HGB §333
Violation of Confidentiality Obligations
Verletzung der Geheimhaltungspflicht
The HGB criminal provision penalising unauthorised disclosure or use of trade and business secrets learned during an audit.
1
Conceptual Framework Linkage
THE FLIP SIDE OF §332: where §332 punishes an auditor for disclosing TOO LITTLE or falsely – concealing findings or issuing a false opinion – §333 punishes the opposite failure: disclosing something that should have stayed confidential. Together they define the two boundaries of the SAME trust relationship the audit apparatus (§§316–324a) exists to protect.
Protecting what should stay private, not what should be made public
Every provision this series has documented about disclosure, transparency, and true-and-fair views assumes information SHOULD reach the public. §333 protects the necessary exception: an auditor's privileged access to a company's most sensitive internal information – trade secrets, business plans, commercially sensitive detail – comes WITH an obligation to keep it confidential, breach of which is itself a criminal offence.
HOW §333 MAPS TO GERMAN ACCOUNTING PRINCIPLES
Trust as a two-way obligation – the audit relationship this series has documented depends on the AUDITED company trusting the auditor with sensitive access, exactly as much as the PUBLIC trusts the auditor's own opinion Consistency with parallel company-law offences – §333 mirrors comparable confidentiality-protection provisions under AktG §404 and GmbHG §85, reflecting a broader, coordinated confidentiality-protection theme across German company law generally
What §333 covers, at a glance
§Core content
333(1)Unauthorized disclosure of a trade/business secret learned during the audit (up to 1 year)
333(2) S.1Aggravation for consideration, enrichment, or harm intent (up to 2 years)
333(2) S.2A separate offence: unauthorized USE/exploitation of the same secret (up to 2 years)
Genuinely important procedural point: this is an ANTRAGSDELIKT – see Section 11.
2
Scope – Auditors, Assistants, and Enforcement-Panel Staff
A Sonderdelikt, with a later-added second Täterkreis
§333's PRIMARY Täterkreis mirrors §332's – the Abschlussprüfer (statutory auditor) or their Gehilfe (assistant), established across the earlier Audit poster. A LATER amendment extended §333 to ALSO cover employees of a Prüfstelle (the Financial Reporting Enforcement Panel established under §342b – briefly noted at the very start of this HGB project's structural overview, but not yet covered in detail in this poster series) who improperly disclose information learned during their own review activity.
3
§333(1) – the Base Offence
Unauthorized disclosure of a secret learned during the audit
§333(1) criminalises an auditor or their assistant who, WITHOUT authorization, discloses a secret (Geheimnis) – specifically a Betriebs- oder Geschäftsgeheimnis (trade or business secret) – that became known to them IN THEIR CAPACITY as auditor DURING the audit of the Jahresabschluss, an Einzelabschluss under §325(2a) (the same cross-reference flagged with appropriate care in the previous poster), or the Konzernabschluss – punishable by imprisonment of up to ONE YEAR or a fine.
4
Four Categories of Protected Company – a Deliberate Callback to Earlier Posters
The exact same consolidation-relationship definitions established throughout this series
§333(1) protects secrets belonging to FOUR distinct categories of company, EACH directly reusing a definition established earlier in this poster series:
The Kapitalgesellschaft itself – the company being audited A Tochterunternehmen (§290(1)-(2)) – a subsidiary under the control tests established in the very first Konzernabschluss poster A gemeinsam geführtes Unternehmen (§310) – a jointly-managed enterprise under the proportionate consolidation Titel An assoziiertes Unternehmen (§311) – an associated company under the equity method Titel
This is a genuinely elegant piece of drafting: rather than redefining these relationships from scratch, §333 simply POINTS BACK to the same definitions this entire poster series has already documented in detail, extending confidentiality protection across the FULL range of group relationships an auditor's work might touch.
5
Worked Example – Disclosing a Subsidiary's Trade Secret
Protection extends throughout the group, not just to the audited parent
Example 1: Disclosing a subsidiary's confidential manufacturing process
During a Konzernabschluss audit, an auditor gains detailed knowledge of a specific, confidential manufacturing process used by one of the parent's subsidiaries – a genuine trade secret with real commercial value. The auditor later mentions specific details of this process, without authorization, in a conversation with an acquaintance at a competing firm.
Even though the disclosed secret belongs to the SUBSIDIARY rather than the parent company being directly audited, §333(1) still applies – the protection explicitly extends to a Tochterunternehmen under §290(1)-(2), exactly as established in the earlier Konzernabschluss poster series, satisfying the base offence and exposing the auditor to imprisonment of up to one year or a fine.
6
The Prüfstelle Extension – Protecting Enforcement-Review Information Too
Extending confidentiality protection beyond the ordinary audit itself
A later amendment extends §333(1) to ALSO cover an employee of a Prüfstelle (per §342b(1) – the Financial Reporting Enforcement Panel briefly identified in this series' very first structural overview of HGB Book 3, though not yet covered in a dedicated poster) who, without authorization, discloses a trade/business secret or other company insight learned during a FORMAL enforcement review – a genuinely separate function from the ordinary statutory audit, but one carrying comparable access to sensitive company information, and therefore warranting the SAME confidentiality protection.
7
Worked Example – an Enforcement-Panel Employee's Improper Disclosure
The same protection, a genuinely different role
Example 2: A Prüfstelle staff member sharing information from an enforcement review
During a formal enforcement review of a company's Jahresabschluss (the kind of review the Prüfstelle established under §342b conducts), a Prüfstelle employee learns significant, non-public detail about the company's internal restructuring plans, and later shares this information, without authorization, with a friend working in financial media.
The Prüfstelle employee, though NOT an auditor or auditor's assistant in the ordinary sense, falls WITHIN the extended §333(1) Täterkreis specifically for information learned during their own review activity – the unauthorized disclosure satisfies the same offence, reflecting the legislature's judgement that this genuinely different oversight function warrants equivalent confidentiality protection.
8
§333(2) Sentence 1 – Aggravation for Consideration, Enrichment, or Harm
A familiar aggravation structure, now applied to confidentiality
§333(2) sentence 1 raises the maximum penalty to TWO years' imprisonment (or a fine) where the offender acts FOR CONSIDERATION or with intent to ENRICH themselves or another, or to HARM another party – precisely the same aggravation structure this series has now seen in both §332(2) sentence 1 (the auditor's own accuracy offence) and, in spirit, the general Entgelt/Bereicherungsabsicht pattern running through this whole Subsection.
9
§333(2) Sentence 2 – a Genuinely Distinct Prohibited Act: Unauthorized USE
Not merely telling someone else – actually exploiting the secret oneself
§333(2) sentence 2 supplies a GENUINELY SEPARATE prohibited act, reaching the SAME two-year maximum: unauthorized USE or exploitation (unbefugt verwertet) of the SAME kind of secret – distinct from mere disclosure. An auditor who never tells anyone else about a secret, but personally TRADES on it (for instance, using confidential knowledge of an impending negative development to sell their own shares before the information becomes public) commits THIS specific variant, even absent any disclosure to a third party at all.
10
Worked Example – Contrasting Disclosure and Exploitation
Two different auditors, two different variants of the same underlying offence
Example 3: One auditor tells a competitor, another trades on the secret personally
Auditor A learns of a client's confidential, imminent product launch during an audit, and shares the specific details with a competing company for a fee. Auditor B, on a different engagement, learns of a client's confidential upcoming loss announcement and, WITHOUT telling anyone else at all, personally sells a substantial personal shareholding in the client company before the loss becomes public.
Auditor A commits UNAUTHORIZED DISCLOSURE under §333(1), aggravated to the two-year maximum under §333(2) sentence 1 given the fee received. Auditor B commits an entirely DIFFERENT variant – unauthorized USE/exploitation under §333(2) sentence 2 – reaching the SAME two-year maximum, DESPITE never disclosing the secret to anyone else at all; personally trading on confidential knowledge is itself independently criminalised.
11
The Antragsdelikt Requirement – Prosecution Only on the Company's Own Complaint
A genuinely important procedural distinction from §331, §331a, and §332
§333 is confirmed to be an Antragsdelikt – a category of offence German prosecutors do NOT pursue automatically on their own initiative, but ONLY upon a formal complaint (Strafantrag) from the AFFECTED party – here, the Kapitalgesellschaft (or the relevant subsidiary/joint/associated company) whose secret was disclosed. This reflects the legislature's judgement that the protected interest is primarily the COMPANY's own private business interest, rather than a broader public interest the state has an independent stake in vindicating regardless of the victim's own wishes – a genuinely different procedural posture than §331, §331a, and §332, all of which the state may prosecute on its own initiative.
12
Worked Example – a Company Choosing Not to Pursue Prosecution
The company's own choice genuinely controls whether the case proceeds at all
Example 4: A company preferring quiet resolution over prosecution
A company discovers its own former auditor improperly disclosed a business secret to a third party, satisfying §333(1) in principle – but the company, wishing to avoid the reputational exposure and disruption a public criminal proceeding might bring, chooses NOT to file the formal Strafantrag required to trigger prosecution.
DESPITE the underlying conduct genuinely satisfying §333(1)'s elements, prosecution does NOT proceed WITHOUT the company's own affirmative complaint – a genuinely different outcome than would apply under §331, §331a, or §332, where state prosecutors could pursue the matter regardless of the affected party's own preference.
13
§333 vs §332 – Two Boundaries of the Same Trust Relationship
Too little/wrong disclosure vs too much disclosure – genuinely opposite failure modes
§332 – Verletzung der Berichtspflicht§333 – Verletzung der Geheimhaltungspflicht
Failing to report ACCURATELY to the public/companyDisclosing what should have stayed CONFIDENTIAL
Ex officio prosecutionAntragsdelikt – company complaint required
Up to 3/5 years (with PIE aggravation)Up to 1/2 years (no PIE-specific tier)
Together, §332 and §333 mark the TWO opposite boundaries of the same underlying trust relationship an auditor holds – required to disclose enough, and accurately, to the PUBLIC and the company itself, while simultaneously required to disclose NOTHING MORE than that to anyone else.
14
Critical Judgments & Practical Difficulties
Where judgement matters most
SIGNIFICANT JUDGEMENTS
Distinguishing a genuine "Betriebs- oder Geschäftsgeheimnis" from other, less sensitive confidential information not carrying the same protection
PRACTICAL DIFFICULTIES
Determining, for a multi-entity engagement, who is authorised (Antragsberechtigt) to file the required complaint on behalf of an affected subsidiary or associated company
15
Relationship to IFRS
Confidentiality obligations sit entirely outside any accounting standard
As with every other criminal provision this series has documented, IFRS itself has no equivalent – auditor confidentiality obligations are governed by each jurisdiction's own professional ethics rules, contract law, and (where applicable) specific criminal statutes, never by an accounting standard directly. §333 completes this poster series' now-familiar theme: the audit trust relationship IFRS presupposes but never itself legislates is, in Germany, given genuine criminal-law teeth on BOTH sides – accuracy (§332) and confidentiality (§333) alike.
16
Statement Mapping
Where every §333 event lands
Event / obligationDocument affectedNotes
Unauthorized disclosure–No specific financial statement affected; the underlying company secret itself
Unauthorized use/exploitation–A genuinely separate prohibited act from disclosure
17
Related Provisions – Cross-Reference Map
How §333 connects across HGB Book 3
ProvisionNature of the connection
§290(1)-(2), §310, §311Supplies the four company-relationship definitions §333(1) protects secrets of
§342bEstablishes the Prüfstelle whose employees §333(1) extends to cover
§332The closely related but genuinely opposite-facing offence covered in the previous poster
AktG §404, GmbHG §85Comparable confidentiality-protection offences elsewhere in German company law, reflecting a coordinated legislative theme
18
Quick-Reference Glossary
Betriebs- oder Geschäftsgeheimnis
Trade or business secret – the specific category of confidential information §333 protects.
Unbefugt offenbaren
To disclose without authorization – the base prohibited act under §333(1).
Unbefugt verwerten
To use/exploit without authorization – a distinct prohibited act under §333(2) sentence 2, independent of disclosure.
Antragsdelikt
An offence prosecuted only upon a formal complaint (Strafantrag) from the affected party, not automatically by the state.
Prüfstelle
The Financial Reporting Enforcement Panel established under §342b, whose employees' confidentiality is also protected under §333's extended scope.
Antragsberechtigt
Authorized to file the complaint – a genuinely practical question in multi-entity engagements involving subsidiaries or associated companies.