I. Purpose

1 Article 28 aims to ensure mutual legal assistance while imposing restrictions on the use of information or material. This enables the requested party to provide particularly sensitive information or material only on a protected basis. This protection may extend to restricting the use of the information to the purpose for which the assistance is granted or to defining the recipients by stipulating that the information or material provided may not be disseminated beyond the law enforcement authorities of the requesting party. In this sense, Article 28 is to be understood as a classic mediating norm, which is committed on the one hand to the fundamental purpose of mutual legal assistance and on the other hand to the legitimate interests in the protection (of data) of the information and materials in question.

2 The mediating approach is ensured by the fact that Article 28 contains a confidentiality obligation. According to this, the receiving authority must treat information received from another state as confidential. This means that the information may not be made public or passed on to unauthorized third parties.

3 Furthermore, there is the principle of purpose limitation. According to this principle, the receiving state may only use the information for the purposes for which it was originally transmitted. This means that information may not be used for other purposes or in other proceedings without the consent of the transmitting state.

4 This is supplemented by the fact that exceptions to the purpose limitation are themselves subject to consent. If the receiving state intends to use the information for purposes other than those covered by the purpose limitation, it must obtain the consent of the transmitting state for this extension of purpose. This ensures that control over the use of the information remains in the hands of the state that originally provided it.

5 Art. 28 can thus be understood as a central component of international cooperation in the fight against cybercrime. It ensures that information exchanged between states is treated confidentially and used only for the intended purpose. Art. 28 thus creates a basis for the trustworthy international exchange of information and supports compliance with national and international data protection guidelines.

II. Scope (Art. 28 para. 1)

6 Art. 28 applies only if there is no mutual legal assistance treaty or agreement based on uniform or reciprocal legal provisions between the requesting and requested parties. The existing conventions and mutual assistance treaties, with regard to the taking of evidence, in particular the Convention of November 8, 1990, on money laundering, investigation, seizure, and confiscation of the proceeds of crime, the European Convention of 20 April 1959 on Mutual Assistance in Criminal Matters or the Second Additional Protocol of 8 November 2001 to the European Convention on Mutual Assistance in Criminal Matters, must be observed with regard to para. 1 and result in Art. 28 being superseded by these for quite a few mutual assistance proceedings.

7 If such a treaty or agreement is in force, its provisions on confidentiality and restrictions on use shall apply in place of Art. 28. This shall apply in any case unless the parties have expressly agreed to apply Art. 28 paras. 2 to 4. For the majority of mutual assistance proceedings involving the Swiss authorities, it can be assumed that mutual assistance within the meaning of para. 1 will be handled in accordance with the relevant conventions and mutual assistance treaties.

8 Whether and in what way there is otherwise an agreement between Switzerland and other states not party to the aforementioned mutual assistance agreements which excludes the applicability of Art. 28, establishes its own confidentiality rules or nevertheless refers to Art. 28 paras. 2 to 4 must be examined on a case-by-case basis for each country. The list of bilateral and multilateral treaties in the field of international mutual assistance in criminal matters maintained by the Federal Office of Justice is useful for this purpose.

9 If there is an agreement between the parties, only that agreement applies. Overlaps with other existing bilateral and multilateral mutual assistance treaties and similar agreements are thus avoided by the clear provision in para. 1, so that the competent authorities can adhere to the usual rules in practice and there is no need to resolve conflicts between competing or even contradictory agreements.

III. Restrictive conditions (Art. 28 para. 2)

10 Para. 2 allows the requested Contracting Party to impose two types of conditions. It may first make the information or documents available on condition that they remain confidential if and to the extent that the request cannot otherwise be complied with (lit. a; comparable to the confidential treatment of the identity of an informant).

11 Furthermore, the condition may be imposed that the information or documents provided may not be used for investigations or proceedings other than those specified in the request (lit. b).

12 The restriction on the use of the information and documents provided must be expressly requested by the requested Contracting Party. This must also apply in the same way to the condition of confidential treatment, as is already clear from the wording of the provision when it states that the transmission is made subject to a condition and that action is therefore expected from the requested party.

13 If no express statement of the condition is made, there is no such restriction on the requesting party.

14 In particular, the second condition reflects the principle of speciality enshrined in Article 67 IMAC, which is of central importance in practice, in Article 28. According to this principle, documents and information transmitted may not be used in the requesting State in proceedings for offences for which mutual assistance is not admissible, either for investigations or as evidence. In Switzerland, this prohibition also extends in particular to acts which, in the Swiss view, are of a political, military, or fiscal nature.

15 During the negotiations on the Cybercrime Convention, two exceptions to the possibility of restricting use were recognized. These are therefore implicitly contained in the provisions of the paragraph and are themselves restrictive in the sense that these exceptions do not carry a restriction on use.

16 The first restriction arises from the fundamental legal principles of many states, which require that information and material constituting evidence that exonerates an accused person must be disclosed to the defense or to a judicial authority. If the information or material provided constitutes such evidence, no violation of fundamental legal principles can be expected or demanded.

17 Similarly, a restriction does not extend to public court proceedings. Material transmitted under mutual legal assistance arrangements and intended for use in court proceedings that are normally public cannot be subject to a restriction on use.

IV. Impossibility of compliance with conditions (Art. 28 para. 3)

18 Para. 3, in turn, establishes an obligation on the requesting party to respond immediately to a condition if it cannot comply with it. The requesting party must immediately inform the requested party of this circumstance. The latter, in turn, is entitled to examine and decide whether it nevertheless wishes to provide the information, and thus in the knowledge that the condition cannot be met, i.e., ultimately unconditionally. In this context, adherence to the principles of mutual legal assistance may be required and assumed, which, in view of the decision, means that, in the interests of fairness to the requested party, it is entitled to exercise any discretion available to it in this regard.

19 If no immediate notification is given that a condition cannot be met, that condition shall remain in force as a binding condition, as in the case of express acceptance of the condition.

V. Information on use (Art. 28 para. 4)

20 Para. 4 represents a control level. The party sending the information or material is enabled to obtain an overview of how the information and materials provided under a condition in para. 2 have been used. To ensure this, the requested party may require the requesting party to provide information on the use of the information or documents. This information must be sufficiently detailed and comprehensive to enable compliance with the conditions to be verified.

21 Ultimately, this not only serves to monitor the requesting party, but also ensures that the requested party can fulfill its obligations – in particular, the obligation to ensure that there is no violation of Art. 67 IMAC.

Materials

Botschaft über die Genehmigung und die Umsetzung des Übereinkommens des Europarates über die Cyberkriminalität, BBl 2010 4697 ff., abrufbar unter https://www.fedlex.admin.ch/eli/fga/2010/813/de, zuletzt besucht am 19.2.2025 (zit. Botschaft CCC).

Explanatory Report to the Convention on Cybercrime Budapest, 23.XI.2001, https://rm.coe.int/16800cce5b, zuletzt besucht am 19.2.2025 (zit. Explanatory Report).