-
- Art. 5a FC
- Art. 6 FC
- Art. 10 FC
- Art. 16 FC
- Art. 17 FC
- Art. 20 FC
- Art. 22 FC
- Art. 29a FC
- Art. 30 FC
- Art. 32 FC
- Art. 42 FC
- Art. 43 FC
- Art. 43a FC
- Art. 55 FC
- Art. 56 FC
- Art. 60 FC
- Art. 68 FC
- Art. 75b FC
- Art. 77 FC
- Art. 96 para. 2 lit. a FC
- Art. 110 FC
- Art. 117a FC
- Art. 118 FC
- Art. 123b FC
- Art. 136 FC
- Art. 166 FC
-
- Art. 11 CO
- Art. 12 CO
- Art. 50 CO
- Art. 51 CO
- Art. 84 CO
- Art. 143 CO
- Art. 144 CO
- Art. 145 CO
- Art. 146 CO
- Art. 147 CO
- Art. 148 CO
- Art. 149 CO
- Art. 150 CO
- Art. 701 CO
- Art. 715 CO
- Art. 715a CO
- Art. 734f CO
- Art. 785 CO
- Art. 786 CO
- Art. 787 CO
- Art. 788 CO
- Transitional provisions to the revision of the Stock Corporation Act of June 19, 2020
- Art. 808c CO
-
- Art. 2 PRA
- Art. 3 PRA
- Art. 4 PRA
- Art. 6 PRA
- Art. 10 PRA
- Art. 10a PRA
- Art. 11 PRA
- Art. 12 PRA
- Art. 13 PRA
- Art. 14 PRA
- Art. 15 PRA
- Art. 16 PRA
- Art. 17 PRA
- Art. 19 PRA
- Art. 20 PRA
- Art. 21 PRA
- Art. 22 PRA
- Art. 23 PRA
- Art. 24 PRA
- Art. 25 PRA
- Art. 26 PRA
- Art. 27 PRA
- Art. 29 PRA
- Art. 30 PRA
- Art. 31 PRA
- Art. 32 PRA
- Art. 32a PRA
- Art. 33 PRA
- Art. 34 PRA
- Art. 35 PRA
- Art. 36 PRA
- Art. 37 PRA
- Art. 38 PRA
- Art. 39 PRA
- Art. 40 PRA
- Art. 41 PRA
- Art. 42 PRA
- Art. 43 PRA
- Art. 44 PRA
- Art. 45 PRA
- Art. 46 PRA
- Art. 47 PRA
- Art. 48 PRA
- Art. 49 PRA
- Art. 50 PRA
- Art. 51 PRA
- Art. 52 PRA
- Art. 53 PRA
- Art. 54 PRA
- Art. 55 PRA
- Art. 56 PRA
- Art. 57 PRA
- Art. 58 PRA
- Art. 59a PRA
- Art. 59b PRA
- Art. 59c PRA
- Art. 62 PRA
- Art. 63 PRA
- Art. 67 PRA
- Art. 67a PRA
- Art. 67b PRA
- Art. 75 PRA
- Art. 75a PRA
- Art. 76 PRA
- Art. 76a PRA
- Art. 90 PRA
-
- Vorb. zu Art. 1 FADP
- Art. 1 FADP
- Art. 2 FADP
- Art. 3 FADP
- Art. 5 lit. f und g FADP
- Art. 6 Abs. 6 and 7 FADP
- Art. 7 FADP
- Art. 10 FADP
- Art. 11 FADP
- Art. 12 FADP
- Art. 14 FADP
- Art. 15 FADP
- Art. 19 FADP
- Art. 20 FADP
- Art. 22 FADP
- Art. 23 FADP
- Art. 25 FADP
- Art. 26 FADP
- Art. 27 FADP
- Art. 31 para. 2 lit. e FADP
- Art. 33 FADP
- Art. 34 FADP
- Art. 35 FADP
- Art. 38 FADP
- Art. 39 FADP
- Art. 40 FADP
- Art. 41 FADP
- Art. 42 FADP
- Art. 43 FADP
- Art. 44 FADP
- Art. 44a FADP
- Art. 45 FADP
- Art. 46 FADP
- Art. 47 FADP
- Art. 47a FADP
- Art. 48 FADP
- Art. 49 FADP
- Art. 50 FADP
- Art. 51 FADP
- Art. 54 FADP
- Art. 57 FADP
- Art. 58 FADP
- Art. 60 FADP
- Art. 61 FADP
- Art. 62 FADP
- Art. 63 FADP
- Art. 64 FADP
- Art. 65 FADP
- Art. 66 FADP
- Art. 67 FADP
- Art. 69 FADP
- Art. 72 FADP
- Art. 72a FADP
-
- Art. 2 CCC (Convention on Cybercrime)
- Art. 3 CCC (Convention on Cybercrime)
- Art. 4 CCC (Convention on Cybercrime)
- Art. 5 CCC (Convention on Cybercrime)
- Art. 6 CCC (Convention on Cybercrime)
- Art. 7 CCC (Convention on Cybercrime)
- Art. 8 CCC (Convention on Cybercrime)
- Art. 9 CCC (Convention on Cybercrime)
- Art. 11 CCC (Convention on Cybercrime)
- Art. 12 CCC (Convention on Cybercrime)
- Art. 25 CCC (Convention on Cybercrime)
- Art. 29 CCC (Convention on Cybercrime)
- Art. 32 CCC (Convention on Cybercrime)
- Art. 33 CCC (Convention on Cybercrime)
- Art. 34 CCC (Convention on Cybercrime)
FEDERAL CONSTITUTION
CODE OF OBLIGATIONS
FEDERAL LAW ON PRIVATE INTERNATIONAL LAW
LUGANO CONVENTION
CODE OF CRIMINAL PROCEDURE
CIVIL PROCEDURE CODE
FEDERAL ACT ON POLITICAL RIGHTS
CIVIL CODE
FEDERAL ACT ON CARTELS AND OTHER RESTRAINTS OF COMPETITION
FEDERAL ACT ON INTERNATIONAL MUTUAL ASSISTANCE IN CRIMINAL MATTERS
DEBT ENFORCEMENT AND BANKRUPTCY ACT
FEDERAL ACT ON DATA PROTECTION
SWISS CRIMINAL CODE
CYBERCRIME CONVENTION
- In a nutshell
- I. General
- II. Prerequisites for a permissible pilot test (para. 1)
- III. Regulation of the pilot project in an ordinance.
- IV. Obligation to obtain the opinion of the FDPIC (para. 2)
- V. Evaluation and time limit of the pilot phase (para. 3 and 4)
- VI. Appraisal
- Bibliography
In a nutshell
The provision for conducting pilot tests allows personal data requiring special protection to be processed, even if no formal legal basis exists yet. The aim of the provision is to allow experimental data processing for a limited period of time if this is indispensable in order to address certain technical innovations, organizational issues or further uncertainties.
I. General
A. Background
1 The need for powerful applications not only in the so-called "e-areas," i.e., eGovernment or eHealth, but more generally in the context of governmental task fulfillment is growing with the digitization of our lives and activities.
2 Since digitization projects generally entail high investment costs, but at the same time it is often impossible to assess whether the applications in question can be implemented technically as hoped, opportunities must be provided for evaluating the design and, in particular, the networking of applications as part of pilot trials. Pilot tests are to be understood as tests to gain knowledge about the feasibility or acceptance of a project.
B. Purpose of the standard
3 Pilot tests must not lead to the principles of the rule of law being undermined. Even if, due to the experimental nature of data processing and the complexity of the legislative process, it is not yet possible at the time of the pilot project to fall back on the legal bases provided by the Constitution (with an appropriate level and density of norms), minimum legal requirements must nevertheless be observed.
4 Art. 35 FADP therefore allows the Federal Council to conduct pilot tests for a limited period of time, based only on an ordinance (and not on a law in the formal sense, as would be required for particularly sensitive personal data, Art. 34 para. 2 FADP).
C. History
5 As early as 1999, the motion "Increased protection for personal data in online connections" was submitted. It formed the basis for the later Art. 17a aDSG and the regulation of data processing in the context of pilot tests, in which the personal rights of the persons concerned could be particularly endangered. The content of Art. 35 FADP was incorporated into the new Data Protection Act largely unchanged and uncontested in the parliamentary deliberations.
II. Prerequisites for a permissible pilot test (para. 1)
6 Personal data requiring special protection or other data processing pursuant to Art. 34 (2) (b) and (c) FADP may only be processed as part of a pilot test and as an exception to the requirement of a legal basis if the following conditions are cumulatively met:
A. Task norm in a law in the formal sense (lit. a)
7 The tasks for the fulfillment of which the pilot project with the automated processing of personal data requiring special protection is to be required must already be regulated in a law in the formal sense at the time of the pilot project (see OK-Zysset on Art. 34 FADP), and the law must also already be in force.
8 It is not sufficient for the formal legal basis to merely regulate the tasks requiring processing. The requirement of norm density must be met, if not for the pilot project itself, then at least for the tasks underlying the project. The legal basis must thus describe the body that has access to the data, the specific purpose of the access, and the scope of the access authorization.
B. Limiting violations of privacy to a minimum (lit. b)
9 In order to minimize the risks posed by the pilot project to the data subjects, organizational, technical and legal measures must be taken, in particular to ensure data security. The protective measures must minimize the possible threat of personality violations. The new wording of Art. 35 (1) (b) FADP thus does justice to the fact that the risk of personality violations in the context of digitized data processing can de facto never be completely excluded.
C. Indispensability of the test phase (lit. c)
10 Pilot projects for the processing of personal data requiring special protection and the associated relativization of the principle of legality may not be initiated lightly: Art. 35 para. 1 lit. c FADP requires that the test phase is indispensable, in particular for technical reasons. At the same time, however, the legislator admits that there may well be other reasons, e.g. organizational reasons, which make a pilot test necessary for the processing of particularly sensitive personal data ("in particular").
11 Combinations of technical and organizational conditions are also conceivable, which would not justify recourse to Art. 35 FADP on their own, but together make a pilot test necessary, especially when it is a matter of testing information systems and checking interfaces across the federal levels, for example. And finally, the Covid pandemic has shown that there may also be unanticipated reasons to conduct a pilot test: Based on the then Art. 17a aDSG (in conjunction with Art. 78 para. 1 EpG), the Swiss Covid app was operated during a one-month trial phase to test the "newly developed solution approaches with regard to the decentralized nature of data processing and cryptographic methods, (the) stability of operation, (the) protection against unintentional or unauthorized manipulation, (the) user-friendliness (as well as the) comprehensibility of the information for the participants and for the professionals authorized to access it." In this case, and due to the urgency of the situation, the pilot phase lasted only from May 14, 2020 to June 25, 2020, after which the app was put into regular operation.
III. Regulation of the pilot project in an ordinance.
12 Even though Art. 35 FADP, in contrast to its predecessor provision Art. 17a para. 3 aDSG, no longer explicitly provides that the Federal Council must precisely regulate the pilot project in an ordinance, this obligation not only remains pursuant to Art. 33 para. 2 lit. e FADP (obligation of the competent federal body to consult the FDPIC in the context of the licensing procedure and to submit a draft ordinance to it): It derives from the principle of legality enshrined in Article 5 para. 1 FC, from which it can be deduced that a minimum level of control under the rule of law must be maintained even during a pilot project, or that serious encroachments on fundamental rights require at least a legal basis at the ordinance level, even in the case of pilot projects.
13 The ordinance must contain all those rules that would have to be adopted (outside of a pilot trial) at the level of laws and ordinances. It is important - especially with regard to the mandatory evaluation (n. 16) - that it is specified in advance as precisely as possible what exactly is to be tested.
IV. Obligation to obtain the opinion of the FDPIC (para. 2)
14 The pilot project must be submitted to the FDPIC for its opinion. This provision establishes an essential control mechanism that takes into account the fact that pilot projects may deviate from the constitutional principle of the standard level. As an element of the "checks and balances", the FDPIC is responsible at least for the plausibility check of the pilot project, the control of the protective mechanisms adopted, the review of the ordinance as well as regular evaluations. For this purpose, according to Art. 33 para. 2 and para. 3 FADP, the FDPIC must be provided with detailed information, in particular on the pilot project as such, the organizational and technical (security) measures, a draft or at least a concept for the ordinance that is to regulate the pilot test, as well as a project plan.
15 Even if the FDPIC cannot issue a binding opinion, it can be assumed that the Federal Council will generally follow the FDPIC's assessment.
V. Evaluation and time limit of the pilot phase (para. 3 and 4)
16 The pilot project must be evaluated at the latest within two years of going into operation (Art. 35 para. 3 FADP). In the evaluation report, the body responsible for the pilot test must explain to the Federal Council whether the project can already be transferred to a regular service, whether the pilot test should be continued (but note the maximum time limit of five years, n. 17) or whether the project should be discontinued.
17 Overall, the pilot phase may last a maximum of five years (Art. 35(4) FADP). This time limit cannot be extended, not even if the pilot is to be converted into a regular service but no legal basis has yet been developed - "regular" operation based on a mere draft is not permissible for reasons of the rule of law.
VI. Appraisal
18 Although Art. 17a of the FADP has only been used very rarely to date and the Federal Council asserts that it will only make use of Art. 35 of the FADP in exceptional cases, it can be assumed that the digital transformation of the administration will also lead to more frequent use of the pilot test provision. This may well be in the interests of the digital further development of the federal administration, but it should not be forgotten that the application of Art. 17a aDSG or Art. 35 FADP is always accompanied by an undermining of the principle of legality. An overly generous recourse to Art. 35 FADP, without, for example, a task norm in the formal sense existing or the indispensability of the test phase having been seriously examined, should therefore be avoided. After all, it cannot be denied that pilot projects are always accompanied by high investment costs - the decision not to continue operating a system after the end of the test phase should therefore not only be difficult, but also rare.
The author gives her personal assessment in this commentary.
Bibliography
Husi-Stämpfli Sandra, Kommentierung zu Art. 35, in: Baeriswyl Bruno/Pärli Kurt/Blonski Dominika (Hrsg.), Datenschutzgesetz, Stämpflis Handkommentar, 2. Aufl., Bern 2023.
Huber René, die Teilrevision des Eidg. Datenschutzgesetzes, ungenügende Pinselrenovation, in: recht 2006, S. 205.
Schäfer Marc Frédéric, Kommentierung zu Art. 17a DSG, in: Maurer-Lambrou Urs/Blechta Gabor-Paul (Hrsg.), Datenschutzgesetz / Öffentlichkeitsgesetz, Basler Kommentar, 3. Aufl., Basel 2014.
Oberlin Jutta Sonja/Kessler Rainer, Daten: Die Schlüsselrolle im Kampf gegen die Coronavirus-Pandemie?, in: jusletter 16.11.2020.
Rosenthal David/Jöhri Yvonne, Handkommentar zum Datenschutzgesetz sowie weiteren, ausgewählten Bestimmungen, Zürich 2008.
Vokinger Kerstin Noëlle, Die digitale Bekämpfung von Covid-19 und die Rolle des Bundes(rates), SJZ 116/2020, S. 412.