Bank secrecy in the light of the Criminal Procedure Law Amendment Act 2024

Authors: Laura Baumgartner-Viechtbauer, Simon Scherzer

Among other things, the Criminal Procedure Law Amendment Act 2024 introduced comprehensive new regulations on seizure and confiscation – in particular also regarding the confiscation of data storage devices (see in more detail: Seizure and confiscation of data storage devices: a look at the new draft law!). As part of this, the existing regulations on the provision of information from the Accounts Register and on bank accounts and banking transactions pursuant to section 116 of the Code of Criminal Procedure (StPO) were also reformed. The resulting changes to the Code of Criminal Procedure came into effect on January 1st, 2025.

The aim of the legislator was to establish a legal framework in accordance with the requirements of the Constitutional Court (VfGH 12/14/2023, G 352/2021), to strengthen the rights of the accused and victims, and to increase the efficiency and acceleration of investigation proceedings.

Bank secrecy is also affected by the changes

The far-reaching changes introduced by the Criminal Procedure Law Amendment Act 2024 also affect bank secrecy pursuant to section 38 BWG (Banking Act). This is of central importance in the Austrian legal system, as it legally obliges credit institutions not to disclose or use certain confidential information that has been entrusted or made accessible to them solely on the basis of the business relationship (section 38 para. 1 BWG). Section 38 BWG thus serves both the customer’s interest in confidentiality and the credit institution’s interest, as this statutory right to refuse to provide information (including to authorities) constitutes an essential basis for customers to place the necessary trust in the bank.

Only in the exceptional cases provided for by law (section 38 para. 2 BWG) is there no obligation to maintain bank secrecy. For example, in a criminal proceeding vis-à-vis public prosecutors and courts in accordance with section 116 and section 210 para. 3 of the Code of Criminal Procedure. Credit institutions must adhere meticulously to these legal requirements in order not to risk violating bank secrecy and thereby possibly being exposed to considerable – even criminal – sanctions (cf. section 101 BWG).

The significance of the amendments to section 116 StPO for credit institutions and the accused

The provision of information from the Accounts Register and information about bank accounts and banking transactions (section 116 StPO) have already been key investigative tools for breaking through bank secrecy. Information from the Accounts Register provides investigating authorities with information on formal account data, such as the identity of the account holder, existing powers of disposal, and the existence of an account in general (“external account data“). In contrast, information on bank accounts and transactions enables the “opening of the account” and thus access to more detailed information, such as insight into account statements, transaction data, or other information about business relationships (“internal account data“) and therefore goes far beyond the information from the Accounts Register.

The formal requirement for ordering information from the Accounts Register is an order issued by the public prosecutor’s office (section 116 para. 3 StPO). However, as a more intrusive measure, information on bank accounts and banking transactions, must be ordered by the public prosecutor’s office on the basis of a court authorization (section 116 para. 4 StPO). Previously, in the case of a request for information about bank accounts and transactions, the court-authorized order (also) had to be addressed to and served on the credit institution affected by the investigative measure (section 116 para. 4 (2) as amended by Federal Law Gazette I No. 27/2018). Accordingly, the credit institution previously also had the option of lodging an appeal against the court authorization and thereby challenge the intrusion into bank secrecy (section 38 para. 2 (1) BWG) as unlawful on the grounds of lacking formal or substantive requirements (section 116 paras. 1, 2, and 4 StPO). This appeal had suspensive effect (section 116 para. 6 as amended by Federal Law Gazette I No. 27/2018). To protect the interests of their clients and avoid the risk of significant sanctions due to a possible breach of bank secrecy, credit institutions regularly exercised their right to appeal after thoroughly reviewing the order.

Under the new legal framework in force since January 1st, 2025, the public prosecutor’s office must, on a case-by-case basis, issue a separate order to the credit institution assigning the duty to cooperate pursuant to section 116 para. 6 StPO, specify the scope of cooperation, and, if necessary, order the confidentiality of the facts and circumstances associated with the order and the court authorization. This order now only needs to refer to the court authorization. Through this prosecutorial order pursuant to section 116 para. 6 StPO, the credit institution is now separately assigned the duty to cooperate on a case-by-case basis, including the scope of such cooperation and any confidentiality obligations. This constitutes a separate order that must be issued independently of the court execution order under section 116 para. 4 StPO in order to trigger the bank’s duty to cooperate. This means that, unlike under the previous legal framework, obligations do not arise for the credit institution solely on the basis of the court authorization, and it is therefore not directly affected by a coercive measure. As a consequence, the credit institution is no longer entitled to file a complaint against the court authorization for the disclosure of information on bank accounts and transactions.

The legislator justifies this new regulation with the aim of accelerating proceedings and protecting the confidentiality interests of the accused. In particular, the aim is to prevent the credit institution from gaining information about the grounds for suspicion, including detailed reasons, and thus gaining access to personal data. At first glance, these data protection aspects may appear promising. The fact is, however, that such a new regulation offers no tangible advantages for the accused. By eliminating the possibility for a (largely) external third party (the credit institution), which previously had to separately review the investigative authorities’ order, to lodge a complaint, sensitive data is now disclosed to the authorities without any possibility of legal protection. This limited legal protection becomes even more apparent when considering that, as under the previous legal framework (cf. section 116 para. 5 StPO as amended by Federal Law Gazette I No. 27/2018), the delivery of the court-approved order to the accused can be postponed (until after the information has been provided) if the purpose of the investigation would otherwise be jeopardized (section 116 para. 5 StPO).

Disclaimer

This article is for general information only and does not replace legal advice. Haslinger / Nagele Rechtsanwälte GmbH assumes no liability for the content and correctness of this article.