Which principle about safeguarding privacy and data should an auditor adhere to when performing an...

An auditor who performs an AML investigation should adhere to the principle that AML and Data Protection Privacy laws should not be mutually exclusive. This means that the auditor should respect and protect the personal data of the individuals involved in the investigation, while also complying with the AML obligations and requirements. The auditor should balance the legitimate interests of preventing and detecting money laundering and terrorist financing with the fundamental rights and freedoms of the data subjects, and apply the data protection principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality.

The auditor should also take into account the relevant legal frameworks and guidance on data protection and AML, such as the EU General Data Protection Regulation (GDPR), the EU Anti-Money Laundering Directive (AMLD), the Council of Europe Convention 108+ on data protection, and the Guidelines on data protection for the processing of personal data for AML/CFT purposes issued by the Consultative Committee of the Convention 108+. The auditor should also cooperate and consult with the data protection authorities and the AML authorities, as appropriate, to ensure compliance and consistency.