235.1
Federal Act
on Data Protection
(Data Protection Act, FADP)
Preamble
The Federal Assembly of the Swiss Confederation,
on the basis of Articles 95 paragraph 1, 97 paragraph 1, 122 paragraph 1 and 173 paragraph 2 of the Federal Constitution1,
and having considered the Federal Council dispatch dated 15 September 20172,
decrees:
Chapter 1 Purpose, Scope of Application and Federal Supervisory Authority
Art. 1 Purpose
This Act has the purpose of protecting the personality and fundamental rights of natural persons whose personal data is processed.
Art. 2 Personal and material scope of application
This Act applies to the processing of personal data of natural persons by:
private persons;
federal bodies.
It does not apply to:
personal data being processed by a natural person exclusively for personal use;
personal data being processed by the Federal Assembly and parliamentary committees as part of their deliberations;
personal data being processed by institutional beneficiaries under Article 2 paragraph 1 of the Host State Act of 22 June 20073 who enjoy immunity from jurisdiction in Switzerland.
The applicable procedural law regulates the processing of personal data and the data subject's rights in court proceedings and in proceedings governed by federal procedural regulations. This Act applies to first instance administrative proceedings.
The public registers for private legal transactions, and in particular the access to these registers and the data subject's rights, shall be regulated by the specific provisions of the applicable federal law. If the specific provisions do not contain any rules, this Act applies.
Art. 3 Territorial scope of application
This Act applies to circumstances that have an effect in Switzerland, even if they were initiated abroad.
For rights under private law, the Federal Act of 18 December 19874 on Private International Law applies. In addition, the provisions on the territorial scope of application of the Criminal Code5 are reserved.
Art. 4 Federal Data Protection and Information Commissioner
The Federal Data Protection and Information Commissioner (FDPIC) supervises the application of the federal data protection regulations.
The following are exempted from supervision by the FDPIC:
the Federal Assembly;
the Federal Council;
the federal courts;
the Office of the Attorney General of Switzerland in relation to processing personal data as part of criminal proceedings;
federal authorities in relation to processing personal data in terms of a judicial activity or proceedings for international mutual assistance in criminal matters.
Chapter 2 General Provisions
Section 1 Definitions and Principles
Art. 5 Definitions
In this Act:
personal data means any information relating to an identified or identifiable natural person;
data subject means a natural person whose personal data is processed;
sensitive personal data means:
data relating to religious, philosophical, political or trade union-related views or activities,
data relating to health, the private sphere or affiliation to a race or ethnicity,
genetic data,
biometric data that uniquely identifies a natural person,
data relating to administrative and criminal proceedings or sanctions,
data relating to social assistance measures;
processing means any handling of personal data, irrespective of the means and procedures used, in particular the collection, storage, keeping, use, modification, disclosure, archiving, deletion or destruction of data;
disclosure means transmitting personal data or making such data accessible;
profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;
high-risk profiling means profiling that poses a high risk to the data subject's personality or fundamental rights by matching data that allow an assessment to be made of essential aspects of the personality of a natural person;
breach of data security means a breach of security that leads to the accidental or unlawful loss, deletion, destruction or modification or unauthorised disclosure or access to personal data;
federal body means an authority or service of the Confederation or a person entrusted to carry out public tasks on behalf of the Confederation;
controller means a private person who or federal body which, alone or jointly with others, determines the purpose and the means of processing personal data;
processor means a private person or federal body that processes personal data on behalf of the controller.
Art. 6 Principles
Personal data must be processed lawfully.
The processing must be carried out in good faith and be proportionate.
Personal data may only be collected for a specific purpose that the data subject can recognise; personal data may only be further processed in a manner that is compatible with this purpose.
They shall be destroyed or anonymised as soon as they are no longer required for the purpose of processing.
Any person who processes personal data must satisfy themselves that the data are accurate. They must take all appropriate measures to correct, delete or destroy data that are incorrect or incomplete insofar as the purpose for which they are collected or processed is concerned. The appropriateness of the measures depends in particular on the form and the extent of the processing and on the risk that the processing poses to the data subject's personality or fundamental rights.
If the consent of the data subject is required, such consent is only valid if given voluntarily for one or more specific instances of processing based on appropriate information.
The consent must be explicitly given for:
processing sensitive personal data;
high-risk profiling by a private person; or
profiling by a federal body.
Art. 7 Data protection by design and data protection by default
The controller is obliged to arrange the data processing in technical and organisational terms so that the data protection regulations, and in particular the principles under Article 6, are respected. It shall take account of this from the planning stage.
The technical and organisational measures must in particular be appropriate with regard to the state of the art, the nature and the extent of the data processing and the risk that the processing poses to the data subject's personality or fundamental rights.
The controller is obliged to ensure by means of suitable default settings that the processing of personal data is limited to the minimum required for the purpose intended, unless the data subject specifies otherwise.
Art. 8 Data security
The controller and the processor shall guarantee a level of data security appropriate to the risk by taking suitable technical and organisational measures.
The measures must make it possible to avoid breaches of data security.
The Federal Council shall issue provisions on the minimum requirements for data security.
Art. 9 Processing by processors
The processing of personal data may be assigned by contract or by the legislation to a processor if:
the data is processed only in the manner in which the controller itself is permitted to do it; and
no statutory or contractual duty of confidentiality prohibits assignment.
The controller must satisfy itself in particular that the processor is able to guarantee data security.
The processor may only assign processing to a third party with prior approval from the controller.
It may claim the same grounds for justification as the controller.
Art. 10 Data protection officer
Private controllers may appoint a data protection officer.
The data protection officer is the contact point for the data subjects and for the authorities responsible for data protection in Switzerland. He or she has the following tasks in particular:
training and advising the private controller in matters of data protection;
providing support on applying the data protection regulations.
Private controllers may invoke the exception in Article 23 paragraph 4 if the following requirements are satisfied:
The data protection officer exercises his or her function towards the controller in a professionally independent manner and is not bound by any instructions.
He or she does not carry out any activities that are incompatible with his or her tasks as a data protection officer.
He or she has the required expertise.
The controller publishes the contact details of the data protection officer and notifies the FDPIC thereof.
The Federal Council shall regulate the appointment of data protection officers by federal bodies.
Art. 11 Code of conduct
Professional, industry and trade associations that are authorised to safeguard the economic interests of their members in their articles of association and federal bodies may submit codes of conduct to the FDPIC.
The FDPIC shall state and publish his or her opinions on the codes of conduct.
Art. 12 Record of processing activities
The controller and the processor shall each maintain a record of their processing activities.
The controller's record shall as a minimum contain:
the identity of the controller;
the purpose of processing;
a description of the categories of data subjects and the categories of processed personal data;
the categories of recipients;
if possible, the retention period for the personal data or the criteria for determining this period;
if possible, a general description of the measures taken to guarantee data security under Article 8;
if the data are disclosed abroad, details of the State concerned and the guarantees under Article 16 paragraph 2.
The processor's record shall contain information on identity of the processor and of the controller, the categories of processing carried out on behalf of the controller, and the information mentioned in paragraph 2 letters f and g.
The federal bodies shall notify the FDPIC of their records of processing activities.
The Federal Council shall provide exceptions for legal entities that have fewer than 250 employees and whose data processing poses a negligible risk of harm to the personality of the data subjects.
Art. 13 Certification
The manufacturers of data processing systems or programs and controllers and processors may have their systems, products and services evaluated by recognised independent certification bodies.
The Federal Council shall issue regulations on the recognition of certification procedures and the introduction of a data protection quality mark. In doing so, it shall take account of international law and the internationally recognised technical standards.
Section 2 Data Processing by Private Controllers with Registered Office or Domicile Abroad
Art. 14 Representative
Private controllers with registered office or domicile abroad shall appoint a representative in Switzerland if they process the personal data of persons in Switzerland and the data processing meets the following requirements:
The processing is connected with the offer of goods or services or the monitoring of the behaviour of persons in Switzerland.
The processing is on a large scale.
The processing is carried out regularly.
The processing poses a high risk to the personality of the data subjects.
The representative shall serve as the contact point for the data subjects and the FDPIC.
The controller shall publish the name and the address of the representative.
Art. 15 Duties of the representative
The representative shall maintain a record of controller's processing activities that contains the information set out in Article 12 paragraph 2.
On request, he or she shall provide the FDPIC with the information contained in the record.
On request, the representative shall provide data subjects with information on how they can exercise their rights.
Section 3 Cross-Border Disclosure of Personal Data
Art. 16 Principles
Personal data may be disclosed abroad if the Federal Council has decided that the legislation of the State concerned or the international body guarantees an adequate level of protection.
In the absence of a decision by the Federal Council under paragraph 1, personal data may be disclosed abroad only if an appropriate level of data protection is guaranteed by:
a treaty under international law;
data protection clauses in an agreement between the controller or the processor and its contractual partner, notice of which has been given to the FDPIC beforehand;
specific guarantees drawn up by the competent federal body, notice of which has been given to the FDPIC beforehand;
standard data protection clauses that the FDPIC has approved, issued or recognised beforehand; or
binding corporate rules that have been approved in advance by the FDPIC or by the authority responsible for data protection in a State that guarantees an adequate level of protection.
The Federal Council may provide for other appropriate guarantees in line with paragraph 2.
Art. 17 Exceptions
In derogation from Article 16 paragraphs 1 and 2, personal data may be disclosed abroad in the following cases:
The data subject has explicitly consented to disclosure.
Disclosure is directly connected with the conclusion or performance of a contract:
between the controller and the data subject; or
between the controller and its contractual partner in the interests the data subject.
Disclosure is necessary in order to:
safeguard an overriding public interest; or
establish, exercise or enforce legal rights before a court or another competent foreign authority.
Disclosure is necessary to protect the life or the physical integrity of the data subject or a third party, and it is not possible to obtain the consent of the data subject within a reasonable time.
The data subject has made the data generally accessible and has not explicitly prohibited processing.
The data originate from a statutory register that is public or accessible to persons with a legitimate interest, provided the statutory requirements for access are met in the case concerned.
The controller or the processor shall inform the FDPIC on request about the disclosure of personal data under paragraph 1 letters b number 2, c and d.
Art. 18 Publication of personal data in electronic form
If personal data are made generally accessible by means of automated information and communications services in order to provide information to the general public, this is not deemed to be disclosure abroad, even if the data are accessible from abroad.
Chapter 3 Duties of the Controller and of the Processor
Art. 19 Duty to provide information when collecting personal data
The controller shall inform the data subject in an appropriate manner when collecting personal data; this duty to provide information also applies if the data is not collected from the data subject.
It shall provide the data subject on collecting the data with the information required for the data subject to exercise their rights under this Act and to guarantee transparent data processing; it shall provide the following information as a minimum:
the controller's identity and contact details;
the purpose of processing;
if applicable, the recipients or the categories of recipients to which personal data is disclosed.
If the data is not collected from the data subject, the controller shall also inform the data subject of the categories of processed personal data.
If the personal data are disclosed abroad, the controller shall also inform the data subject of the State or the international body to which such data are disclosed and if applicable of the guarantees under Article 16 paragraph 2 or the application of an exception under Article 17.
If the data is not collected from the data subject, the controller shall also inform the data subject of the information specified in paragraphs 2–4 at the latest one month after receiving the data. If the controller discloses the personal data before the expiry of this deadline, it shall inform the data subject at the time of disclosure at the latest.
Art. 20 Exceptions from the duty to provide information and restrictions
The duty to provide information under Article 19 ceases to apply if one of the following requirements is satisfied:
The data subject already has the information concerned.
The processing is required by law.
The controller is a private person who is required by law to preserve confidentiality.
The requirements of Article 27 are satisfied.
If the personal data is not collected from the data subject, the duty to provide information also ceases to apply if any one of the following requirements is satisfied:
It is not possible to provide the information.
Providing the information requires disproportionate effort.
The controller may restrict, delay or dispense with the communication of the information in the following cases:
It is required to do so because of overriding third party interests.
Providing the information defeats the purpose of the processing.
The controller is a private person and the following requirements are satisfied:
The controller is required to do so because of its own overriding interests.
The controller does not intend to disclose the personal data to third parties.
The controller is a federal body and any one of the following requirements is satisfied:
The measure is required to satisfy overriding public interests, in particular to protect Switzerland's internal or external security.
The communication of the information may compromise an enquiry, an investigation or administrative or judicial proceedings.
Legal entities that belong to the same group of companies are not third parties within the meaning of paragraph 3 letter c number 2.
Art. 21 Duty to provide information in the case of an automated individual decision
The controller shall inform the data subject about any decision that is based exclusively on automated processing and that has a legal consequence for or a considerable adverse effect on the data subject (automated individual decision).
It shall on request allow the data subject to express their point of view. The data subject may request that the automated individual decision be reviewed by a natural person.
Paragraphs 1 and 2 do not apply if:
the automated individual decision is directly connected with the conclusion or the processing of a contract between the controller and the data subject and the data subject's request is granted; or
the data subject has explicitly consented to the decision being automated.
If the automated individual decision is issued by a federal body, it must designate the decision accordingly. Paragraph 2 does not apply if, in accordance with Article 30 paragraph 2 of the Administrative Procedure Act of 20 December 19686 (APA) or another federal act, the data subject is not entitled to a hearing before the decision is taken.
Art. 22 Data protection impact assessment
If processing is likely to result in a high risk to the data subject's personality or fundamental rights, the controller shall carry out a data protection impact assessment beforehand. If several similar processing procedures are planned, a joint assessment may be carried out.
The existence of a high risk, in particular when using new technologies, depends on the nature, extent, circumstances and purpose of the processing. A high risk arises in particular:
in the case of the large-scale processing of sensitive personal data;
if public areas are systematically monitored on a large scale.
The data protection impact assessment shall include a description of the planned processing, an evaluation of the risks to the data subject's personality or fundamental rights and a description of the measures to protect personality and fundamental rights.
Private controllers are exempt from having to carry out a data protection impact assessment if they are required by law to process the data.
A private controller may dispense with carrying out a data protection impact assessment if it uses a system, product or service that is certified under Article 13 for the intended use, or if it complies with a code of conduct under Article 11 that satisfies the following requirements:
The code of conduct is based on a data protection impact assessment.
It provides for measures to protect the personality and the data subject's fundamental rights.
It has been submitted to the FDPIC.
Art. 23 Consultation of the FDPIC
If the data protection impact assessment indicates that the planned processing despite the measures planned by the controller will still pose a high risk to the personality or the data subject's fundamental rights, the controller shall seek the FDPIC's opinion beforehand.
The FDPIC shall inform the controller within two months of any objections to the planned processing. This deadline may be extended by one month if the data processing is complex.
If the FDPIC objects to the planned processing, he or she shall propose suitable measures to the controller.
A private controller may dispense with consulting the FDPIC if it has consulted the data protection officer under Article 10.
Art. 24 Notifications of data security breaches
The controller shall notify the FDPIC of any breach of data security that is likely to lead to a high risk to the data subject's personality or fundamental rights as quickly as possible.
In the notification, it shall as a minimum specify the nature of the breach of data security, its consequences and the measures taken or planned.
The processor shall notify the controller of any breach of data security as quickly as possible.
The controller shall inform the data subject if this is required for their protection or if the FDPIC so requests.
It may limit, delay or dispense with the provision of information to the data subject if:
there is a reason for doing so pursuant to Article 26 paragraph 1 letter b or paragraph 2 letter b or the provision of information is prohibited by a statutory duty of confidentiality;
the provision of information is impossible or requires disproportionate effort; or
the provision of information to the data subject is equally guaranteed by making a public announcement.
With the controller’s consent, the FDPIC may forward the notification to the National Cyber Security Centre for analysis. The communication may contain sensitive personal data, including data relating to administrative and criminal proceedings or sanctions involving the controller.7
A notification made pursuant to this Article may only be used against the person required to notify in criminal proceedings with that person's consent.
Chapter 4 Rights of the Data Subject
Art. 25 Right to information
Any person may request information from the controller on whether personal data relating to them is being processed.
The data subject shall receive the information required to be able to exercise their rights under this Act and to guarantee transparent data processing. In every case, they are entitled to the following information:
the identity and the contact details of the controller;
the processed personal data as such;
the purpose of processing;
the retention period for the personal data or, if this is not possible, the criteria for determining this period;
the available information about the source of the personal data, if it has not been collected from the data subject;
if applicable, whether an automated individual decision has been taken and the logic behind the decision;
if applicable, the recipients or the categories of recipients to which personal data is disclosed, as well as the information specified in Article 19 paragraph 4.
The data subject may consent to having personal data relating to their health communicated by a health profession of their choice.
If the controller arranges for personal data to be processed by a processor, it remains under a duty to provide information.
No one may waive their right to information in advance.
The controller must provide information free of charge. The Federal Council may provide for exceptions, in particular if the effort required is disproportionate.
The information shall in general be provided within 30 days.
Art. 26 Limitations on the right to information
The controller may refuse to provide information, or restrict or delay the provision of information if:
a formal law so provides, in particular in order to preserve professional secrecy;
this is required to safeguard overriding third-party interests; or
the request for information is obviously unjustified, in particular if does not serve the purpose of data protection or is clearly frivolous.
Furthermore, it is possible to refuse, restrict or delay the provision of information in the following cases:
The controller is a private person and the following requirements are satisfied:
The controller's own overriding interests require the measure.
The controller does not intend to disclose the personal data to third parties.
The controller is a federal body, and one of the following requirements is satisfied:
The measure is required to satisfy overriding public interests, in particular Switzerland's internal or external security.
The communication of the information may compromise an enquiry, an investigation or administrative or judicial proceedings.
Legal entities that belong to the same group of companies are not third parties within the meaning of paragraph 2 letter a number 2.
The controller must indicate why it is refusing, restricting or delaying the provision of the information.
Art. 27 Limitation on the right to information for the media
If personal data are processed exclusively for their publication in the editorial section of a periodically published medium, the controller may refuse, restrict or delay the provision of information for one of the following reasons:
The data reveals the sources of the information.
The provision of information would allow access to drafts of publications.
The provision of information would compromise the freedom of the public to shape their own opinions.
Journalists may also refuse, restrict or delay the provision of information if they are using the personal data exclusively as an aid to their own personal work.
Art. 28 Right to data portability
Any person may request the controller to deliver the personal data that they have disclosed to it in a conventional electronic format if:
the controller is carrying out the automated processing of the data; and
the data are being processed with the consent of the data subject or in direct connection with the conclusion or the performance of a contract between the controller and the data subject.
The data subject may also request the controller to transfer their personal data to another controller if the requirements in paragraph 1 are met and no disproportionate effort is required.
The controller must deliver or transfer the personal data free of charge. The Federal Council may provide for exceptions, in particular if the effort is disproportionate.
Art. 29 Restrictions on the right to data portability
The controller may refuse, restrict or delay the delivery or transfer of personal data for the reasons set out in Article 26 paragraphs 1 and 2.
The controller must give reasons why it has decided to refuse, restrict or delay the delivery or transfer.
Chapter 5 Special Provisions on Data Processing by Private Persons
Art. 30 Breaches of personality rights
Any person who processes personal data must not unlawfully breach the data subjects' personality rights.
A breach of personality rights arises in particular if:
personal data are processed contrary to the principles of Articles 6 and 8;
personal data are processed contrary to the express wishes of the data subject;
sensitive personal data are disclosed to third parties.
In general no breach of personality rights arises if the data subject makes the personal data generally accessible and has not explicitly prohibited any processing.
Art. 31 Grounds for justification
A breach of personality rights is unlawful unless it is justified by the consent of the data subject, by an overriding private or public interest, or by the law.
The controller may have an overriding interest in the following cases in particular:
The controller processes personal data relating to a contracting party in direct connection with the conclusion or the performance of a contract.
The controller is or intends to be in commercial competition with another person and for this purpose processes personal data that are not disclosed to third parties; legal entities that belong to the same group of companies as the controller are not regarded as third parties for the purposes of this provision.
The controller processes personal data to verify the creditworthiness of the data subject, provided the following requirements are satisfied:
The matter involves neither sensitive personal data nor high-risk profiling.
The data are only disclosed to third parties if the third parties require the data for the conclusion or the performance of a contract with the data subject.
The data are no more than ten years old.
The data subject has attained the age of majority.
The controller processes the personal data professionally and exclusively for publication in the editorial section of a periodically published medium or the controller uses the data, if they are not published, as an aid to their own personal work.
The controller processes the personal data for purposes not related to specific persons, in particular for research, planning or statistics, provided the following requirements are satisfied:
The controller anonymises the data as soon as the purpose of processing permits; if anonymity is impossible or if it requires disproportionate effort, the controller shall take appropriate measures to prevent the identification of the data subject.
If the matter involves sensitive personal data, the controller shall disclose such data to third parties in such a manner that the data subject is not identifiable; if this is not possible, it must be guaranteed that the third parties only process the data for purposes unrelated to the data subject's person.
The results are published in such a manner that data subjects are not identifiable.
The controller collects personal data relating to a public figure that relate to that person's public activities.
Art. 32 Legal rights
The data subject may request that incorrect personal data be corrected unless:
a statutory provision prohibits the correction;
the personal data are processed for archiving purposes that are in the public interest.
Actions to protect the personality are governed by the Articles 28, 28a and 28g–28l of the Civil Code8. The applicant may in particular request that:
a specific data processing activity be prohibited;
a specific disclosure of personal data to third parties be prohibited;
personal data be deleted or destroyed.
If neither the accuracy nor the inaccuracy of the relevant personal data can be established, the applicant may request that the data be marked as being disputed.
The applicant may also request that any correction, deletion or destruction, prohibition of processing or disclosure to third parties, marking as disputed or judgment be communicated to third parties or be published.
Chapter 6 Special Provisions on Data Processing by Federal Bodies
Art. 33 Control and responsibility in the case of the joint processing of personal data
The Federal Council shall regulate the control procedures and responsibility for data protection in cases in which a federal body processes personal data jointly with other federal bodies, with cantonal bodies or with private persons.
Art. 34 Legal basis
Federal bodies may only process personal data if there is a statutory basis for doing so.
A statutory basis in a formal law is required in the following cases:
The matter involves the processing of sensitive personal data.
The matter involves profiling.
The purpose or manner of the data processing may lead to a serious violation of the data subject's fundamental rights.
A statutory basis in a substantive law is sufficient as the basis for processing personal data under paragraph 2 letters a and b provided the following requirements are satisfied:
Processing is essential for a task required by a formal law.
The purpose of processing poses no particular risks to the data subject's fundamental rights.
In derogation from the paragraphs 1–3, federal bodies may process personal data if any one one of the following requirements is satisfied:
The Federal Council has authorised the processing because it considers that the data subject's rights are not at risk.
The data subject has consented to the processing in the specific case or has made their personal data generally accessible and has not explicitly prohibited any processing.
The processing is necessary in order to protect the life or physical integrity of the data subject or of a third party, and it is not possible to obtain the consent of the data subject within a reasonable time.
Art. 35 Automated data processing as part of pilot trials
Before a formal enactment comes into force, the Federal Council may authorise the automated processing of sensitive personal data or other data processing under Article 34 paragraph 2 letters b and c if:
the tasks for which the processing is required are regulated in a formal law that is already in force;
adequate measures have been taken to limit any violation of the data subjects' fundamental rights to a minimum; and
a test phase before the enactment comes into force is essential for the practical implementation of the data processing, in particular for technical reasons.
The Federal Council shall obtain the FDPIC's opinion beforehand.
The competent federal body shall submit an evaluation report to the Federal Council no later than two years after the start of the pilot trial. In the report, it shall propose the continuation or discontinuation of the processing.
Automated data processing must in every case be discontinued if no formal enactment containing the required legal basis has come into force within five years of the start of the pilot trial.
Art. 36 Disclosure of personal data
Federal bodies may only disclose personal data if there is a statutory basis for doing so in accordance with Article 34 paragraphs 1–3.
They may disclose personal data in specific cases in derogation from paragraph 1, if any one of the following requirements is satisfied:
The data must be disclosed in order for the controller or the recipient to fulfil a statutory duty.
The data subject has consented to disclosure.
The data must be disclosed in order to protect the life or physical integrity of the data subject or of a third party and it is not possible to obtain the consent of the data subject within a reasonable time.
The data subject has made their personal data generally accessible and has not explicitly prohibited any processing.
The recipient has credibly shown that the data subject has refused consent or objected to the disclosure in order to prevent the recipient from enforcing legal rights or exercising other legitimate interests; the data subject must be given the opportunity beforehand to comment, unless this is impossible or requires disproportionate effort.
The federal bodies may furthermore disclose personal data as part of official information provided to the public or based on the Freedom of Information Act of 17 December 20049 if:
the data is connected with the fulfilment of public duties; and
there is an overriding public interest in the disclosure.
They may also disclose a person’s surname, first name, address and date of birth on request even if the requirements in paragraphs 1 or 2 are not satisfied.
They may make personal data generally accessible by means of automated information and communications services if there is a legal basis for publishing the data or if they disclose data based on paragraph 3. If there is no longer a public interest in making the data generally accessible, the data concerned shall be deleted from the automated information and communications service.
The federal bodies shall refuse or restrict disclosure or make disclosure subject to requirements if:
essential public interests or the manifestly legitimate interests of the data subject so require; or
statutory duties of confidentiality or special data protection regulations so require.
Art. 37 Objecting to the disclosure of personal data
A data subject who credibly shows a legitimate interest may object to the disclosure of specific personal data by the responsible federal body.
The federal body shall reject the objection if any one of the following requirements is satisfied:
There is a legal duty to disclose the data.
The fulfilment of the body's tasks would otherwise be jeopardised.
Article 36 paragraph 3 remains reserved.
Art. 38 Offering documents to the Federal Archives
In accordance with the Archiving Act of 26 June 199810, federal bodies shall offer to the Federal Archives all personal data that they no longer regularly require.
They shall destroy personal data that the Federal Archives do not deem to be worth archiving unless:
the data are anonymised;
they must be preserved for evidentiary or security purposes or to safeguard the data subject's legitimate interests.
Art. 39 Data processing for purposes not related to specific persons
Federal bodies may process personal data for purposes not related to specific persons, in particular for research, planning or statistics, provided:
the data are anonymised as soon as the purpose of processing permits;
the federal body only discloses sensitive personal data to private persons in such a manner that the data subjects are not identifiable;
the recipient only transmits the data to third parties with the consent of the federal body that disclosed the data; and
the results are only published in such a manner that the data subjects are not identifiable.
Articles 6 paragraph 3, 34 paragraph 2 and 36 paragraph 1 do not apply.
Art. 40 Private law activities by federal bodies
If a federal body acts under private law, the provisions on data processing by private persons apply.
Art. 41 Rights and procedures
Any person who has a legitimate interest may request the responsible federal body to:
stop the unlawful processing of the personal data concerned;
redress the consequences of unlawful processing;
declare the processing to be unlawful.
The applicant may in particular request the federal body to:
correct, delete or destroy the personal data concerned;
communicate its decision, in particular about correcting, deleting or destroying personal data, the objection against the disclosure under Article 37 or marking data as disputed under paragraph 4, to third parties or publish the decision.
Instead of deleting or destroying the personal data, the federal body shall restrict the processing if:
the data subject disputes the accuracy of the personal data and neither its accuracy nor its inaccuracy can be established;
the overriding interests of third parties so require;
an overriding public interest, in particular Switzerland's internal or external security, so requires;
deleting or destroying the data may jeopardise an enquiry, an investigation or an administrative or judicial procedure.
If neither the accuracy nor the inaccuracy of the relevant personal data can be established, the federal body shall mark the data as being disputed.
The correction, deletion or destruction of personal data may not be requested in connection with the stocks held by publicly accessible libraries, education and training institutions, museums, archives or other public memory institutions. If the applicant credibly shows an overriding interest, he or she may request the institution to restrict access to the disputed data. Paragraphs 3 and 4 do not apply.
The procedure is governed by the APA11. The exceptions in Articles 2 and 3 APA do not apply.
Art. 42 Procedure for disclosing official documents that contain personal data
Where proceedings relating to access to official documents that contain personal data in accordance with the Freedom of Information Act of 17 December 200412 are pending, the data subject may claim those rights in the proceedings that they would have under Article 41 of this Act in relation to the documents that are the subject matter of the access proceedings.
Chapter 7 Federal Data Protection and Information Commissioner
Section 1 Organisation
Art. 43 Election and status
The United Federal Assembly shall elect the head of the FDPIC (the Commissioner).
Any person with the right to vote on federal matters is eligible for election.
The Commissioner's employment relationship is governed, unless this Act provides otherwise, by the Federal Personnel Act of 24 March 200013 (FPA). The Commissioner shall be insured against the financial consequences of retirement, invalidity and death with PUBLICA, the Federal Pension Fund. If the Commissioner remains in the position after reaching the age of 65 and so requests, pension cover shall be extended until the end of the employment contract, but no later than the end of the year in which the Commissioner attains the age of 68. The FDPIC shall finance the employer’s contributions.14
The Federal Assembly shall issue the implementing provisions relating to the Commissioner’s employment contract in an ordinance.15
The Commissioner shall exercise his or her duties independently, without seeking or accepting instructions from any authority or third party. He or she is assigned for administrative purposes to the Federal Chancellery.
He or she shall have a permanent secretariat and his or her own budget. He or she shall appoint his or her staff.
He or she is is not subject to the system of assessment under Article 4 paragraph 3 FPA.
Art. 44 Term of office, re-election and termination of office
The Commissioner's term of office amounts to four years and may be extended twice. It begins on the first day of January following the start the National Council's legislature period.
The Commissioner may terminate his or her employment contract at the end of any month subject to a period of six months' notice. The Judiciary Committee may in an individual case allow the Commissioner a shorter period of notice if there are no substantial interests that preclude this.16
The United Federal Assembly may remove the Commissioner from office before the end of the term of office if he or she:
has wilfully or through gross negligence committed a serious violation of his or her official duties; or
has permanently lost the capacity to carry out his or her official duties.
Art. 44a17 Reprimand
The Judiciary Committee may issue a reprimand if it establishes that the Commissioner has failed to comply with official duties.
Art. 45 Budget
The FDPIC shall submit the draft of his or her budget each year via the Federal Chancellery to the Federal Council. The Federal Council shall submit the budget unchanged to the Federal Assembly.
Art. 46 Incompatibility
The Commissioner may not be a member of the Federal Assembly or the Federal Council and may not have any other employment relationship with the Confederation.
Art. 47 Additional occupation
The Commissioner may not have any additional occupations.
The Judicial Committee may permit the Commissioner to carry out an additional occupation provided this does not adversely affect the exercise of his or her duties or the independence and the reputation of the FDPIC.18 The decision shall be published.
Art. 47a19 Recusal
In the event of any dispute with regard to the Commissioner’s recusal, the decision shall be taken by the president of the division of the Federal Administrative Court that is competent in data protection matters.
Art. 48 Self-regulation of the FDPIC
The FDPIC shall ensure by means of suitable control measures, in particular in relation to data security, that the legally compliant implementation of data protection regulations under federal law is guaranteed within his or her office.
Section 2 Investigation of Violations of Data Protection Regulations
Art. 49 Investigation
The FDPIC shall open an investigation into a federal body or a private person ex officio or in response to a report if there are sufficient indications that a data processing activity could violate data protection regulations.
It may refrain from opening an investigation if the violation of data protection regulations is of minor importance.
The federal body or the private person shall provide the FDPIC with all the information and documents that is needed for the investigation. The right to refuse to provide information is governed by the Articles 16 and 17 of the APA20, unless Article 50 paragraph 2 of this Act provides otherwise.
If the data subject has filed a report, the FDPIC shall inform them about the steps taken in response and the result of any investigation.
Art. 50 Powers
If the federal body or the private person fails to fulfil the duties to cooperate, the FDPIC may as part of the investigation order the following in particular:
access to all information, documents, records of processing activities and personal data that are required for the investigation;
access to premises and installations;
questioning of witnesses;
appraisals by experts.
Professional secrecy remains reserved.
In order to enforce the measures under paragraph 1 the FDPIC may request support from other federal authorities and from the cantonal or communal police.
Art. 51 Administrative measures
If data protection regulations have been violated, the FDPIC may order that the processing be modified, suspended or terminated, wholly or in part, and the personal data deleted or destroyed, wholly or in part.
It may delay or prohibit disclosure abroad if this violates the requirements of Article 16 or 17 or provisions relating to the disclosure of personal data abroad in other federal acts.
It may in particular order that the federal body or the private person:
provide him or her with information in accordance with Articles 16 paragraph 2 letters b and c and 17 paragraph 2;
take the measures in accordance with Articles 7 and 8;
inform the data subjects in accordance with Articles 19 and 21;
conduct a data protection impact assessment in accordance with Article 22;
consult him or her in accordance with Article 23;
provide him or her or, if applicable, the data subject with information in accordance with Article 24;
provide the data subject with the information specified in Article 25.
It may also order that private controllers with registered office or domicile abroad appoint a representative in accordance with Article 14.
If the federal body or the private person has taken the required measures during the investigation in order to restore compliance with the data protection regulations, the FDPIC may simply issue an official warning.
Art. 52 Procedure
The investigation proceedings and rulings under Articles 50 and 51 are governed by the APA21.
The only party is the federal body or the private person against which or whom an investigation has been opened.
The FDPIC may contest appeal decisions of the Federal Administrative Court.
Art. 53 Coordination
Federal administrative authorities that supervise private persons or organisations outside the Federal Administration in accordance with another federal act shall invite the FDPIC to comment before they issue a ruling that relates to data protection issues.
If the FDPIC is conducting his or her own investigation against the same party, the two authorities shall coordinate their proceedings.
Section 3 Administrative Assistance
Art. 54 Administrative assistance between Swiss authorities
Federal authorities and cantonal authorities shall provide the FDPIC with the information and personal data that it requires to fulfil its statutory duties.
The FDPIC shall provide the following authorities with the information and personal data that they require to fulfil their statutory duties:
the authorities responsible for data protection in Switzerland;
the competent prosecution authorities, where the matter relates to an offence reported under Article 65 paragraph 2;
the federal authorities and the cantonal and communal police for the implementation of measures in accordance with Articles 50 paragraph 3 and 51.
Art. 55 Administrative assistance for foreign authorities
The FDPIC may exchange information or personal data with foreign authorities that are responsible for data protection in order that they may fulfil their respective statutory duties in relation to data protection, provided the following requirements are satisfied:
Reciprocity with regard to administrative assistance is guaranteed.
The information and personal data are used only in the proceedings related to data protection that are the subject of the request for administrative assistance.
The recipient authority undertakes to preserve professional secrecy as well as trade and manufacturing secrecy.
The information and personal data are only disclosed to third parties if the authority that provided them gives its approval beforehand.
The recipient authority undertakes to comply with the requirements and restrictions imposed by the authority that provided the information and personal data.
In order to justify its request for administrative assistance or to comply with the request from an authority, the FDPIC may provide the following information in particular:
the identity of the controller, of the processor or of other third parties involved;
the categories of data subjects;
the identity the data subjects, provided:
the data subjects have consented, or
disclosure of the identity of the data subjects is essential for the FDPIC or the foreign authority to fulfil statutory duties;
processed personal data or categories of processed personal data;
the purpose of processing;
the recipients or the categories of recipients;
technical and organisational measures.
Before the FDPIC provides information that may include professional, trade or manufacturing secrets to a foreign authority, it shall inform the natural persons or legal entities concerned that hold these secrets, and invite them to comment, unless this is not possible or requires disproportionate effort.
Section 4 Other Tasks of the FDPIC
Art. 56 Register
The FDPIC shall keep a register of the processing activities of federal bodies. The register shall be published.
Art. 57 Information
The FDPIC shall submit a report on his or her activities to the Federal Assembly every year. He or she shall submit the report to the Federal Council at the same time. The report shall be published.
In cases of general interest, the FDPIC shall inform the public about its findings and rulings.22
Art. 58 Further tasks
The FDPIC shall also carry out the following tasks in particular:
It shall inform, train and advise federal bodies and private persons on data protection matters.
It shall support the cantonal bodies and work with Swiss and foreign authorities that are responsible for data protection.
It shall raise public awareness, and in particular that of persons in need of protection, in relation to data protection.
It shall provide data subjects on request with information on how they may exercise their rights.
It shall comment on draft federal legislation and measures that involve data processing.
It shall carry out the duties assigned to it under the Freedom of Information Act of 17 December 200423 or other federal acts.
It shall develop working instruments as recommendations of good practice for use by controllers, processors and data subjects; for this purpose, it shall take into account the specifics of the field concerned and the need to protect vulnerable persons.
It may also advise federal bodies that are not subject to his or her supervision in accordance with Articles 2 and 4. The federal bodies may allow him or her to inspect files.
The FDPIC has the power to declare to foreign authorities that are responsible for data protection that direct service is permitted in relation to data protection in Switzerland, provided Switzerland is granted reciprocal rights.
Section 5 Fees
Art. 59
The FDPIC shall charge private persons fees for:
its opinion on a code of conduct in accordance with Article 11 paragraph 2;
the approval of standard data protection clauses and binding corporate rules in accordance with Article 16 paragraph 2 letters d and e;
consultation in connection with a data protection impact assessment in accordance with Article 23 paragraph 2;
precautionary measures and measures under Article 51;
advice on data protection issues in accordance with Article 58 paragraph 1 letter a.
The Federal Council shall specify the amount of the fees.
It may stipulate the cases in which it is possible to waive or reduce a fee.
Chapter 8 Criminal Provisions
Art. 60 Violation of the duty to provide information, the right to information and the duty to cooperate
On complaint, a fine not exceeding 250,000 francs shall be imposed on private persons who:
violate their duties under Articles 19, 21 and 25–27, in that they wilfully provide false or incomplete information;
fail wilfully:
to provide information to the data subject in accordance with Articles 19 paragraph 1 and 21 paragraph 1, or
to provide the data subject with the information specified in Article 19 paragraph 2.
A fine not exceeding 250,000 francs shall be imposed on private persons who, in violation of Article 49 paragraph 3, wilfully provide the FDPIC with false information or wilfully fail to cooperate in the course of an investigation.
Art. 61 Violation of duties of care
On complaint, a fine not exceeding 250,000 francs shall be imposed on private persons who wilfully:
disclose personal data abroad in violation of Article 16 paragraphs 1 and 2 without satisfying the requirements of Article 17;
assign the data processing to a processor without satisfying the requirements of Article 9 paragraphs 1 and 2;
fail to comply with the minimum requirements for data security stipulated by the Federal Council in Article 8 paragraph 3.
Art. 62 Violation of the professional duty of confidentiality
Any person who, while practising his or her profession, acquires knowledge of secret personal data for the purpose of that profession but thereafter wilfully discloses such data shall on complaint be liable to a fine not exceeding 250,000 francs.
The same penalty shall apply to any person who wilfully discloses secret personal data that has come to his or her knowledge while carrying on an activity for or while training with a person subject to a duty of confidentiality.
The disclosure of secret personal data after ceasing to practise a profession or after completing training is also a criminal offence.
Art. 63 Disregard of decisions
Any private person who wilfully fails to comply with a ruling issued by the FDPIC or a decision of the appeal courts that refers to the penalty under this Article shall be liable to a fine not exceeding 250,000 francs.
Art. 64 Corporate criminal liability
The criminal liability of businesses is governed by Articles 6 and 7 of the Federal Act of 22 March 197424 on Administrative Criminal Law (ACLA).
If a fine not exceeding 50,000 francs is under consideration and if the identification of the perpetrators in accordance with Article 6 ACLA requires measures that would be disproportionate in view of the potential penalty, the authority may decide not to pursue these persons but instead to order the business to pay the fine (Art. 7 ACLA).
Art. 65 Jurisdiction
The prosecution and the adjudication of criminal acts is a matter for the cantons.
The FDPIC may file a complaint with the competent prosecution authority and exercise the rights of a private claimant in the proceedings.
Art. 66 Statute of limitations for prosecution
Prosecution is subject to a statute of limitations of five years.
Chapter 9 Conclusion of International Treaties
Art. 67
The Federal Council may conclude international treaties relating to:
international cooperation between data protection authorities;
the mutual acknowledgement of an adequate level of protection for the disclosure of personal data abroad.
Chapter 10 Final Provisions
Art. 68 Repeal and amendment of other legislation
The repeal and the amendment of other legislation are regulated in Annex 1.
Art. 69 Transitional provisions relating to ongoing instances of processing
Articles 7, 22 and 23 do not apply to data processing that began before this Act comes into force, provided the purpose of processing remains unchanged and no new data are collected.
Art. 70 Transitional provision relating to ongoing proceedings
This Act does not apply to FDPIC investigations that are ongoing at the time that it comes into force; likewise, this Act does not apply to appeals pending against first instance decisions issued before it comes into force. Such cases are governed by the previous law.
Art. 71 Transitional provision relating to the data of legal entities
For federal bodies, regulations in other federal legislation that relate to personal data shall continue to apply to the data of legal entities for five years from the date on which this Act come into force. In particular federal bodies may continue to disclose the data of legal entities in accordance with Article 57s paragraphs 1 and 2 of the Government and Administration Organisation Act of 21 March 199725 for five years from the date on which this Act come into force if there is a legal basis that authorises them to disclose personal data.
Art. 72 Transitional provision relating to the Commissioner's election and termination of office
The election of the Commissioner and the termination of his or her term of office shall be governed by the previous law until the end of the legislature period in which this Act comes into force.
If the incumbent is elected in the first vote of the United Federal Assembly to elect the Commissioner, the Commissioner’s new term of office begins on the day after the election.26
Art. 72a27 Transitional provision relating to the Commissioner’s employment contract
If the Commissioner’s employment contract was based on the previous law, the previous law continues to apply.
Art. 73 Coordination
Coordination with other enactments is regulated in Annex 2.
Art. 74 Referendum and commencement
This Act is subject to an optional referendum.
The Federal Council shall determine the commencement date.
Commencement date: 1 September 202328
(Art. 68)
Repeal and amendment of other legislation
I
The following enactments are repealed:
Federal Act of 19 June 199229 on Data Protection;
Schengen-Data Protection Act of 28 September 201830.
II
The following enactments are amended as follows:
…31
(Art. 68)