by German law. In recognition of that fact, the duty to observe the

German Banking Secrecy Principle has been incorporated in No. 2(1) of the standard General Terms

and Conditions for Banks (

Allgemeine Geschäftsbedingungen

 –

AGB-Banken

). 

2.3

Against this background, the German Banking Secrecy Principle does not differentiate between

(i) customer data; and (ii) data of natural persons or legal entities, provided that the data are obtained

by UBS ESE on the basis or within the context of its customer business/contractual relationship.

2.4

Though, on the one hand, it is undisputed that each bank can generally modify the AGB-Banken for

their own purposes, it is on the other hand unclear to what extent the German Banking Secrecy

Principle can be waived by such modification. It can be expected that there is a customary law

35

Article 49(1) EU GDPR at sentence

1 paragraph (a) and sentence

2, respectively.

36

See

Article

48 EU GDPR.

0036335-0000808 UKO1: 2005527215.20

15

foundation (

Gewohnheitsrecht

) to the German Banking Secrecy Principle, according to which such

principle is such an essential part of the relationship between a bank and its client that it cannot be

carved out. For clarification purposes, we would therefore like to highlight that a mere deletion of

No. 2(1) AGB-Banken would not result in the German Banking Secrecy Principle being inapplicable.

Scope of protection under the German Banking Secrecy Principle

2.5

The German Banking Secrecy Principle applies in respect of all business and private information on

the client obtained by a bank on the basis or within the context of its client business/contractual

relationship, i.e. not only personal data. Furthermore, the German Banking Secrecy Principle applies

to all outward as well as inward processes of the bank. Hence, even inside the bank only those

individuals which have a legitimate interest may have access to the data subject to the German Banking

Secrecy Principle (“need to know” principle).

2.6

Anonymised data (i.e. data that has been amended in such a way that it is technically impossible to

trace it back to specific persons or is only possible with disproportionate effort) or redacted data are

not included in the scope of the German Banking Secrecy Principle and can be transferred to third

parties without further restrictions related to the bank secrecy.

2.7

Consequently, where Covered Books and Records do not contain any relevant forms of business and

private information on the client obtained by UBS ESE on the basis or within the context of its client

business/contractual relationship (e.g. transaction data such as volumes and prices) the German

Banking Secrecy Principle will not apply, and hence UBS ESE can share the information without

customer consent.

Sharing of information – general limitations on sharing of information within the scope of the German

Banking Secrecy Principle

2.8

As a general remark, it should be noted that there is neither case law nor legal literature discussing in

detail the limits of the German Banking Secrecy Principle if it comes to sharing information with US

authorities such as the SEC. This is probably mainly due to the fact that traditionally data protection

rules were stricter than the banking secrecy limits and that there are few instances where data sharing

results in damages to the customer which would justify a legal proceeding. Therefore, it seems very

difficult to precisely determine to what extent data may be shared with SEC for the purpose of the

registration as an SBSD in the US.

2.9

According to No. 2(1) of the AGB-Banken which incorporates the general principles developed on the

German Banking Secrecy Principle UBS ESE may share information falling within the scope of the

German Banking Secrecy Principle only if:

(a)

required by law,

(b)

the client has consented to the disclosure, or

(c)

the bank is authorised to provide a bank notification requested by another bank (

Bankauskunft

)

(cf. No. 2(1) sent. 1 AGB-Banken).

37

Sharing of information if “required by law” – assessment

2.10

Although information contained in the Covered Books and Records or obtained through On-Site

Inspections is covered by the German Banking Secrecy Principle, it may be shared if there is a legal

obligation/requirement to do so, i.e. where a law to which the bank is subject to requires that the

information shall be disclosed (

Legal Requirement

). Such Legal Requirements are included, inter

37

As the third option mentioned in the AGB

-

Banken, disclosing data

on the basis of a bank notification

, is not relevant in the case at hand, it is not

further discussed in this opinion. 

0036335-0000808 UKO1: 2005527215.20

16

alia, in German tax, criminal law, AML and regulatory law provisions (c.f.

Kümpel/Mülbert/Früh/Seyfried, Bank- und Kapitalmarktrecht, No. 2 AGB-Banken: Bankgeheimnis

und Bankauskunft, Recital 3_254).

2.11

As far as it is based on Legal Requirements, a data-sharing request does not contradict the German

Banking Secrecy Principle. However, the question is whether these considerations can also be applied

in the case at hand where the information request is not

per se

 based on German law, but on foreign

law:

Sec 44(1) of the German Banking Act as Legal Requirement

2.12

Pursuant to Sec. 44(1) of the German Banking Act (

Kreditwesengesetz

–

KWG

), BaFin and the ECB

have the power to request from institutions information about all business activities, documentation

and, if necessary, copies, and also to perform on-site inspections. Consequently, the disclosure of

information based on this provision does not contradict the German Banking Secrecy Principle. 

2.13

However, this specific power is only available to BaFin and the ECB to oblige UBS ESE to disclose

client-related information vis-à-vis BaFin and the ECB themselves. It is not clear whether this power

applies equally to investigations conducted by the ECB to support foreign regulators such as SEC

because

BaFin and

the

ECB

are

subject to professional secrecy requirements when sharing

information. In any event, Sec. 44(1) KWG would only allow measures undertaken by BaFin and the

ECB to support SEC, but by no means measures undertaken by SEC directly. As this opinion is

focussed on the latter, Sec. 44(1) KWG will not constitute a sufficient legal basis in the case at hand.

17 CFR 240.18a-6(g)

as Legal Requirement

2.14

Pursuant to 17 CFR 240.18a-6(g)a non-resident security-based swap dealer and non-resident major

security-based swap participant applying for registration must provide the SEC access to Books and

Records and must allow for On-Site Inspections. This might justify the sharing of information with

UBS AG London Branch for the purpose of providing information to the SEC or with the SEC in the

course of On-Site Inspections in Germany.

2.15

In general, only legal requirements to which UBS ESE is directly subjected may justify the disclosure

and sharing of client-related information with UBS AG London Branch for the purpose of providing

information to the SEC or with the SEC in the course of On-Site Inspections in Germany. UBS ESE

is primarily authorised and supervised in Germany and therefore subject to local rules. We are not

aware of any legal literature or case law dealing with the question of whether foreign statute may

justify the disclosure of information subjected to the German Banking Secrecy Principle. Therefore, it

is uncertain, whether such a US rule may justify the disclosure of client-related information. 

Order of a court / administrative order as Legal Requirement

2.16

Legal literature considers an order of a foreign court to be sufficient to override the legal duties of the

German Banking Secrecy Principle. This should also apply to the disclosure of information in the

event of a request for information from a foreign authority, provided that this is enforceable in

Germany or where for example, the foreign authority has prosecutorial powers (c.f. Wech, das

Bankgeheimnis, p. 458; Canaris, Bankvertragsrecht, Recital 62). 

0036335

-

0000808 UKO1: 2005527215.20

17

2.17

In the case of the SEC, SEC measures are generally not enforceable in Germany and the SEC does not

have prosecutorial powers in Germany. Therefore, as in the case of US law, it is unclear whether an

SEC order can justify sharing of data. However, in any event, to rely on this exception, UBS ESE

would need to balance its interests in complying with the SEC’s disclosure request against the German

Banking Secrecy Principle and UBS ESE must satisfy itself that the customer interests do not outweigh

its own; this needs to be assessed in practice on a case-by-case basis (c.f. Canaris, Bankvertragsrecht,

Recital 62).

BaFin

MoU as Legal Requirement

38

2.18

Pursuant to Article IV paragraph 44 of the BaFin MoU, the SEC is able do directly request Books and

Records when necessary to fulfil its regulatory mandate or to conduct On-Site Inspections. However,

in this regard we note the following: (i) The BaFin MoU is a public law arrangement. It is unclear

whether it can have an effect on the German Banking Secrecy Principle which is, as set out above,

rooted in civil law. (ii) More importantly, pursuant to Article II paragraph 28 of the BaFin MoU, the

BaFin MoU “

does not create any legally binding obligations, confer any rights or supersede domestic

laws, nor should it be construed as an agreement to limit the protection and safeguards provided by

the laws applicable to the authorities and does not confer upon any person the right or ability, directly

or indirectly, to obtain, suppress, or exclude any information or to challenge the exchange of

information under this MoU

”

.

Consequently, the BaFin MoU lacks the authority of statue. 

2.19

Nevertheless, whilst the position is not free from doubt, in our view one could well argue that the

combination of the BaFin MoU, the US laws and the SEC orders justify the sharing of data from a

banking secrecy perspective.

2.20

Sharing of information in case of “consent” – assessment

2.21

In case there is no Legal Requirement on the basis of which client-related information sharing can be

justified, sharing of client data protected by the German Banking Secrecy Principle may only be based

on customer consent.

2.22

Customer consent exists in the form of implied or explicit consent: There are recognised circumstances

in which the sharing and disclosure of client-related data is in the interest of the relevant client. In such

cases, the German Banking Secrecy Principle shall not prevent the disclosure or sharing of client-

related data as the sharing of customer data is justified by implied consent (

konkludente Einwilligung

).

Otherwise, explicit consent would be required.

Explicit consent

2.23

Generally speaking, explicit consent can always justify information sharing. Such explicit consent

must be provided on a case-by-case basis for the duration of the contractual relationship. This means,

that a consent in form of a more general consent, i.e. consent allowing the transfer of information to

the US in any circumstance may not be sufficient. Please note that we have assumed at Assumption

of

 that UBS ESE has validly obtained such explicit consent.

Implied

consent (disclosure of information in the clients’ interest)

2.24

In an economy of scale with regard to the provision of services by UBS ESE and the receipt of services

by the customers, the sharing of information is a key requirement for the efficient running of a banking

business. The German Banking Secrecy Principle shall not compromise this (c.f. WM 2000, p. 503).

Therefore, it is recognised that the sharing of information can be justified by implied consent where

such sharing of information is, from a broader perspective, in the interest of the customers. This

requires, however, a balancing of interests.

38

The ECB MoU contains similar rules.

0036335-0000808 UKO1: 2005527215.20

18

2.25

As a consequence of the registration of UBS AG as a SBSD in the US, we understand that the customer

benefits by having access to a wider range of products. While not being a typical case of sharing of

information for an economy of scale, we nevertheless believe that one can well argue that such benefits

can form the basis of an implied consent. 

2.26

However, as mentioned, to rely on this exception, UBS ESE must balance its interests in complying

with the SEC’s disclosure request against the principle of the German Banking Secrecy Principle and

UBS ESE must satisfy itself that those interests do not outweigh its own. While this would need to be

assessed on a case-by-case basis, it seems that, as a matter of principle, for those clients who personally

make use of the opportunities resulting from the access to SBS transactions, such benefits may

outweigh the data sharing. 

Potential sanctions in case of a breach of the German Banking Secrecy Principle – Overview

2.27

A breach of banking secrecy has civil law consequences for UBS ESE. It entitles the customer to

terminate the contract with UBS ESE without notice (c.f. No. 18(2) AGB-Banken) as well as to claims

for damages, injunctive relief and claims for restitution or deletion of the data.

2.28

Note that a successful claim for breach of banking secrecy must demonstrate that there has been an

unauthorised use of confidential information to the detriment of the Rights Holder, i.e. the customer.

3.

PRINCIPLE OF TERRITORIALITY

3.1

According to the general territorial principle of international law, a state that wishes to take action

outside its sovereign borders is, as a general rule, referred to private law, because the territorial

principle of international law limits the validity of its sovereign acts to its national territory. In this

respect, the SEC is in principle not authorized to take sovereign action, including On-Site Inspection

and obtaining access to Covered Books and Records, in Germany. However, such a permission can be

found in an MoU between BaFin and the SEC. While this MoU is non-binding, in our view it should

allow those actions to be taken without a breach of the general territorial principle.

***

0036335-0000808 UKO1: 2005527215.20

19

ANNEX 2

ASSUMPTIONS

This opinion relies on the following assumptions:

1.

UBS AG has a “prudential regulator” as defined by Section 3 of the US Securities Exchange Act of

1934 (the

Securities Exchange Act

). As such, the Covered Books and Records considered in this

opinion are limited to what a prudentially regulated SBSD must be able to share with the SEC. 

2.

Additionally, in accordance with SEC Guidance at 85 FR 6297, books and records pertaining to SBS

transactions entered into prior to the date that UBS AG submits an application for registration are not

Covered Books and Records. 

3.

Where transfers of personal data are made to the SEC in the absence of an adequacy determination,

such disclosure will be made in compliance with Articles 44

et seq.

 of the EU GDPR and limited to

what is necessary for the purpose of the transfer (i.e. compliance with the principle of data

minimisation, e.g. by applying less intrusive processing activities such as redaction).

4.

UBS ESE or, as the case may be, UBS AG has obtained any necessary prior consent of the persons

(e.g

.

, counterparties, employees) whose information is or will be included in Covered Books and

Records in order to provide the SEC with access to its Covered Books and Records or to allow On-

Site Inspections, to the extent, as considered in this opinion, such consent would constitute valid

consent and such consent has not been withdrawn. Insofar as Covered Books and Records relate to

employees of UBS ESE, such employees are “associated persons” of UBS AG for purposes of 17 CFR

§ 240.18a-5(b)(8) who have agreed to sharing of their personal/employment information with the SEC

in the event of a request for information from the SEC. 

5.

Any data held by UBS ESE that is subject to a disclosure request from the SEC, either by way of

access or On-Site Inspection, will be held by UBS ESE in Germany. Whilst UBS ESE will be subject

to direct On-Site Inspection by the SEC in Germany, UBS ESE will provide access to its Covered

Books and Records (beyond On-Site Inspections) to UBS AG London Branch, rather than providing

this access directly to the SEC. 

6.

The SEC will restrict its information requests for, and use of, any information pursuant to its access to

Covered Books and Records and On-Site Inspections to only the information that it requires for the

legitimate and specific purpose of fulfilling its regulatory mandate and responsibilities by evaluating

compliance with legal obligations designed to ensure the proper legal administration of SEC-regulated

firms (which includes regulating, administering, supervising, enforcing and securing compliance with

the securities or derivatives laws in its jurisdiction) and to prevent and/or enforce against potential

illegal behaviour. 

7.

Similarly, UBS ESE will ensure that its disclosures are compliant with the data protection principles

set out in Article 5 of the EU GDPR.

39

 We understand that UBS’ general experience in responding to

information requests from the SEC (or other US and non-US regulators) leads it to maintain a belief,

which it considers to be reasonable, that UBS ESE can and (subject to any changes in applicable law

and regulation and/or the approach of relevant regulators, including the competent German data

protection authorities) will continue to be able to comply with these data protection principles in the

course of making disclosures of the sort required when providing access to Covered Books and

Records and submitting to On-Site Inspection.

40

8.

It is the SEC’s practice to limit the type and amount of personal data it requests during examinations

to targeted requests based on risk and related to specific clients and accounts, and employees. The

39

These principles are set out in

 at paragraph

40

See the

SEC

G

uidance at 85 FR 6298

.

0036335-0000808 UKO1: 2005527215.20

20

requested information may include some limited criminal records data and ‘special category data’

under the EU GDPR (as described in paragraph

 of

 to this opinion). We understand that

this aligns with UBS’ general experience in responding to information requests from the SEC, leading

it to maintain a belief, which it considers to be reasonable, that this assumption is, and will remain,

accurate (subject to any changes in applicable law and regulation and/or the approach of relevant

regulators, including the competent German data protection authorities).

41

9.

Information, data and documents received by the SEC are maintained in a secure manner and, under

strict US laws of confidentiality, information about individuals cannot be onward shared save for

certain uses publicly disclosed by the SEC, including in an enforcement proceeding, pursuant to a

valid and non-exempt US Freedom of Information Act (

FOIA

) request,

42

 pursuant to a lawful request

of the US Congress or a properly issued subpoena, or to other regulators who have demonstrated a

need for the information and provide assurances of confidentiality.

10.

UBS ESE has policies in place directing its staff not to UBS ESE’s communication services

(e.g. business e-mail accounts, telephones, chat services, etc.) for private purposes, and directing its

staff not to use private communication services for business purposes.

11.

All terms of business entered into with clients conducting SBS transactions contain clear statements

such that clients are aware that that regulatory oversight will be exercised by regulatory authorities

and that information regarding their transactions, including their personal data, can be disclosed to

regulatory authorities (for example, clause 10, and in particular clause 10(b) of the terms of business

for professional clients and eligible counterparties (March 2019)

43

).

12.

UBS AG does not include the information described in 17 C.F.R. §§.18a-5(b)(8)(i)(A) through (H) or

240.18a-5(a)(10)(i)(A) through (H), as the case may be, in questionnaires or applications for

employment executed by an associated person who is not a US Person (as defined in 17 C.F.R.

§240.3a71-3(a)(4)(i)(A)), unless UBS AG is required to obtain such information under applicable law

in the jurisdiction in which the associated person is employed or located or obtains such information

in conducting a background check that is customary for UBS AG in that jurisdiction and the creation

or maintenance of records reflecting that information would not result in a violation of applicable law

in the jurisdiction in which the associated person is employed or located.

***

41

See the

SEC

G

uidance at 85 FR 6298

.

42

We do not give any views in the opinion to matters of US law, though we understand that information can be

made public pursuant to requests

under the US FOIA, and that certain information is exempt from such requests, including (among others): (1) a trade secret or privileged or

confidential commercial or financial information obtained from a person; (2) a personnel, medical, or similar file the release of which would

constitute a clearly unwarranted invasion of personal privacy; (3) information compiled for law enforcement purposes, the release of which (a)

could reasonably be expected to interfere with law enforcement proceedings; (b) would deprive a person of a right to a fair trial or an impartial

adjudication; (c) could reasonably be expected to constitute an unwarranted invasion of personal privacy; (d) could reasonably be expected to

disclose the identity of a confidential source; (e) would disclose techniques, procedures, or guidelines for investigations or prosecutions; or (f)

could reasonably be expected to endanger an individual's life or physical safety; (4) contained in or related to examination, operating, or condition

reports about financial institutions that the SEC regulates or supervises.

43

Available at:

https://www.ubs.com/global/en/investment-bank/regulatory/_jcr_content/mainpar/toplevelgrid/col1/linklist_1815406319/

link.1894740908.file/PS9jb250ZW50L2RhbS9JbnZlc3RtZW50QmFuay9kb2N1bWVudHMvaWJ0ZXJtcy90ZXJtcy1vZi1idXNpbmVzcy5wZ

GY=/terms-of-business.pdf

.

0036335-0000808 UKO1: 2005527215.20