-
- Art. 5a FC
- Art. 6 FC
- Art. 10 FC
- Art. 16 FC
- Art. 17 FC
- Art. 20 FC
- Art. 22 FC
- Art. 29a FC
- Art. 30 FC
- Art. 32 FC
- Art. 42 FC
- Art. 43 FC
- Art. 43a FC
- Art. 55 FC
- Art. 56 FC
- Art. 60 FC
- Art. 68 FC
- Art. 75b FC
- Art. 77 FC
- Art. 96 para. 2 lit. a FC
- Art. 110 FC
- Art. 117a FC
- Art. 118 FC
- Art. 123b FC
- Art. 136 FC
- Art. 166 FC
-
- Art. 11 CO
- Art. 12 CO
- Art. 50 CO
- Art. 51 CO
- Art. 84 CO
- Art. 143 CO
- Art. 144 CO
- Art. 145 CO
- Art. 146 CO
- Art. 147 CO
- Art. 148 CO
- Art. 149 CO
- Art. 150 CO
- Art. 701 CO
- Art. 715 CO
- Art. 715a CO
- Art. 734f CO
- Art. 785 CO
- Art. 786 CO
- Art. 787 CO
- Art. 788 CO
- Transitional provisions to the revision of the Stock Corporation Act of June 19, 2020
- Art. 808c CO
-
- Art. 2 PRA
- Art. 3 PRA
- Art. 4 PRA
- Art. 6 PRA
- Art. 10 PRA
- Art. 10a PRA
- Art. 11 PRA
- Art. 12 PRA
- Art. 13 PRA
- Art. 14 PRA
- Art. 15 PRA
- Art. 16 PRA
- Art. 17 PRA
- Art. 19 PRA
- Art. 20 PRA
- Art. 21 PRA
- Art. 22 PRA
- Art. 23 PRA
- Art. 24 PRA
- Art. 25 PRA
- Art. 26 PRA
- Art. 27 PRA
- Art. 29 PRA
- Art. 30 PRA
- Art. 31 PRA
- Art. 32 PRA
- Art. 32a PRA
- Art. 33 PRA
- Art. 34 PRA
- Art. 35 PRA
- Art. 36 PRA
- Art. 37 PRA
- Art. 38 PRA
- Art. 39 PRA
- Art. 40 PRA
- Art. 41 PRA
- Art. 42 PRA
- Art. 43 PRA
- Art. 44 PRA
- Art. 45 PRA
- Art. 46 PRA
- Art. 47 PRA
- Art. 48 PRA
- Art. 49 PRA
- Art. 50 PRA
- Art. 51 PRA
- Art. 52 PRA
- Art. 53 PRA
- Art. 54 PRA
- Art. 55 PRA
- Art. 56 PRA
- Art. 57 PRA
- Art. 58 PRA
- Art. 59a PRA
- Art. 59b PRA
- Art. 59c PRA
- Art. 62 PRA
- Art. 63 PRA
- Art. 67 PRA
- Art. 67a PRA
- Art. 67b PRA
- Art. 75 PRA
- Art. 75a PRA
- Art. 76 PRA
- Art. 76a PRA
- Art. 90 PRA
-
- Vorb. zu Art. 1 FADP
- Art. 1 FADP
- Art. 2 FADP
- Art. 3 FADP
- Art. 5 lit. f und g FADP
- Art. 6 Abs. 6 and 7 FADP
- Art. 7 FADP
- Art. 10 FADP
- Art. 11 FADP
- Art. 12 FADP
- Art. 14 FADP
- Art. 15 FADP
- Art. 19 FADP
- Art. 20 FADP
- Art. 22 FADP
- Art. 23 FADP
- Art. 25 FADP
- Art. 26 FADP
- Art. 27 FADP
- Art. 31 para. 2 lit. e FADP
- Art. 33 FADP
- Art. 34 FADP
- Art. 35 FADP
- Art. 38 FADP
- Art. 39 FADP
- Art. 40 FADP
- Art. 41 FADP
- Art. 42 FADP
- Art. 43 FADP
- Art. 44 FADP
- Art. 44a FADP
- Art. 45 FADP
- Art. 46 FADP
- Art. 47 FADP
- Art. 47a FADP
- Art. 48 FADP
- Art. 49 FADP
- Art. 50 FADP
- Art. 51 FADP
- Art. 54 FADP
- Art. 57 FADP
- Art. 58 FADP
- Art. 60 FADP
- Art. 61 FADP
- Art. 62 FADP
- Art. 63 FADP
- Art. 64 FADP
- Art. 65 FADP
- Art. 66 FADP
- Art. 67 FADP
- Art. 69 FADP
- Art. 72 FADP
- Art. 72a FADP
-
- Art. 2 CCC (Convention on Cybercrime)
- Art. 3 CCC (Convention on Cybercrime)
- Art. 4 CCC (Convention on Cybercrime)
- Art. 5 CCC (Convention on Cybercrime)
- Art. 6 CCC (Convention on Cybercrime)
- Art. 7 CCC (Convention on Cybercrime)
- Art. 8 CCC (Convention on Cybercrime)
- Art. 9 CCC (Convention on Cybercrime)
- Art. 11 CCC (Convention on Cybercrime)
- Art. 12 CCC (Convention on Cybercrime)
- Art. 25 CCC (Convention on Cybercrime)
- Art. 29 CCC (Convention on Cybercrime)
- Art. 32 CCC (Convention on Cybercrime)
- Art. 33 CCC (Convention on Cybercrime)
- Art. 34 CCC (Convention on Cybercrime)
FEDERAL CONSTITUTION
CODE OF OBLIGATIONS
FEDERAL LAW ON PRIVATE INTERNATIONAL LAW
LUGANO CONVENTION
CODE OF CRIMINAL PROCEDURE
CIVIL PROCEDURE CODE
FEDERAL ACT ON POLITICAL RIGHTS
CIVIL CODE
FEDERAL ACT ON CARTELS AND OTHER RESTRAINTS OF COMPETITION
FEDERAL ACT ON INTERNATIONAL MUTUAL ASSISTANCE IN CRIMINAL MATTERS
DEBT ENFORCEMENT AND BANKRUPTCY ACT
FEDERAL ACT ON DATA PROTECTION
SWISS CRIMINAL CODE
CYBERCRIME CONVENTION
- In a nutshell
- I. General
- II. Types of restriction (para. 1 and 2)
- III. Grounds for restriction (para. 1-3)
- IV. Duty to state reasons (para. 4)
- Bibliography
In a nutshell
Art. 26 FADP regulates the possible restrictions of the right to information of the data subjects. The controller may postpone, restrict or refuse to provide information for various reasons. In particular, legal obligations such as professional secrecy, overriding interests of third parties and obvious unfoundedness or obvious querulousness can be considered as grounds for restriction. Private responsible parties may invoke their own overriding interests, federal bodies overriding public interests. Restrictions must be proportionate and examined on a case-by-case basis and justified to the person concerned.
I. General
1 The right of data subjects to information under Art. 25 FADP exists within the limits of Art. 26 f. FADP. FADP. Information may be postponed, restricted or refused by the controller on various grounds of limitation (Art. 26 FADP). The media may invoke further grounds to restrict information (Art. 27 FADP).
2 The "may" provision gives the impression that data controllers are free to decide whether to restrict information. This is not the case, however, because data controllers may often be obliged to restrict information. Art. 26 para. 1 FADP lists legal obligations (lit. a), overriding interests of third parties (lit. b) and obvious unfoundedness (lit. c) as reasons. Further reasons are listed in Art. 26 para. 2 FADP depending on whether the person responsible is a private person (lit. a) or a federal body (lit. b) (cf. n. 8 ff. below).
II. Types of restriction (para. 1 and 2)
3 Information may be postponed, restricted or refused (Art. 26 para. 1 and 2 FADP). The restriction must be proportionate, also in accordance with Art. 6 para. 2 FADP and Art. 36 para. 3 FC, i.e. necessary, suitable and appropriate or proportionate in the narrower sense. In particular, the restriction must be suitable in form and scope as well as in terms of time to achieve the desired goal.
4 In the event of a refusal, no information is provided at all. The data subject requesting information shall not receive any information for an unlimited period of time. The controller does not inform the data subject whether personal data about him or her is being processed (Art. 25 para. 1 FADP). If the refusal is limited in time, it is a deferral (cf. n. 6 below).
5 Restriction means that only partial information is provided, for example by blacking out certain information. Restriction may also mean that information is provided in whole or in part, but that the information is subject to conditions. Such a condition may be that the information provided may not be made available to third parties and may not be published. The data controller may require the data subject requesting information to confirm in advance that he or she will comply with any conditions, also in the form of a confidentiality agreement. Further protection, for example by agreement of a contractual penalty in the case of a responsible private person or by a threat of punishment under Art. 292 SCC in the case of a responsible federal body, is likely to be permissible only in exceptional cases in view of proportionality (cf. n. 3 above). The restricted provision of information, including any conditions, may be limited in time. In this case, it is a postponement (cf. n. 6).
6 In the case of a deferral, the information is not provided in whole or in part within the time limit (Art. 25 para. 7 FADP), but only at a later date. In the case of a responsible federal body, for example, the provision of information may be postponed in order not to interfere with the free formation of opinion and will.
7 In contrast to Art. 9 para. 3 aDSG, Art. 26 FADP does not regulate how to proceed if the grounds for restriction cease to apply. According to Art. 9 para. 3 aDSG, a federal body had to provide the information in this case, unless the provision of information was impossible or only possible with a disproportionate effort. For responsible federal bodies, it can be assumed that this fundamental duty to reconsider will continue to apply. On the other hand, an obligation to reply retrospectively can only be assumed with restraint in the case of private responsible parties, i.e. logically in the case of postponement.
III. Grounds for restriction (para. 1-3)
8 Art. 26 para. 1-3 FADP conclusively list the possible grounds for restriction. If there is no ground for restriction, the information may not be restricted in any possible way (cf. n. 3 ff. above). If there is more than one ground for restriction, the persons responsible may invoke all the grounds for restriction. All data controllers may invoke the grounds for restriction pursuant to Art. 26 para. 1 FADP. The grounds for restriction under Art. 26 para. 2 FADP distinguish between private data controllers and federal bodies. Art. 26 para. 3 FADP concerns only private persons. Whether a responsible person or a responsible person is considered a federal body is determined by Art. 5 lit. i FADP.
A. Legal obligations, in particular professional secrecy (para. 1 lit. a)
9 According to the wording, this ground for restriction applies exclusively to obligations under a law in the formal sense. This reason for restriction was taken over from Art. 9 para. 1 lit. aDSG, except for the now explicit mention of professional secrets. Legal obligations according to an ordinance are not sufficient in the reverse conclusion. Whether the information can be restricted by reference to general official secrecy must be examined in each individual case.
10 Moreover, the duty must relate to the restriction of information to the data subjects. Legal provisions that generally exclude access to personal data are not relevant. A lawyer, for example, may invoke professional secrecy vis-à-vis third parties, inter alia pursuant to Art. 13 FCA, but not vis-à-vis a client as a data subject.
B. Overriding interests of third parties (para. 1 lit. b)
11 Data or information need not relate solely to a data subject requesting information. A reference can also exist to other data subjects (Art. 5 lit. b FADP), but also to other third parties, for example to legal entities. Third parties include, for example, employees of the data controller. Such a relationship and thus any interests of third parties are even possible without personal data about such third parties being affected. Thus, a third party or a third party about whom the controller does not process any personal data could nevertheless have an interest in having the information provided to a person requesting information restricted.
12 If the interests of third parties are affected, the controller must check whether there are overriding interests and, if so, whether these overriding interests require the information to be restricted. The examination, including the weighing of interests, must be carried out on a case-by-case basis. The necessity of overriding interests shows that the interests of the data subject requesting information are not overriding per se. Conversely, the interests of the respective third party in the restricted information must outweigh the interests of the data subject, i.e., a "certain materiality of the impairment of the position of the third party or parties must be presumed". The reason for restriction was taken over unchanged from Art. 9 para. 1 lit. b aDSG. The exception applies equally to the duty to inform pursuant to Art. 20 para. 3 lit. a FADP.
C. Obvious unfoundedness or obvious querulousness (para. 1 lit. c)
13 According to Art. 26 para. 1 lit. c FADP, information may be restricted if the request for information is manifestly unfounded, namely if it pursues a purpose contrary to data protection, or is manifestly querulous. These grounds for restriction represent an innovation compared to the grounds for restriction under Art. 9 aDSG and were supplemented in the course of the parliamentary debate, also supported by case law. Abusive requests for information should also be prevented at this point.
14 These grounds for restriction are to be interpreted narrowly. The person responsible may not assume without further ado that a request for information is obviously unfounded or obviously querulous. In particular, requests for information are considered to be obviously querulous if they are obviously intended to "harass or exercise a responsible person (for example, by repetition or in the knowledge of the uselessness of the information)". A request for information is considered manifestly unfounded if it does not attempt to claim data protection rights or to create transparency motivated by data protection law.
15 If a request for information is indeed manifestly unfounded or manifestly querulous, the solution most favorable to the data subject must be chosen. The solution chosen, in particular deferral or restriction rather than denial, must be proportionate (see n. 3 above).
D. Overriding interests of private data controllers (para. 2 lit. a and para. 3)
16 Private controllers may restrict information beyond the grounds of Art. 26 para. 1 FADP if their own interests outweigh the interests of the data subject requesting information (para. 1) and the data concerned are not disclosed to third parties (para. 2). These requirements apply cumulatively. The examination, including any balancing of interests, must take place on a case-by-case basis (see also n. 12 above). The content of the provision corresponds to Art. 9 para. 4 aDSG and also exists as an exception to the obligation to provide information (Art. 20 para. 3 lit. c FADP).
17 Data that serve to protect against theft in a department store, the protection of manufacturing and trade secrets or a high level of financial expenditure are examples of possible overriding self-interest, whereby in the case of the latter, cost sharing in accordance with Art. 26 para. 6 FADP must be examined.
18 Data that is not disclosed to third parties or "real" third parties, i.e. internal data, is basically data that is disclosed only to persons who belong to the same organizational or corporate structure, i.e. not to another organizational or corporate structure, and who may be pursuing different purposes with the data processing than the controller. During the parliamentary debate, a group privilege was created with Art. 26 para. 3 FADP, according to which companies that belong to the same group are not considered third parties within the meaning of Art. 26 para. 2 a no. 2 FADP (the same for the duty to inform; Art. 20 para. 3 c no. 2 i.V.m. para. 4 FADP). The aDSG did not yet know such a privilege and group companies were considered third parties.
19 The exception also applies to companies abroad that belong to the same group. In all other respects, the applicable data protection obligations apply to the disclosure of data to group companies abroad, for example for the disclosure of personal data abroad (Art. 16 f. FADP).
20 Contractors pursuant to Art. 5 lit. k FADP are not considered third parties (see also Art. 9 and 24 para. 4 FADP).
E. Overriding interests of federal bodies (para. 2 lit. b)
21 Federal bodies as data controllers may restrict information beyond the grounds of Art. 26 para. 1 FADP if public interests outweigh the interests of the data subject requesting information (no. 1) or if the information would jeopardize an investigation, inquiry or judicial proceedings (no. 2). The provision essentially corresponds to Art. 9 para. 2 aDSG and also exists as an exception to the obligation to provide information (Art. 20 para. 3 lit. d FADP).
22 No. 1 mentions in particular the internal or external security of the Confederation as a possible overriding public interest, the safeguarding of which may require a restriction of information. The naming is exemplary, i.e. all public interests can be considered as a reason for restriction, provided that they are overriding and the restriction is necessary to safeguard the corresponding interests. Other public interests that may be considered are - also in accordance with Art. 7 para. 1 FoIA - for example the free formation of opinion and will of authorities, judicial bodies and other public bodies, the implementation of specific official measures in accordance with the objectives, the foreign policy interests or the international relations of Switzerland, the relations between the Confederation and the cantons or the economic, monetary and currency policy interests of Switzerland.
23 No. 2 mentions as a further reason for restriction the possible endangerment of an investigation, an inquiry or official or judicial proceedings. This restriction applies only if and to the extent that the FADP is applicable at all to such investigations and proceedings (Art. 2 para. 3 FADP). In the literature, it is argued that internal investigations which precede disciplinary proceedings, for example, could fall under this provision.
24 Both grounds for restriction must be examined on a case-by-case basis, including any balancing of interests (see also n. 12 and 16 above).
IV. Duty to state reasons (para. 4)
25 The data controller must give reasons to the data subject for the restriction of information, as already provided for in Art. 9 para. 5 aDSG. The justification must enable the data subject to understand the reason or reasons for the restriction and to examine its lawfulness. In the case of responsible federal bodies, the restriction must be ordered at least at the request of the data subject in the form of a contestable order (Art. 5 APA). There is no obligation to retain the reasons given, but for reasons of proof, it is obvious for the person responsible to retain the relevant communication with the person concerned.
26 The burden of proof for the reason(s) for restriction lies with the person responsible, also with regard to proportionality. In the case of abusive requests for information pursuant to Art. 26 para. 1 lit. c FADP, it is sufficient to show that a request for information "obviously serves in a relevant way a purpose that does not concern data protection," which is a burden of proof.
Bibliography
Bundesamt für Justiz: Verordnung über den Datenschutz (Datenschutzverordnung, DSV), Erläuternder Bericht vom 31.8.2022 (zit. BJ, Bericht).
Husi-Stämpfli Sandra, Kommentierung zu Art. 26 DSG in: Baeriswyl Bruno/Pärli Kurt/Blonski Dominika (Hrsg.), Stämpflis Handkommentar, Datenschutzgesetz, 2. Aufl., Bern, 2023 (zit. SHK-Husi-Stämpfli, Art. 26 DSG).
Rosenthal David, Das neue Datenschutzgesetz, Jusletter vom 16.11.2020 (zit. Rosenthal, Jusletter).
Rosenthal David/Jöhri Yvonne, Handkommentar zum Datenschutzgesetz und weiteren, ausgewählten Bestimmungen, Zürich 2008 (zit. Rosenthal/Jöhri, Art. 9 aDSG).