-
- Art. 5a FC
- Art. 6 FC
- Art. 10 FC
- Art. 16 FC
- Art. 17 FC
- Art. 20 FC
- Art. 22 FC
- Art. 29a FC
- Art. 30 FC
- Art. 32 FC
- Art. 42 FC
- Art. 43 FC
- Art. 43a FC
- Art. 55 FC
- Art. 56 FC
- Art. 60 FC
- Art. 68 FC
- Art. 75b FC
- Art. 77 FC
- Art. 96 para. 2 lit. a FC
- Art. 110 FC
- Art. 117a FC
- Art. 118 FC
- Art. 123b FC
- Art. 136 FC
- Art. 166 FC
-
- Art. 11 CO
- Art. 12 CO
- Art. 50 CO
- Art. 51 CO
- Art. 84 CO
- Art. 143 CO
- Art. 144 CO
- Art. 145 CO
- Art. 146 CO
- Art. 147 CO
- Art. 148 CO
- Art. 149 CO
- Art. 150 CO
- Art. 701 CO
- Art. 715 CO
- Art. 715a CO
- Art. 734f CO
- Art. 785 CO
- Art. 786 CO
- Art. 787 CO
- Art. 788 CO
- Transitional provisions to the revision of the Stock Corporation Act of June 19, 2020
- Art. 808c CO
-
- Art. 2 PRA
- Art. 3 PRA
- Art. 4 PRA
- Art. 6 PRA
- Art. 10 PRA
- Art. 10a PRA
- Art. 11 PRA
- Art. 12 PRA
- Art. 13 PRA
- Art. 14 PRA
- Art. 15 PRA
- Art. 16 PRA
- Art. 17 PRA
- Art. 19 PRA
- Art. 20 PRA
- Art. 21 PRA
- Art. 22 PRA
- Art. 23 PRA
- Art. 24 PRA
- Art. 25 PRA
- Art. 26 PRA
- Art. 27 PRA
- Art. 29 PRA
- Art. 30 PRA
- Art. 31 PRA
- Art. 32 PRA
- Art. 32a PRA
- Art. 33 PRA
- Art. 34 PRA
- Art. 35 PRA
- Art. 36 PRA
- Art. 37 PRA
- Art. 38 PRA
- Art. 39 PRA
- Art. 40 PRA
- Art. 41 PRA
- Art. 42 PRA
- Art. 43 PRA
- Art. 44 PRA
- Art. 45 PRA
- Art. 46 PRA
- Art. 47 PRA
- Art. 48 PRA
- Art. 49 PRA
- Art. 50 PRA
- Art. 51 PRA
- Art. 52 PRA
- Art. 53 PRA
- Art. 54 PRA
- Art. 55 PRA
- Art. 56 PRA
- Art. 57 PRA
- Art. 58 PRA
- Art. 59a PRA
- Art. 59b PRA
- Art. 59c PRA
- Art. 62 PRA
- Art. 63 PRA
- Art. 67 PRA
- Art. 67a PRA
- Art. 67b PRA
- Art. 75 PRA
- Art. 75a PRA
- Art. 76 PRA
- Art. 76a PRA
- Art. 90 PRA
-
- Vorb. zu Art. 1 FADP
- Art. 1 FADP
- Art. 2 FADP
- Art. 3 FADP
- Art. 5 lit. f und g FADP
- Art. 6 Abs. 6 and 7 FADP
- Art. 7 FADP
- Art. 10 FADP
- Art. 11 FADP
- Art. 12 FADP
- Art. 14 FADP
- Art. 15 FADP
- Art. 19 FADP
- Art. 20 FADP
- Art. 22 FADP
- Art. 23 FADP
- Art. 25 FADP
- Art. 26 FADP
- Art. 27 FADP
- Art. 31 para. 2 lit. e FADP
- Art. 33 FADP
- Art. 34 FADP
- Art. 35 FADP
- Art. 38 FADP
- Art. 39 FADP
- Art. 40 FADP
- Art. 41 FADP
- Art. 42 FADP
- Art. 43 FADP
- Art. 44 FADP
- Art. 44a FADP
- Art. 45 FADP
- Art. 46 FADP
- Art. 47 FADP
- Art. 47a FADP
- Art. 48 FADP
- Art. 49 FADP
- Art. 50 FADP
- Art. 51 FADP
- Art. 54 FADP
- Art. 57 FADP
- Art. 58 FADP
- Art. 60 FADP
- Art. 61 FADP
- Art. 62 FADP
- Art. 63 FADP
- Art. 64 FADP
- Art. 65 FADP
- Art. 66 FADP
- Art. 67 FADP
- Art. 69 FADP
- Art. 72 FADP
- Art. 72a FADP
-
- Art. 2 CCC (Convention on Cybercrime)
- Art. 3 CCC (Convention on Cybercrime)
- Art. 4 CCC (Convention on Cybercrime)
- Art. 5 CCC (Convention on Cybercrime)
- Art. 6 CCC (Convention on Cybercrime)
- Art. 7 CCC (Convention on Cybercrime)
- Art. 8 CCC (Convention on Cybercrime)
- Art. 9 CCC (Convention on Cybercrime)
- Art. 11 CCC (Convention on Cybercrime)
- Art. 12 CCC (Convention on Cybercrime)
- Art. 25 CCC (Convention on Cybercrime)
- Art. 29 CCC (Convention on Cybercrime)
- Art. 32 CCC (Convention on Cybercrime)
- Art. 33 CCC (Convention on Cybercrime)
- Art. 34 CCC (Convention on Cybercrime)
FEDERAL CONSTITUTION
CODE OF OBLIGATIONS
FEDERAL LAW ON PRIVATE INTERNATIONAL LAW
LUGANO CONVENTION
CODE OF CRIMINAL PROCEDURE
CIVIL PROCEDURE CODE
FEDERAL ACT ON POLITICAL RIGHTS
CIVIL CODE
FEDERAL ACT ON CARTELS AND OTHER RESTRAINTS OF COMPETITION
FEDERAL ACT ON INTERNATIONAL MUTUAL ASSISTANCE IN CRIMINAL MATTERS
DEBT ENFORCEMENT AND BANKRUPTCY ACT
FEDERAL ACT ON DATA PROTECTION
SWISS CRIMINAL CODE
CYBERCRIME CONVENTION
- In a nutshell
- I. General
- II. Scope of application
- III. Sovereign and private-law action by the state
- IV. Legal Consequences
- V. Casuistry
- Bibliography
- Materials
In a nutshell
Art. 40 FADP applies when federal bodies act under private law within the meaning of Art. 5 lit. i FADP. This is possible if an area is not conclusively regulated by public law and thus leaves room for private law actions. In order to determine this in individual cases, the existence of a special legal regulation must first be examined and then a distinction made between sovereign and private law actions. With administrative support activities, the administration of financial assets, private-sector state activities and parts of the administration of services, areas have emerged in which private-law action by the public sector is normally permissible and relevant. If there is private-law action, federal bodies are subject to the provisions for private individuals in the case of corresponding data processing.
However, even when applying Art. 40 FADP, public authorities acting under private law may never completely dispense with constitutional principles. For example, the obligation to respect fundamental rights or the principle of legality continue to apply.
I. General
A. Preliminary Remarks
1 Art. 40 FADP remains unchanged from the previous version (Art. 23 para. 1 aDSG) and has undergone only minor editorial changes.
2 The previous second paragraph, according to which supervision is governed by the provisions for federal bodies (Art. 23 para. 2 aDSG), has been deleted without replacement. The reason for this is that the version of the FADP commented on here already provides for the same supervisory system for private persons and federal bodies.
B. Purpose of the Norm and Background
3 The FADP is designed as a uniform law and regulates data processing by private persons and by federal bodies in only one decree. As part of the public sector, federal bodies are generally subject to stricter legal requirements, which also applies to the processing of personal data and data protection obligations (see Art. 5 lit. i FADP).
4Art. 40 FADP breaks this dichotomy. The provision stipulates that federal bodies acting under private law are subject to the less strict data protection provisions for private individuals (in particular Chapter 5 FADP). The provision is intended to ensure that federal bodies do not experience any disadvantages compared to private competitors when participating in economic competition. The legislator is thus addressing the fact that federal bodies, as subjects of private law, do not exercise sovereignty and that there is sometimes no relationship of subordination vis-à-vis private parties that could be compensated for by a stricter legal dress.
5Art. 40 FADP is to a certain extent the counterpart to Art. 5 lit. i FADP, according to which private individuals who perform public duties are subject to the stricter provisions for federal bodies (cf. the commentary on Art. 5 lit. i FADP).
C. Genesis
6The Federal Council's draft of the first Federal Data Protection Act of 1988 already provided for private-law activities by federal bodies to be subject to the provisions for private individuals. This principle is still valid and unchanged.
7In the parliamentary deliberations on the 1988 draft, the Council of States argued that federal bodies should remain subject to the provisions for federal bodies even when acting under private law. This was subject to the proviso that the Federal Council be granted the authority to regulate exceptional situations. The Council of States was concerned that less restrictive data protection provisions should not make it unnecessarily attractive for the public sector to act under private law. And it should be ensured that private-law action by federal bodies - should it occur in exceptional cases - is based on a legal foundation. After the National Council supported the Federal Council's draft, the Council of States finally agreed to it. However, it imposed the condition that the requirements for the legal basis of federal bodies acting under private law be tightened.
8The original version of the FADP 1988 stipulated that the supervision of federal bodies would not be relaxed in the area of private-law activities. Thus, the same supervisory possibilities were to remain in place. In the version commented on here, however, this provision (Art. 23 para. 2 aDSG) was deleted without replacement. The reason for this is the standardization of the supervisory regime for private and federal bodies.
II. Scope of application
9Art. 40 FADP ties in with the concept of a federal body. According to Art. 5 lit. i FADP, federal bodies are authorities and departments of the Confederation as well as private persons entrusted with public duties (for details, see the commentary on Art. 5 lit. i FADP).
10 In principle, the provisions specific to federal bodies are applicable to them (esp. Chapter 6 FADP). However, in the event that a federal body acts in a private capacity, it is subject to the provisions for private individuals pursuant to Art. 40 FADP (esp. Chapter 5 FADP).
III. Sovereign and private-law action by the state
A. Categorization of State Action
11 As diverse as the manifestations of state action itself are, so are the views on how state action should be subdivided and categorized. In the context of Art. 40 FADP, the division into "sovereign action" and "private action" is relevant because the provision conditions private action. The pair of terms acts as a counterpart to each other and describes the form of state action, not its object and content.
B. Sovereign Action as a Principle
12 In principle, the state acts in a sovereign manner in the performance of its duties. Sovereign action includes the power to unilaterally determine the rights and obligations of private parties and is accompanied by a superiority of the state over private parties (subordination relationship). An example of sovereign action is the issuance of decrees in return for the conclusion of contracts under private law.
13 The state acts in a sovereign manner, for example, in the area of intervention administration. This involves interfering with the rights and freedoms of private individuals, who must tolerate this. It directly serves the fulfillment of public tasks. Examples include expropriation or police restrictions on land ownership. The state also acts in a sovereign manner in parts of the administration of services, i.e. when state services of an economic and social nature are provided to private individuals (e.g. the provision of state social security). It also directly serves the fulfillment of public tasks.
C. Private Law Action
1. Basic principles
14 It is undisputed that the public sector can also act under private law in certain constellations. However, whether there is room for the state to act under private law must be determined on a case-by-case basis. The starting point is that the state is always bound by the principle of legality in its actions (cf. Art. 5 para. 1 FC). In principle, it therefore has no autonomy in shaping its legal relations. If an area of law is conclusively regulated by public law, there is thus no room for maneuver for action under private law. This is only possible under the following conditions:
There is no conclusive regulation under public law.
Private law action is the appropriate form of action for the respective area of responsibility.
15 In the context of Art. 40 FADP, action under private law by a federal body is also decisive. Private-law action is characterized, as described, by the fact that no public-law norm applies to an activity, no subordination relationship exists as a result and the state and third parties deal on the same level (e.g. conclusion of a contract under private law). The existence of a competitive relationship with private parties, on the other hand, is not necessary under Art. 40 FADP.
16 In the area of data protection law, the legal nature of the basic relationship with the data subject is taken into account for the demarcation between private and public law actions. This distinction is often not trivial. The pluralism of methods can serve as an aid (see infra n. 18). In addition, certain case constellations have developed in which the state normally acts under private law (see infra n. 21 ff.).
2. Delimitation in accordance with methodological pluralism
17 In accordance with the principle of legality, in order to assign the basic relationship between the person concerned and the public body to public or private law, it must first be examined whether a solution exists under special law to regulate this question (see supra n. 14).
18 If this is not the case or if the interpretation of the regulation leaves doubts, the delimitation criteria developed in doctrine and practice can be consulted. According to this pluralism of methods, the following points are examined:
Interest theory: Does the legal relationship predominantly serve the pursuit of private or public interests?
Subordination theory: Does the acting state institution act in a sovereign and thus superior manner vis-à-vis the private parties?
Functional theory: Does the legal relationship have as its object the fulfillment of a public task?
Modal theory: Is a violation sanctioned by civil or public law?
19 According to practice, it must be examined separately for each individual case which theory is best suited for the delimitation. According to case law of the highest courts, for example, the functional theory is considered the most suitable for assessing the legal nature of contracts.
3. Cases of permissible private law action
20 In practice, certain areas of activity have emerged in which the public authority normally (permissibly) acts under private law.
21 In the case of administrative support activities (also known as demand management), the public authority procures the necessary material and personnel resources that it needs for the direct fulfillment of public tasks. The administrative support activity serves only indirectly to perform public tasks. For the implementation of these tasks, the public authority concludes contracts under private law.
22 The financial assets of the general government include all realizable assets. They serve the public authority only indirectly for the realization of the public task and in its management it acts under private law. Examples are the leasing of real estate on the open market or trading in securities for investment purposes.
23 If the public sector acts under private law, it participates in economic life and is in a competitive relationship with the private sector. In the external relationship, i.e. in interaction with the competition, the public authority acts under private law. Examples are the operation of a municipal restaurant or certain business areas of the cantonal banks.
24 In the case of service administration, the public authority provides economic services for private individuals. It acts under private law if the provision of services only indirectly serves the pursuit of public interests, as in the case of transport contracts for public transport or contracts for the supply of energy. On the other hand, it acts in a sovereign manner when it provides IV pensions.
IV. Legal Consequences
A. Applicable data protection provisions
25 If the matter concerns an area of permissible action under private law by the state, the data protection provisions for private individuals apply to federal bodies (Art. 40 FADP). Specifically, this means that in addition to the general provisions (Chapter 2), the special provisions for private individuals (Chapter 5) apply.
26 Federal bodies acting under private law are thus bound by less strict provisions. This is characterized, for example, by the lack of application of Art. 34 FADP, which requires the existence of a legal basis for data processing by federal bodies. A further consequence is the applicability of the mechanism under Art. 31 f. FADP, according to which certain violations of privacy can be cured by suitable grounds for justification (legal basis, overriding private or public interest, consent).
27 However, even within the framework of Art. 40 FADP, there is no complete decoupling from the legal regime for federal bodies. Certain constitutional principles must also be observed by federal bodies acting under private law (cf. infra n. 31 ff.).
B. Procedural
28 The provisions of private law also apply to the enforcement of rights if Art. 40 FADP is applicable. If a data subject wishes to take legal action to enforce data subject rights or other claims against a federal body acting under private law, the provisions of Chapter 5 of the FADP apply.
29 In the case of legal proceedings, the civil courts have jurisdiction in the action. The procedure is governed by the Code of Civil Procedure.
C. Further applicability of public law
1. Constitutional principles
30Despite the application of Art. 40 FADP, the commitment to constitutional principles (see Art. 5 FC) may not be lightly abandoned. In the case of private-law actions by federal bodies, it must always be examined whether they comply with these overriding principles.
31 First and foremost, attention must be paid to the principle of legality (Art. 5 para. 1 FC). This fulfills both a democratic and a constitutional function. Under the private law regime of the FADP, the lawful implementation of the principle of transparency, the duty to inform or the obtaining of consent can compensate for the rule of law function in certain cases. The democratic function, on the other hand, cannot be replaced by the aforementioned obligations (cf. also Art. 34 of this Commentary, in particular the excursus on consent).
2. Commitment to fundamental rights
32In the area of fundamental rights, too, there is no need for a complete alignment with private parties if the state acts under private law in accordance with Art. 40 FADP. The community as well as private individuals who perform public duties are always bound by fundamental rights in their actions and must contribute to their realization. After this principle was initially the subject of supreme court rulings, it was expressly laid down in the Federal Constitution of 1999 in Art. 35 para. 2 FC. For the fundamental rights obligation, it is also not private or sovereign action that is decisive, but - more broadly - whether a public task is performed (Art. 35 para. 2 FC speaks of "state task").
3. Two-Tier Theory in the Submission Procedure
33In order to distinguish between private and sovereign action, the two-stage theory is sometimes used in the submission procedure. It states that the award (formation of will) is made by means of a decree and is thus of a public-law nature, while the contract with the successful tenderer is of a private-law nature.
34 However, the two-stage theory has not been recognized by the supreme court case law. In any case, delimitation difficulties also arise in the context of data protection law: In light of Art. 40 FADP, application of the two-tier theory would mean that data processing up to and after the award would be subject to different legal regimes. However, such a strict separation of data processing entails considerable (technical) difficulties in practice.
35 In the sense of a solution that is not only pragmatic, but also constitutionally justifiable, it must therefore be assumed that the more restrictive data protection provisions for federal bodies will be applied globally to tender procedures. In this area, too, the state acting under private law must not be treated lightly and entirely on an equal footing with private parties.
V. Casuistry
36 The "SwissPass" ruling of the Federal Administrative Court provides an example of the procedure described above for examining the existence of private-sector action under Art. 40 FADP. In this case, the court had to assess whether the issuance of a SwissPass and the related data processing by SBB were subject to public or private law.
37 First of all, the special legal regulation for the area of passenger transport is relevant, according to which transport companies - irrespective of their legal form - are subject to the provisions for federal bodies for licensed and authorized activities and, in the case of private-law activities, to those for private persons (Art. 54 PBG). It follows that transport companies can also act under private law in the licensed area and must comply with the data protection regulations for private individuals.
38According to the Federal Administrative Court, the issuance of the SwissPass does not directly serve the purpose of concessionary passenger transport, since it can also be issued without public transport services. However, since the SwissPass is an aid for the conclusion of a passenger transport contract, the court nevertheless took into account its legal nature. Applying the pluralism of methods and, in particular, the theory of functions, the court qualified the passenger transport contract as civil law and deduced from this that SBB was subject to the data protection regulations for private individuals when issuing the SwissPass.
39 As a result, the judgment is correct and private-law action by SBB appears to be permitted and relevant in the specific case. Two points should then be noted:
On the one hand, the court also included in its considerations the "fulfillment of a public task" as a criterion, which has no place in a strict interpretation of Art. 40 FADP. According to the wording, the norm is based solely on the legal form of the action. The two concepts of "public task" and "private-law or sovereign action" must be separated as a matter of principle.
Despite this principle, it is argued here that a pure focus on the legal nature of the basic relationship between the person concerned and the public body can lead to a circumvention of overriding public law standards. The actions and, in the present context, the processing of personal data by federal bodies may not be measured solely by their choice of form of action. The action must be placed in a larger, constitutional context. Thus, Art. 40 FADP is not applicable at all if it does not concern a federal body, including private parties performing public tasks. In the present opinion, the Federal Administrative Court's assessment of the transport contract on the basis of the pluralism of methods and, sometimes, the theory of functions is therefore consistent and prevents any circumvention of principles of public law.
Bibliography
Bühlmann Lukas/Schüepp Michael, Information, Einwilligung und weitere Brennpunkte im (neuen) Schweizer Datenschutzrecht, Jusletter 15.3.2021.
Fey Marco, Kommentierung zu Art. 40 DSG, in: Baeriswyl Bruno/Pärli Kurt/Blonski Dominika (Hrsg.), Datenschutzgesetz, Stämpflis Handkommentar, 2. Aufl., Bern 2022 (zit. SHK DSG-Bearbeiterin).
Häfelin Ulrich/Müller Georg/Uhlmann Felix, Allgemeines Verwaltungsrecht, 8. Aufl., Zürich et al. 2020.
Kunz Simon, Kommentierung zu Art. 23 DSG, in: Maurer-Lambrou Urs/Blechta Gabor-Paul (Hrsg.), Datenschutzgesetz/Öffentlichkeitsgesetz, Basler Kommentar, 3. Aufl., Basel 2014 (zit. BSK-Bearbeiterin).
Rosenthal David/Jöhri Yvonne, Handkommentar zum Datenschutzgesetz sowie weiteren, ausgewählten Bestimmungen, Zürich 2008 (zit. Rosenthal/Jöhri).
Rudin Beat, Kommentierung zu Art. 2 DSG, in: Baeriswyl Bruno/Pärli Kurt/Blonski Dominika (Hrsg.), Datenschutzgesetz, Stämpflis Handkommentar, 2. Aufl., Bern 2022 (zit. SHK DSG-Bearbeiterin).
Rütsche Bernhard, Was sind öffentliche Aufgaben?, recht 2013, S. 153-162.
Materials
Botschaft zum Bundesgesetz über die Totalrevision des Bundesgesetzes über den Datenschutz (DSG) und die Änderung weiterer Erlasse zum Datenschutz vom 15.9.2017, BBl 2017 S. 6941 ff., abrufbar unter https://www.fedlex.admin.ch/eli/fga/2017/2057/de, besucht am 6.5.2023 (zit. Botschaft 2017).
Botschaft zum Bundesgesetz über den Datenschutz (DSG) vom 23.3.1988, BBl 1988 II S. 413 ff., abrufbar unter https://www.fedlex.admin.ch/eli/fga/1988/2_413_421_353/de, besucht am 6.5.2023 (zit. Botschaft 1988).
Sitzung des Ständerats zum Datenschutzgesetz vom 14.3.1990, Amtl. Bull. NR 1990 S. 149 ff. (zit. Amtl. Bull. SR 1990).
Sitzung des Nationalrats zum Datenschutzgesetz vom 10.3.1992, Amtl. Bull. NR 1992 S. 381 ff. (zit. Amtl. Bull. NR 1922).
Sitzung des Ständerats zum Datenschutzgesetz vom 18.3.1992, Amtl. Bull. SR S. 228 ff. (zit. Amtl. Bull. SR 1922).