-
- Art. 5a FC
- Art. 6 FC
- Art. 10 FC
- Art. 16 FC
- Art. 17 FC
- Art. 20 FC
- Art. 22 FC
- Art. 29a FC
- Art. 30 FC
- Art. 32 FC
- Art. 42 FC
- Art. 43 FC
- Art. 43a FC
- Art. 55 FC
- Art. 56 FC
- Art. 60 FC
- Art. 68 FC
- Art. 75b FC
- Art. 77 FC
- Art. 96 para. 2 lit. a FC
- Art. 110 FC
- Art. 117a FC
- Art. 118 FC
- Art. 123b FC
- Art. 136 FC
- Art. 166 FC
-
- Art. 11 CO
- Art. 12 CO
- Art. 50 CO
- Art. 51 CO
- Art. 84 CO
- Art. 143 CO
- Art. 144 CO
- Art. 145 CO
- Art. 146 CO
- Art. 147 CO
- Art. 148 CO
- Art. 149 CO
- Art. 150 CO
- Art. 701 CO
- Art. 715 CO
- Art. 715a CO
- Art. 734f CO
- Art. 785 CO
- Art. 786 CO
- Art. 787 CO
- Art. 788 CO
- Transitional provisions to the revision of the Stock Corporation Act of June 19, 2020
- Art. 808c CO
-
- Art. 2 PRA
- Art. 3 PRA
- Art. 4 PRA
- Art. 6 PRA
- Art. 10 PRA
- Art. 10a PRA
- Art. 11 PRA
- Art. 12 PRA
- Art. 13 PRA
- Art. 14 PRA
- Art. 15 PRA
- Art. 16 PRA
- Art. 17 PRA
- Art. 19 PRA
- Art. 20 PRA
- Art. 21 PRA
- Art. 22 PRA
- Art. 23 PRA
- Art. 24 PRA
- Art. 25 PRA
- Art. 26 PRA
- Art. 27 PRA
- Art. 29 PRA
- Art. 30 PRA
- Art. 31 PRA
- Art. 32 PRA
- Art. 32a PRA
- Art. 33 PRA
- Art. 34 PRA
- Art. 35 PRA
- Art. 36 PRA
- Art. 37 PRA
- Art. 38 PRA
- Art. 39 PRA
- Art. 40 PRA
- Art. 41 PRA
- Art. 42 PRA
- Art. 43 PRA
- Art. 44 PRA
- Art. 45 PRA
- Art. 46 PRA
- Art. 47 PRA
- Art. 48 PRA
- Art. 49 PRA
- Art. 50 PRA
- Art. 51 PRA
- Art. 52 PRA
- Art. 53 PRA
- Art. 54 PRA
- Art. 55 PRA
- Art. 56 PRA
- Art. 57 PRA
- Art. 58 PRA
- Art. 59a PRA
- Art. 59b PRA
- Art. 59c PRA
- Art. 62 PRA
- Art. 63 PRA
- Art. 67 PRA
- Art. 67a PRA
- Art. 67b PRA
- Art. 75 PRA
- Art. 75a PRA
- Art. 76 PRA
- Art. 76a PRA
- Art. 90 PRA
-
- Vorb. zu Art. 1 FADP
- Art. 1 FADP
- Art. 2 FADP
- Art. 3 FADP
- Art. 5 lit. f und g FADP
- Art. 6 Abs. 6 and 7 FADP
- Art. 7 FADP
- Art. 10 FADP
- Art. 11 FADP
- Art. 12 FADP
- Art. 14 FADP
- Art. 15 FADP
- Art. 19 FADP
- Art. 20 FADP
- Art. 22 FADP
- Art. 23 FADP
- Art. 25 FADP
- Art. 26 FADP
- Art. 27 FADP
- Art. 31 para. 2 lit. e FADP
- Art. 33 FADP
- Art. 34 FADP
- Art. 35 FADP
- Art. 38 FADP
- Art. 39 FADP
- Art. 40 FADP
- Art. 41 FADP
- Art. 42 FADP
- Art. 43 FADP
- Art. 44 FADP
- Art. 44a FADP
- Art. 45 FADP
- Art. 46 FADP
- Art. 47 FADP
- Art. 47a FADP
- Art. 48 FADP
- Art. 49 FADP
- Art. 50 FADP
- Art. 51 FADP
- Art. 54 FADP
- Art. 57 FADP
- Art. 58 FADP
- Art. 60 FADP
- Art. 61 FADP
- Art. 62 FADP
- Art. 63 FADP
- Art. 64 FADP
- Art. 65 FADP
- Art. 66 FADP
- Art. 67 FADP
- Art. 69 FADP
- Art. 72 FADP
- Art. 72a FADP
-
- Art. 2 CCC (Convention on Cybercrime)
- Art. 3 CCC (Convention on Cybercrime)
- Art. 4 CCC (Convention on Cybercrime)
- Art. 5 CCC (Convention on Cybercrime)
- Art. 6 CCC (Convention on Cybercrime)
- Art. 7 CCC (Convention on Cybercrime)
- Art. 8 CCC (Convention on Cybercrime)
- Art. 9 CCC (Convention on Cybercrime)
- Art. 11 CCC (Convention on Cybercrime)
- Art. 12 CCC (Convention on Cybercrime)
- Art. 25 CCC (Convention on Cybercrime)
- Art. 29 CCC (Convention on Cybercrime)
- Art. 32 CCC (Convention on Cybercrime)
- Art. 33 CCC (Convention on Cybercrime)
- Art. 34 CCC (Convention on Cybercrime)
FEDERAL CONSTITUTION
CODE OF OBLIGATIONS
FEDERAL LAW ON PRIVATE INTERNATIONAL LAW
LUGANO CONVENTION
CODE OF CRIMINAL PROCEDURE
CIVIL PROCEDURE CODE
FEDERAL ACT ON POLITICAL RIGHTS
CIVIL CODE
FEDERAL ACT ON CARTELS AND OTHER RESTRAINTS OF COMPETITION
FEDERAL ACT ON INTERNATIONAL MUTUAL ASSISTANCE IN CRIMINAL MATTERS
DEBT ENFORCEMENT AND BANKRUPTCY ACT
FEDERAL ACT ON DATA PROTECTION
SWISS CRIMINAL CODE
CYBERCRIME CONVENTION
- In a nutshell
- I. General
- II. Claim and procedural requirements
- III. The requests
- IV. Exemption provision (para. 5)
- V. Administrative procedural law (para. 6)
- Bibliography
- Materials
In a nutshell
If a person is of the opinion that a federal body is violating the applicable provisions of the FADP when processing personal data, Art. 41 FADP (together with the right to information pursuant to Art. 25 FADP) provides them with the necessary rights to enforce lawful data processing against the responsible federal body. In particular, it can demand that the federal body refrain from unlawful data processing, remedy the consequences of unlawful processing or establish the unlawfulness of the processing (Art. 41 para. 1 FADP). The article provides for exceptions, such as in particular the restriction of processing (Art. 41 para. 3 FADP). The decision of the federal body to refuse or grant or reject these claims is issued in the form of an order, which in turn, if the necessary requirements are met, can be contested in accordance with the rules of general federal administration of justice.
I. General
A. Preliminary remarks
1 If a federal body processes personal data, this constitutes an interference with the fundamental right of informational self-determination of the person concerned in accordance with Art. 13 para. 2 FC and Art. 8 ECHR. For this reason, federal authorities may only process personal data to a limited extent in compliance with the processing principles pursuant to Art. 6 FADP and in particular Art. 34 et seq. FADP at all. In particular, they require a legal basis for this.
2 Data processing by a federal authority generally constitutes real acts. Art. 41 FADP grants the data subject (and possibly also third parties, see N. 8) a number of claims by means of which they can demand that the lawfulness of data processing be restored or that the unlawfulness at least be established. At least in the case of a (partially) dismissive decision, the data subject thus obtains a contestable order.
3The individual legal protection under Art. 41 FADP, which only comes into effect in the event of an active claim by the data subject, must be distinguished from the supervisory rights of the Federal Data Protection and Information Commissioner (see the comments on Art. 49 et seq. FADP). Within the scope of his supervisory powers, the FDPIC is authorized to conduct ex officio investigations and issue rulings, which also protects persons who cannot or do not wish to take legal action against an errant federal body (e.g. because they have no knowledge of the unlawfulness or of the data processing itself).
B. History of origin
4According to the Federal Council's dispatch on the original FADP of 1992, the proposed legal system was to be based on the private-law actions of Art. 28a CC, but was also to be integrated into the administrative procedural law in force at the time. The Councils did not subsequently question this concept proposed by the Federal Council and only made a few changes.
5The provision underwent some changes as a result of the revision, which came into force on September 1, 2023. In particular, an explicit right to erasure and the restriction of processing were included. These amendments and additions proposed by the Federal Council were adopted by the Councils without further ado.
II. Claim and procedural requirements
6The addressee of the claim is the responsible federal body that processes the data or has it processed in order to fulfill its legal mandate. Not only the federal authorities are deemed to be a federal body, but also private individuals who perform public-law tasks for the Confederation (see explanations on Art. 5 lit. i FADP). This means, for example, that claims arising from unlawful data processing against a pension fund, which is organized as a foundation under private law but offers mandatory occupational pension provision in accordance with the BVG and is therefore considered a federal body, must be asserted in accordance with Art. 41 FADP (and not Art. 32 FADP).
7It should be noted that the enforcement of a claim against a federal body has no binding effect on other federal bodies (see N. 21 on notification to third parties or publication); they must therefore be enforced individually against each responsible federal body that processes data.
8Any person who has an interest worthy of protection is entitled to make a claim. Whether such an interest exists is assessed in accordance with the general principles of administrative procedure. The interest worthy of protection is also not limited to personal interests and does not have to coincide with the interest protected by the infringed norm. The only requirement is that the applicant has a current legal or factual interest in the outcome of the proceedings he has initiated and that this can bring him a direct, practical benefit. They must have a special relationship to the subject matter of the dispute and therefore be more affected than the general public.
9 In the case of the person concerned, an interest worthy of protection will generally be given. However, exceptions are possible, e.g. if the federal body no longer processes the data at all, which would render the request irrelevant. In a few constellations, it is also conceivable that third parties whose data is not processed at all can demonstrate an interest worthy of protection. However, this is usually only the case if such a third party is a close relative or friend of the (deceased) person concerned and can invoke the protection of memory recognized by the Federal Supreme Court.
III. The requests
A. Prerequisite of unlawfulness
10 Pursuant to Art. 41 para. 1 FADP, the applicant may request the omission of unlawful data processing, the elimination of the consequences of unlawful data processing or the determination of the unlawfulness of data processing.
11 What these claims have in common is that they presuppose that the data processing is unlawful . This is in contrast to the objection to the disclosure of personal data under Art. 37 FADP; here, only an interest of the data subject worthy of protection is decisive, but not the unlawfulness of the disclosure (see the commentary on Art. 37 FADP).
12 Unlawfulness may consist, among other things, in the fact that the federal body does not have a sufficient legal basis for the corresponding data processing. For example, the Federal Administrative Court ruled that a pension fund that sends unsealed pension certificates directly to the employer is acting unlawfully because such disclosure is not necessary for the implementation of occupational pension provision in accordance with the BVG and no other legal basis (in particular Art. 86a BVG, which regulates the disclosure of data within the framework of the BVG) would legitimize this. In addition, the processing of incorrect data is also unlawful if the responsible federal body does not comply with its duty of verification in this regard (see commentary on Art. 6 para. 5 FADP).
B. Right to injunctive relief (para. 1 lit. a and para. 2 lit. a)
1. General
13 The claim for injunctive relief requires that at the time of assertion there is a serious fear that the responsible federal body will carry out certain unlawful data processing in the near future. Such a serious fear may exist if the federal body is already processing the data and this is continuing, or if there are concrete indications that the data will be processed unlawfully in a certain way in the near future. Only then, according to the case law of the Federal Supreme Court, can the current legal interest in injunctive relief be affirmed.
14 If these conditions are met, however, the data subject can not only demand that the federal body refrain from unlawful data processing. Rather, they can also request the restoration of lawfulness, in particular by requesting rectification, erasure or destruction of the data concerned on the basis of Art. 41 para. 2 lit. a FADP.
2. Rectification and confirmation (para. 4)
15 The processing of inaccurate personal data is only unlawful if the inaccuracy is due to a breach of the duty of verification pursuant to Art. 6 para. 5 FADP. A federal body processing data must therefore take appropriate measures ex officio to ensure the accuracy of the data at the time the data is collected or during the processing period (see commentary on Art. 6 para. 5 FADP). Even if it does so, data processing becomes unlawful at least at the moment the data subject approaches the federal body with a claim for rectification and the latter fails to sufficiently clarify the accuracy or inaccuracy again.
16 If the accuracy or inaccuracy of the data cannot be established or cannot be established without further ado despite the data subject's substantiated request for rectification, the federal body must restrict processing in accordance with Art. 41 para. 3 FADP for the duration of the necessary clarifications (see letter E below). This means that the federal body may only process the data during this period in order to establish its accuracy or inaccuracy.
17 If it is not possible for the federal body to prove the accuracy of the processed data, possibly despite further clarifications, but the data subject is also unable to prove the accuracy of the corrections he or she has requested, the federal body must attach a note of dispute. On the one hand, this serves the interests of the person concerned by demonstrating that they do not agree with the federal body's presentation of the facts. On the other hand, it ensures that the federal body does not have to refrain from processing data that it needs to fulfill its legal mandate.
18 The legislative materials on the new restriction introduced with the 2023 revision do not comment on the relationship between Art. 41 para. 3 and para. 4 FADP. However, as explained above, one of the purposes of the confirmation notice is to ensure that the federal body can continue to perform its statutory duties. If a clarification of the accuracy or inaccuracy of the data is unsuccessful, it must be possible for the federal body to lift a restriction on processing made for this purpose in accordance with Art. 41 para. 3 FADP, to attach a note of dispute and to process the data in question in full again, at least if it is not possible to completely refrain from processing and no other reason for restriction (see letter E) applies.
C. Right to erasure (para. 1 lit. b)
19 The data subject also has the right to have the consequences of unlawful data processing eliminated by means of suitable and proportionate measures. This relates to the actual elimination of adverse consequences that are attributable to unlawful data processing, for example the subsequent granting of statutory benefits. If a health insurance company in the area of compulsory health insurance (OKP) were to use a health questionnaire to clarify the general state of health of an insured person and not offer them certain OKP benefits based on this, there would be no legal basis for this (and it would contradict the obligation to accept data under the KVG); the data collection would be unlawful and the health insurance company would have to grant the insured person the benefits under health insurance law.
20 However, the entitlement does not allow the persons concerned to remove formally legally binding decrees. This is still only possible with the statutory grounds for revision in accordance with Art. 66 APA. It is also not possible for data subjects to claim compensation or satisfaction based on Art. 41 para. 1 lit. b FADP, as these claims must be asserted via the Federal Liability Act.
21 In practice, the claim for removal will regularly play a role in the event of unlawful data disclosure. In this case, the data subject can request, among other things, the publication of the decision on the unlawful data processing (namely on the rectification, erasure or destruction, the notice of objection but also on the objection to the disclosure pursuant to Art. 37 FADP) or its notification to any data recipients (Art. 41 para. 2 lit. b FADP). The purpose of this is that a data recipient can voluntarily accept the decision and delete or correct the data, but cannot be forced to do so. In this case, the data subject still has no choice but to assert any claims against the data recipient.
D. Right to a declaratory judgment (para. 1 lit. c)
22 The applicant may also request a declaration that the data processing is unlawful. This claim is only subsidiary to the claim for injunctive relief and removal. As long as it is possible to demand the cessation of unlawful processing or the elimination of the associated consequences, there is no legitimate interest in the determination of unlawfulness.
23 According to the case law of the Federal Supreme Court, there is an interest in a declaratory judgment if (past) unlawful data processing or the associated violation of personality rights continues to have a disruptive effect and the determination of unlawfulness is suitable for eliminating this ongoing effect.
E. Restriction of processing (para. 3)
24 With the revision of 2023, Art. 41 para. 3 FADP was newly inserted. According to this, instead of deleting or destroying the data, the federal body must restrict processing if one of the following cases applies
The data subject disputes the accuracy of the personal data, but neither the accuracy nor the inaccuracy can be established (see n. 18 above);
Overriding interests of third parties or overriding public interests require that the data continue to exist;
the deletion or destruction of the data would jeopardize an investigation, an inquiry or official or judicial proceedings.
25 It should be noted that Art. 18 DSGVO also provides for the "restriction of processing". In contrast to the provision of the FADP, where it is a claim of the data subject against the controller, Art. 41 para. 3 FADP is designed as an exception to erasure/destruction or rectification. When processing a request for erasure/destruction, but also for rectification (although not explicitly mentioned, the restriction of processing to check the accuracy or inaccuracy of the data makes sense from a legal point of view), the federal body must check ex officio whether one of the reasons for a restriction exists. If the request is granted and the restriction is affirmed, the federal body must reduce the processing to the purpose that conflicts with the erasure/destruction or rectification.
26 The decision on the restriction must be issued as an order or as an interim order if the proceedings are not concluded as a result.
27 The dispatch stipulates that the restriction must be implemented in such a way that the disputed data must be clearly marked, which in practice could mean that it is temporarily moved to another processing system or that access rights are restricted. In this argument, the legislator has not taken into account the fact that this will regularly lead to implementation problems in practice, as it cannot be assumed that all systems enable such precautions for individual data, i.e. "field-based", so to speak, and cannot be implemented without further ado. If the technical implementation options are not available, the restriction must at least be ensured with organizational measures, e.g. by means of instructions in the system, directives or separate lists.
IV. Exemption provision (para. 5)
28 The rectification, erasure or destruction of personal data cannot be requested in relation to the holdings of so-called public repositories, such as in particular publicly accessible libraries, educational institutions, museums or archives. In these constellations, it is also not possible to issue a notice of dispute. The purpose of these institutions is to depict a moment in the past, which can only be achieved if the holdings are faithful to the original and unchanged.
29 However, the data subject can at least request that access to disputed data be restricted. In principle, the public interest in free and unaltered access to documents takes precedence. However, an overriding interest of the person concerned in restricting access is to be assumed if he or she would suffer considerable personal disadvantages as a result of free access, for example because his or her professional advancement would be restricted and the archival value of the data in question appears to be lower in comparison. According to the dispatch, this exception must be taken into account in particular with regard to the increasing publication of archive records on the Internet.
V. Administrative procedural law (para. 6)
30 The procedure for asserting claims under Art. 41 para. 1-2 FADP is governed by the APA. This applies even if the APA does not actually apply to the respective subject area (the exceptions in Art. 2 and 3 of the APA do not apply).
31 This means in particular that the federal body must clarify the facts of the case ex officio (principle of investigation, Art. 12 APA). However, the applicant is subject to a duty to cooperate (Art. 13 APA); for example, as part of an application for rectification, the applicant must submit evidence that proves the correctness of the changes requested.
32 The federal body can also decide to reject, approve or reject the application. The decision is issued in the form of a ruling, which in turn can be appealed to the Federal Administrative Court.
Bibliography
Bangert Jan, Kommentierung zu Art. 25/25bis DSG, in: Maurer-Lambrou Urs/Blechta Gabor-Paul (Hrsg.), Basler Kommentar, Datenschutzgesetz, 3. Aufl., Basel, 2014.
Burkert Herbert, Datenschutz und Rechtsschutz, in: Schweizerisches Zentralblatt für Staats- und Verwaltungsrecht, ZBl 108 (2007), S. 374-379.
Fanger Reto, Kommentierung zu Art. 41 DSG, in: Bieri Adrian/Powell Julian (Hrsg.), OFK-Orell Füssli Kommentar (Navigator.ch), Zürich 2023.
Gautschi Adrian, Kommentierung zu Art. 42 DSG, in: Blechta, Gabor-Paul/Vasella David (Hrsg.), Balser Kommentar, Datenschutzgesetz, 4. Aufl. Basel 2024.
Häfelin Ulrich/Müller Georg/Uhlmann Felix, Allgemeines Verwaltungsrecht, 8. Aufl., Zürich/St. Gallen 2020.
Häner Isabelle, Kommentierung zu Art. 25 und 25a VwVG, in: Waldmann Bernhard/Weissenberger Philippe (Hrsg.), Praxiskommentar Verwaltungsverfahrensgesetz, 2. Aufl., Zürich 2016.
Jöhri Yvonne, Kommentierung zu Art. 25 DSG, in: Rosenthal David/Jöhri Yvonne, Handkommentar zum Datenschutzgesetz, Zürich/Basel/Genf 2008.
Sturny Monique, Kommentierung zu Art. 41, in: Baeriswyl Bruno/Pärli Kurt/Blonski Dominika, Stämpflis Handkommentar (SHK) zum Datenschutzgesetz, 2. Aufl., Zürich 2023.
Materials
Botschaft zum Bundesgesetz über den Datenschutz (DSG) vom 23.3.1988 (BBl 1988 413).
Botschaft zum Bundesgesetz über die Totalrevision des Bundesgesetzes über den Datenschutz und die Änderung weiterer Erlasse zum Datenschutz vom 15.9.2017 (BBl 2017 6941).