Professional secrecy: Updated CSSF FAQ in case of data transfer

On 2 September 2019, a new question was added to the following FAQs published by the CSSF: the FAQ concerning the AIFM Law¹ , the FAQ concerning the UCI Law² , the FAQ on specialised investment funds (SIFs) and investment companies in risk capital (SICARs)  that do not qualify as alternative investment funds (AIFs)³ , and the FAQ on the statuses of "PFS"⁴ .

The newly added question relates to professional secrecy and its application in case of data transfer by an entity acting as central administration or depositary bank to another service provider.

In the case of data transfer to a service provider, the central administration or the depositary bank must obtain the consent from its client, i.e. the undertakings for collective investment ("UCIs"),  represented by their management body (i.e. the board of directors for a SICAV⁵) , the general partner (GP) for an SCA⁶  or an SCSp⁷ , or their management company for an FCP⁸ . This consent must cover (i) the contemplated outsourcing of services, (ii) the type of information transmitted in the context of the outsourcing, and (iii) the country of establishment of the service provider.

In the case of outsourcing with transfer of personal and confidential investor data, the management body of the UCI or the management company of an FCP must inform the investors of the UCI of the transfer of their data and permit them to object/consent through the following means:

• communication to existing investors (letter explaining the transfer of data with a possibility to object within a reasonable timeframe);
• immediate change/modification of the subscription form;
• on the first occasion: modification of the prospectus (disclosing the necessary information regarding the data transfer).

The same conditions apply to UCITS management companies and AIFMs which are authorised to act as central administration and which effectively perform that function for the UCI.