-
- Art. 5a FC
- Art. 6 FC
- Art. 10 FC
- Art. 16 FC
- Art. 17 FC
- Art. 20 FC
- Art. 22 FC
- Art. 29a FC
- Art. 30 FC
- Art. 32 FC
- Art. 42 FC
- Art. 43 FC
- Art. 43a FC
- Art. 55 FC
- Art. 56 FC
- Art. 60 FC
- Art. 68 FC
- Art. 75b FC
- Art. 77 FC
- Art. 96 para. 2 lit. a FC
- Art. 110 FC
- Art. 117a FC
- Art. 118 FC
- Art. 123b FC
- Art. 136 FC
- Art. 166 FC
-
- Art. 11 CO
- Art. 12 CO
- Art. 50 CO
- Art. 51 CO
- Art. 84 CO
- Art. 143 CO
- Art. 144 CO
- Art. 145 CO
- Art. 146 CO
- Art. 147 CO
- Art. 148 CO
- Art. 149 CO
- Art. 150 CO
- Art. 701 CO
- Art. 715 CO
- Art. 715a CO
- Art. 734f CO
- Art. 785 CO
- Art. 786 CO
- Art. 787 CO
- Art. 788 CO
- Transitional provisions to the revision of the Stock Corporation Act of June 19, 2020
- Art. 808c CO
-
- Art. 2 PRA
- Art. 3 PRA
- Art. 4 PRA
- Art. 6 PRA
- Art. 10 PRA
- Art. 10a PRA
- Art. 11 PRA
- Art. 12 PRA
- Art. 13 PRA
- Art. 14 PRA
- Art. 15 PRA
- Art. 16 PRA
- Art. 17 PRA
- Art. 19 PRA
- Art. 20 PRA
- Art. 21 PRA
- Art. 22 PRA
- Art. 23 PRA
- Art. 24 PRA
- Art. 25 PRA
- Art. 26 PRA
- Art. 27 PRA
- Art. 29 PRA
- Art. 30 PRA
- Art. 31 PRA
- Art. 32 PRA
- Art. 32a PRA
- Art. 33 PRA
- Art. 34 PRA
- Art. 35 PRA
- Art. 36 PRA
- Art. 37 PRA
- Art. 38 PRA
- Art. 39 PRA
- Art. 40 PRA
- Art. 41 PRA
- Art. 42 PRA
- Art. 43 PRA
- Art. 44 PRA
- Art. 45 PRA
- Art. 46 PRA
- Art. 47 PRA
- Art. 48 PRA
- Art. 49 PRA
- Art. 50 PRA
- Art. 51 PRA
- Art. 52 PRA
- Art. 53 PRA
- Art. 54 PRA
- Art. 55 PRA
- Art. 56 PRA
- Art. 57 PRA
- Art. 58 PRA
- Art. 59a PRA
- Art. 59b PRA
- Art. 59c PRA
- Art. 62 PRA
- Art. 63 PRA
- Art. 67 PRA
- Art. 67a PRA
- Art. 67b PRA
- Art. 75 PRA
- Art. 75a PRA
- Art. 76 PRA
- Art. 76a PRA
- Art. 90 PRA
-
- Vorb. zu Art. 1 FADP
- Art. 1 FADP
- Art. 2 FADP
- Art. 3 FADP
- Art. 5 lit. f und g FADP
- Art. 6 Abs. 6 and 7 FADP
- Art. 7 FADP
- Art. 10 FADP
- Art. 11 FADP
- Art. 12 FADP
- Art. 14 FADP
- Art. 15 FADP
- Art. 19 FADP
- Art. 20 FADP
- Art. 22 FADP
- Art. 23 FADP
- Art. 25 FADP
- Art. 26 FADP
- Art. 27 FADP
- Art. 31 para. 2 lit. e FADP
- Art. 33 FADP
- Art. 34 FADP
- Art. 35 FADP
- Art. 38 FADP
- Art. 39 FADP
- Art. 40 FADP
- Art. 41 FADP
- Art. 42 FADP
- Art. 43 FADP
- Art. 44 FADP
- Art. 44a FADP
- Art. 45 FADP
- Art. 46 FADP
- Art. 47 FADP
- Art. 47a FADP
- Art. 48 FADP
- Art. 49 FADP
- Art. 50 FADP
- Art. 51 FADP
- Art. 54 FADP
- Art. 57 FADP
- Art. 58 FADP
- Art. 60 FADP
- Art. 61 FADP
- Art. 62 FADP
- Art. 63 FADP
- Art. 64 FADP
- Art. 65 FADP
- Art. 66 FADP
- Art. 67 FADP
- Art. 69 FADP
- Art. 72 FADP
- Art. 72a FADP
-
- Art. 2 CCC (Convention on Cybercrime)
- Art. 3 CCC (Convention on Cybercrime)
- Art. 4 CCC (Convention on Cybercrime)
- Art. 5 CCC (Convention on Cybercrime)
- Art. 6 CCC (Convention on Cybercrime)
- Art. 7 CCC (Convention on Cybercrime)
- Art. 8 CCC (Convention on Cybercrime)
- Art. 9 CCC (Convention on Cybercrime)
- Art. 11 CCC (Convention on Cybercrime)
- Art. 12 CCC (Convention on Cybercrime)
- Art. 25 CCC (Convention on Cybercrime)
- Art. 29 CCC (Convention on Cybercrime)
- Art. 32 CCC (Convention on Cybercrime)
- Art. 33 CCC (Convention on Cybercrime)
- Art. 34 CCC (Convention on Cybercrime)
FEDERAL CONSTITUTION
CODE OF OBLIGATIONS
FEDERAL LAW ON PRIVATE INTERNATIONAL LAW
LUGANO CONVENTION
CODE OF CRIMINAL PROCEDURE
CIVIL PROCEDURE CODE
FEDERAL ACT ON POLITICAL RIGHTS
CIVIL CODE
FEDERAL ACT ON CARTELS AND OTHER RESTRAINTS OF COMPETITION
FEDERAL ACT ON INTERNATIONAL MUTUAL ASSISTANCE IN CRIMINAL MATTERS
DEBT ENFORCEMENT AND BANKRUPTCY ACT
FEDERAL ACT ON DATA PROTECTION
SWISS CRIMINAL CODE
CYBERCRIME CONVENTION
- I. Purpose of the norm and history of its origins
- II. Right to information of the FDPIC
- III. Procedural Matters
- Bibliography
- Materials
I. Purpose of the norm and history of its origins
1 If the FDPIC conducts an investigation into suspected data protection violations by a federal body or a private person, he must in principle provide all the information and documents necessary for the investigation in accordance with Art. 49 para. 3 FADP. In order to ensure that the supervisory activities can be carried out effectively even if the persons responsible do not comply with their obligations to cooperate, Art. 50 FADP grants the FDPIC certain powers of investigation and intervention in order to clarify the facts comprehensively, quickly and precisely.
2 The purpose of Art. 50 FADP is to meet the current and expected future requirements of international law, which Switzerland must comply with as a member state of Convention ETS 108 of the Council of Europe for the Protection of Individuals with regard to Automatic Processing of Personal Data and as a Schengen state. Article 15 para. 2 lit. a of the Protocol of Amendment of 18 May 2018 to the ETS 108 Convention requires that Member States provide their data protection supervisory authorities with powers of investigation and intervention. Similarly, Art. 47(1) of Directive (EU) 2016/680 provides that EU and Schengen States shall provide for effective investigatory powers for their supervisory authorities, namely the power to obtain access to all personal data processed and to all information necessary for the performance of their tasks.
3 In view of Article 45 of Regulation (EU) 2016/679 (the General Data Protection Regulation, GDPR), according to which a transfer of personal data from the EU to third countries may only be carried out if the third country in question provides an adequate level of protection in accordance with a decision of the European Commission, the Swiss legislator considers the new investigative powers of the FDPIC to be a crucial element in ensuring that the EU upholds its adequacy decision vis-à-vis Switzerland.
4 Compared to the 1992 Data Protection Act (aDSG), Art. 50 FADP clarifies and strengthens the position of the FDPIC. Thus, Art. 27 para. 3 aDSG (in the area of supervision of federal bodies) and Art. 29 para. 3 aDSG (in the private sector) already provided for the possibility of requesting files, obtaining information and having data processing performed within the scope of fact-finding investigations. The persons responsible were obliged to cooperate, subject to the right to refuse to testify that applies mutatis mutandis under Art. 16 APA (cf. Art. 27 para. 3 aDSG and Art. 34 para. 2 lit. b aDSG). However, if the persons responsible did not cooperate of their own accord, the FDPIC had no direct coercive measures at its disposal to obtain information (e.g. the possibility of seizing information or gaining access to localities, installations or systems even against the will of the person entitled). In the event of a refusal to cooperate by a federal body, the FDPIC could only turn to a higher-level unit with the right to issue instructions to the same; in the private sector, the only option open to him was in fact to file criminal charges for violation of the obligations to cooperate (Art. 34 para. 2 lit. b aDSG). In serious cases of refusal to cooperate by a federal body or a private person, he could also inform the public pursuant to Art. 30 para. 2 aDSG.
5 The limited investigative powers of the FDPIC under the aDSG have sometimes met with criticism from academics and data protection practitioners. Suggestions to expand the FDPIC's information-gathering powers were also made, for example, by the FADP Revision Support Group in 2014. Accordingly, the strengthening of the position of the FDPIC in its investigative activities is a response to the international requirements (cf. n. 2 f. above) as well as the weaknesses identified by doctrine and practice.
6 Practice will show whether the newly designed regime of the FDPIC's investigative powers, together with its cautiously expanded remedial powers (cf. OK-Fanger/Oehri on Art. 51 FADP), will ensure effective supervisory activity. In addition to the corresponding order of competences, effective supervision in fact also requires that the FDPIC be adequately resourced. In this regard, there has been some criticism in the literature about the resources, which are considered to be too scarce and which, despite an increase that has already taken place, will probably continue to force the FDPIC to proceed according to the principle of opportunity in its supervisory activities in the future. In this regard, the 2018 Schengen evaluators were also critical and recommended that the FDPIC be allocated sufficient financial and human resources to fulfill all of its tasks in the Schengen context.
II. Right to information of the FDPIC
A. Ordering investigative measures
7 If the FDPIC opens an investigation against a federal body or a private person pursuant to Art. 49 para. 1 FADP because of a suspected data protection violation, it is in principle up to the federal body or the private person concerned to provide the FDPIC with all the information and documents necessary for the investigation (Art. 49 para. 3 FADP). If the person responsible does not comply with the obligations to cooperate under Art. 49 para. 3 FADP, Art. 50 para. 1 FADP grants the FDPIC the authority to order measures to obtain information. The ordering of such measures is subsidiary to the cooperation of the person responsible and thus presupposes that the FDPIC has opened an investigation and has tried in vain to obtain the necessary information and documents.
8The catalog of possible measures for obtaining information in Art. 50(1) FADP is based on that of Art. 12 APA and is not exhaustive. In particular, the FDPIC may request access to all information, documents, lists of processing activities and personal data required for the investigation (lit. a) as well as to premises and installations (lit. b), and may order the examination of witnesses (lit. c) and expert assessments (lit. d).
9 In order to enable a targeted investigation, the concept of access (Art. 50 para. 1 lit. a and lit. b FADP) must be understood broadly. Thus, access to documents includes not only their inspection, but also their seizure, if necessary. With regard to the access measures in Art. 50 Para. 1 lit. a and lit. b FADP, the regulation is essentially based on the relevant provisions of the FADP (Art. 58 para. 1 lit. e and lit. f FADP). In this context, the information is usually collected by means of a questionnaire and all documents relevant to the investigation are recorded with the records. Pursuant to Art. 12 para. 1 FADP, the directory of processing activities - except in the exceptional cases of Art. 12 para. 5 FADP, which are, however, very extensive in Switzerland as a country of SMEs and therefore probably represent the rule - must be created and maintained by the controller and the processor independently of any data protection investigation. Here, too, the order pursuant to Art. 50 para. 1 FADP thus relates to the inspection and, if necessary, seizure, but not to the proper maintenance. The latter can, if necessary, be the subject of an order under Art. 51 FADP based on the results of the investigation. If necessary, the disclosure of the personal data required for the investigation may also be ordered under Art. 50 para. 1 lit. a FADP. Access to premises and facilities may be necessary if technical and organizational measures (TOM) are the subject of the investigation. By mentioning the examination of witnesses and expert opinions, Art. 50 para. 1 FADP goes further than the GDPR, which does not contain any explicit rules in this regard.
10 Compared to the aDSG, the exemplary list of possible investigative measures in Art. 50 para. 1 FADP means a selective expansion of the information powers (cf. n. 4 above). However, the essential expansion of the position of the FDPIC with regard to the procurement of information lies primarily in the strengthening of the enforcement mechanisms (cf. below n. 18 ff.).
B. Personal and material scope of application
11 In order for the FDPIC to be able to fulfill his legal supervisory duties, the information gathering rights to which he is entitled must be comprehensively structured.
12 In personal terms, information is primarily obtained from the federal body or private person concerned, but may also include other bodies or persons involved in the data processing in question (e.g. employees, auxiliary persons, agents, outsourcing partners) or third parties who can provide relevant information (e.g. data subjects, authorities, former employees, business partners). Under the aDSG, the group of persons from whom the FDPIC can obtain information in the course of its investigations was already broadly defined. The explicit inclusion of witness hearings and expert opinions in Art. 50 para. 1 FADP now also makes the possible involvement of third parties clear in the text of the law. While the duty of the responsible party to cooperate as a party is based on Art. 49 para. 3 FADP and Art. 13 para. 1 lit. c APA, that of third parties is based on Art. 15 and Art. 17 APA. Rights of refusal applicable in individual cases remain reserved (cf. n. 14 ff. below).
13 The FDPIC's right to information must also be interpreted broadly from a factual point of view. Article 50 para. 1 lit. a FADP specifically mentions all information, documents, lists of processing activities and personal data that are necessary for the investigation. Consequently, the right to information extends to all information in connection with a specific case or of a general nature that is relevant and necessary for a legal assessment of the alleged data protection violation. This includes all documents and information that could possibly say something about whether, when and how the responsible bodies comply with the requirements of data protection law, in particular those that can be used to assess the accuracy of the data, the permissibility of its processing and the observance of the rights of the data subjects. Also covered are, for example, documents and information on personnel, technical and organizational precautions, process, program and system documentation as well as all legal bases (e.g. directives, guidelines, leaflets, contracts) that have to do with the enforcement of data protection provisions.
C. Limits, in particular reservation of professional secrecy
14The FDPIC's right to information and the corresponding duties to cooperate on the part of federal bodies and private persons against whom an investigation is directed, as well as third parties where applicable, are of course not unlimited. They find their limits in the relevant rights of refusal. In this regard, Art. 49 para. 3 FADP provides that the right to refuse information of federal bodies and private persons is governed by Art. 16 and Art. 17 FADP, unless Art. 50 para. 2 FADP provides otherwise. Art. 16 and Art. 17 APA also apply to third parties.
15According to the applicable order, which results from the interplay of the FADP and the APA and the partial reference therein to the BZP and the StGB, information and also other cooperation, for example in the form of the surrender of documents, can be refused in any case:
if the contributor would expose himself or a close person to the risk of criminal prosecution or a serious disadvantage to the honor or would cause a direct pecuniary damage for himself or for the latter (Art. 16 para. 1 APA in conjunction with Art. 42 para. 1 lit. a BZP);
if the contributor can invoke the protection of sources for media professionals (Art. 16 para. 1 APA in conjunction with. Art. 42 para. 1 lit. abis BZP in conjunction with. Art. 28a StGB);
if the contributor can invoke a professional secret pursuant to Art. 321 no. 1 SCC and the person entitled to the secret has not consented to the disclosure of the secret (Art. 16 para. 1 APA i.V.m. Art. 42 para. 1 lit. b BZP in conjunction with. Art. 321 no. 1 StGB);
if it concerns attorney correspondence (Art. 17 APA in conjunction with Art. 51a BZP).
16In contrast, invoking manufacturing or trade secrets, contractual confidentiality obligations or official secrecy does not exempt a person from participating in an investigation by the FDPIC. The FDPIC, for his part, is bound by the applicable legal provisions - namely on data protection and the protection of industrial and commercial secrets - and is subject to official secrecy under Article 22 of the Federal Act on Civil Procedure, which, according to the legislator, guarantees the confidential treatment of the information obtained in the course of his investigations.
17According to the practice under the aDSG, holders of other professional secrets, i.e., for example, persons subject to banking secrecy (Art. 47 BankG), professional secrecy in medical research (Art. 321bis SCC) or postal and telecommunications secrecy (Art. 321ter SCC), could not invoke a right to refuse to cooperate in investigations under data protection law pursuant to Art. 16 para. 2 APA in conjunction with Art. 42 para. 2 BZG. Art. 42 para. 2 BZP. It is questionable whether the explicit reservation of professional secrecy in the new Art. 50 para. 2 FADP changes anything in this regard. This was only inserted during the parliamentary debate. However, according to the view expressed here, the relevant parliamentary debate suggests that the explicit mention of professional secrecy is merely a clarification and does not imply any change in the legal situation and practice.
III. Procedural Matters
A. Overview
18While the content of the FDPIC's right to information under Art. 50 para. 1 FADP has probably only been expanded in certain respects compared to the old law (cf. n. 7 ff. above), the position of the FDPIC with regard to its enforcement has been significantly strengthened. Under the aDSG, the FDPIC could provide for investigative measures, but could not compulsorily enforce them in the case of an uncooperative counterpart (cf. n. 4 above). The FDPIC's information gathering is now regulated in three stages:
Primarily, it takes place through an informal request by the FDPIC to the federal body or the private person against whom an investigation has been opened. Pursuant to Art. 49 (3) FADP, the person responsible is obliged to provide information and hand over documents, insofar as this is necessary for the investigation, if he or she cannot assert a right to refuse to cooperate.
Subsidiarily, i.e. if obtaining information solely by means of providing information and handing over documents by the federal body concerned or the private person concerned is either unsuccessful or insufficient, the FDPIC may "order" investigative measures pursuant to Art. 50 para. 1 FADP (cf. on this point n. 19 ff. below).
Finally, the FDPIC may involve other federal authorities as well as the cantonal or communal police authorities in the enforcement of the measures ordered under Art. 50 para. 1 FADP pursuant to Art. 50 para. 3 FADP.
B. Term "order"
19The law and also the materials do not explicitly comment on what is meant by the term "order" or in what form this order must be made. Whereas in the context of the administrative measures that the FDPIC can issue on the basis of Art. 51 FADP after the conclusion of an investigation, both the dispatch and the reception of the new provision in the literature prominently address the FDPIC's authority to issue orders (cf. OK-Fanger/Oehri on Art. 51 FADP, n. 1 ff.), with regard to the investigative measures under Art. 50 FADP, there is no discussion of the question of whether their order also has the character of an order or whether it is to be qualified as an official act.
20The provisions of the FADP applicable to the investigation procedure under Article 50 FADP by virtue of the reference in Article 52 para. 1 FADP, in particular Articles 12-19 FADP, as well as Articles 37, 39-41 and 43-61 FADP, which are also applicable by virtue of the further reference in Article 19 FADP and which are all relevant to the determination of the facts in administrative proceedings, do not expressly determine the form in which investigative measures are to be ordered.
21According to the view expressed here and explained in detail below, the ordering of investigative measures must take the form of a procedural (interim) order.
22Unlike in the area of civil procedure, actual evidence orders are not common in administrative proceedings, in which the investigative maxim prevails. However, evidentiary or investigative measures are generally ordered in the form of injunctions in many administrative areas. Although the case law hardly deals in detail with the legal nature of the orders in question, in most of these decisions the ruling court assumes an order without further ado in the considerations on the object of challenge.
23 In decisions in which the Federal Supreme Court had to deal specifically with the question of whether the order of an investigative measure in a specific case qualifies as a (contestable) order or not, the picture is not uniform: sometimes a corresponding order is classified as a procedural interim order, sometimes as a real act of the authorities. In its more recent case law, the Federal Supreme Court seems to increasingly assume the character of an injunction. However, no general statements for all administrative areas can be derived from this.
24With reference to the fact that the ordering of evidence measures under the duty to cooperate always creates a legal obligation, the doctrine argues - rightly in the view represented here - for a qualification as an order. In some cases, a distinction is made as to whether the fulfillment of the duty to cooperate can be enforced by sanctions (direct coercion, fines, etc.). Insofar as this is provided for by law and thus a genuine legal obligation is to be assumed, an order to cooperate in this regard is to be structured as an interim order if the threat to cease and desist is so specific that it can be enforced.
25If an administrative act strongly interferes with the legal position of the addressee, an injunction is appropriate so that the addressee can, if necessary, arrange for a review by an appellate body. The federal body or the private person as a party to an investigation under data protection law is likely to disagree with the ordering of investigative measures on a regular basis: After the responsible party was unwilling or unable to provide the FADP with the necessary information basis for the assessment of a possible data protection violation in the context of the informal inquiry by the FDPIC, it can be assumed that he will not suddenly be able or willing to cooperate sufficiently of his own accord, even in response to an order pursuant to Art. 50 para. 1 FADP. In view of the right to be heard, it is all the more important for him to have the possibility of having the disputed order reviewed by the courts under the conditions of Art. 52 para. 1 FADP in conjunction with 46 APA. In addition, the FDPIC can enforce the ordered investigative measures, insofar as they can be compulsorily enforced, with the help of other federal authorities and the cantonal and municipal police authorities in accordance with Art. 50 para. 3 FADP. Failure to cooperate is punishable under Art. 60 FADP. In other words, investigative measures under Art. 50 para. 1 FADP regularly give rise to real legal obligations for the party to the proceedings, which is why they must be ordered by decree.
26The same applies analogously to the obligation of third parties to cooperate, which can be enforced (Art. 50 para. 3 FADP) and non-compliance with which may also result in penalties (Art. 52 para. 1 FADP in conjunction with Art. 60 APA). If they are summoned as witnesses or requested to edit documents or grant access to premises and installations, this constitutes a substantial interference against which a legal remedy must be available before compulsory enforcement or sanctioning of non-cooperation.
27 From the perspective of procedural economy, it can admittedly be objected that, depending on the circumstances of the individual case, the ordering of investigative measures by decree can lead to very lengthy and costly investigative proceedings. However, this is acceptable for reasons of the rule of law. No excessive requirements are to be placed on the justification of investigative measures by the FDPIC, so that an order in the form of a decree does not lead to a significant additional expense compared to a purely real act. There is a risk of delay in the procedure if an independent appeal is possible (Art. 52 para. 1 FADP in conjunction with Art. 46 para. 1 APA), which in the present context will only be the case in exceptional cases (see in detail below n. 28). In addition, the FDPIC may withdraw the suspensive effect of an appeal if necessary (Art. 52 para. 1 FADP in conjunction with Art. 55 para. 2 APA). Finally, especially in the case of complex investigations with a long duration of proceedings, the precautionary ordering of administrative measures pursuant to Art. 51 FADP may sometimes be necessary (cf. OK-Fanger/Oehri on Art. 51 FADP, n. 22 ff.).
C. Legal remedy
28 If the order for investigative measures is deemed to be of an injunctive nature, it may be appealed under the conditions of Art. 52 para. 1 FADP in conjunction with Art. 46 para. 1 VwG. Art. 46 para. 1 APA, it can be challenged independently by appeal to the Federal Administrative Court.
29Primarily, a challenge is likely to exist if the order may cause irreparable disadvantage within the meaning of Art. 46 para. 1 lit. a APA. This is the case if objections are raised against the ordered evidence measures which cannot be raised without disadvantage by challenging the final decision. Art. 46 para. 1 lit. b APA, according to which the appeal is also admissible if its approval would immediately bring about a final decision and thus save a significant amount of time or costs for extensive evidentiary proceedings, will hardly be relevant with regard to investigative measures under data protection law.
30Where an appeal is admissible, the decision of the Federal Administrative Court can subsequently be appealed to the Federal Supreme Court by means of an appeal in public law matters (Art. 82 lit. a in conjunction with Art. 86 para. 1 lit. a BGG). In addition to the addressee of the order, the FDPIC also has the right of appeal (Art. 52 para. 3 FADP).
D. Enforcement
31Art. 50 para. 3 FADP provides that the FDPIC may involve other federal authorities as well as the cantonal or municipal police authorities in the enforcement of the measures under Art. 50 para. 1 FADP. Art. 54 para. 2 lit. c FADP also states in this regard that the FDPIC may disclose to the authorities consulted the information and personal data necessary for the performance of their legal duties.
32Article 50 (3) FADP was amended during the legislative process. Still in the FADP of 2017, the provision in question explicitly granted the FDPIC the power to order precautionary measures for the duration of the investigation and to have them enforced by a federal authority or the cantonal or municipal police bodies (Art. 44 para. 2 FADP [2017]). The final version of the provision no longer contains any direct mention of precautionary measures (cf. on the possibility of ordering precautionary measures during the duration of a data protection investigation, OK-Fanger/Oehri on Art. 51 FADP, n. 22 ff.).
33With regard to enforcement, the rules of the FADP, in particular Art. 39-43 of the APA, also apply in addition, in accordance with the reference in Art. 52 para. 1 FADP, unless Art. 50 FADP provides otherwise. Consequently, enforcement requires that no legal remedy with suspensive effect is available against the order (Art. 52 para. 1 FADP in conjunction with Art. 39 APA). With regard to the possible means of coercion (cf. Art. 52 para. 1 FADP in conjunction with Art. 41 APA), coercive access and searches of premises and installations as well as the seizure of installations, documents, lists of processing activities and personal data will primarily play a role in practice. A threat of punishment may also come into consideration (cf. Art. 60 FADP and Art. 52 para. 1 FADP in conjunction with Art. 60 APA). In contrast, the compulsory production of parties to provide information or of witnesses should hardly ever be considered, especially since the principle of proportionality always applies with regard to the means of compulsion used (Art. 52 para. 1 FADP in conjunction with Art. 42 APA).
E. No fee
34Art. 59 para. 1 lit. d FADP stipulates that the FDPIC shall charge a fee to private persons for the issuance of precautionary measures and (administrative) measures under Art. 51 FADP. With regard to the investigation procedure, this means e contrario that no fees are to be imposed on a federal body in any case in the absence of a corresponding legal basis. Moreover, according to the dispatch on the FADP (2017), it should be concluded that no fees are charged for investigations against private persons that are concluded without ordering precautionary measures or administrative measures.
35The envisaged exemption from fees is convincing for investigation proceedings in which the clarification of the facts is formally simple, i.e. can be carried out without a formal order of investigative measures solely through the cooperation of a fully cooperating responsible party, and on the other hand has an exculpatory effect, i.e. does not lead to administrative measures. Likewise, it can be argued that the ordering of investigative measures on third parties, insofar as these were not first made necessary by a lack of cooperation on the part of the data controller, should not entail any financial consequences for the latter. However, Art. 50 FADP is not only tailored to such case constellations, but also applies in particular if the data controller does not sufficiently cooperate in the investigation procedure (cf. Art. 50 para. 1 FADP). According to the opinion expressed here, the ordering of investigative measures, which became necessary solely because the responsible party unjustifiably failed to comply with his or her duties to cooperate, should in any case have cost consequences in the private sector, even if, after the investigation has been fully conducted and opened in response to sufficient indications pursuant to Art. 49 para. 1 FADP, it turns out that there has been no violation of data protection provisions and thus no administrative measures need to be ordered pursuant to Art. 51 FADP.
Bibliography
Auer Christoph/Binder Anja Martina, Kommentierung zu Art. 12 VwVG, in: Auer Christoph/Müller Markus/Schindler Benjamin (Hrsg.), VwVG – Bundesgesetz über das Verwaltungsverfahren: Kommentar, 2. Aufl., Zürich 2019.
Auer Christoph/Binder Anja Martina, Kommentierung zu Art. 13 VwVG, in: Auer Christoph/Müller Markus/Schindler Benjamin (Hrsg.), VwVG – Bundesgesetz über das Verwaltungsverfahren: Kommentar, 2. Aufl., Zürich 2019.
Auer Christoph/Binder Anja Martina, Kommentierung zu Art. 15 VwVG, in: Auer Christoph/Müller Markus/Schindler Benjamin (Hrsg.), VwVG – Bundesgesetz über das Verwaltungsverfahren: Kommentar, 2. Aufl., Zürich 2019.
Baeriswyl Bruno, Kommentierung zu Art. 50 DSG, in: Baeriswyl Bruno/Pärli Kurt/Blonski Dominika (Hrsg.), Datenschutzgesetz, Stämpflis Handkommentar, 2. Aufl., Bern 2023.
Baeriswyl Bruno, Kommentierung zu Art. 27 aDSG, in: Baeriswyl Bruno/Pärli Kurt/Blonski Dominika (Hrsg.), Datenschutzgesetz, Stämpflis Handkommentar, Bern 2015.
Baeriswyl Bruno, Kommentierung zu Art. 29 aDSG, in: Baeriswyl Bruno/Pärli Kurt/Blonski Dominika (Hrsg.), Datenschutzgesetz, Stämpflis Handkommentar, Bern 2015.
Güngerich Andreas/Bickel Jürg, Kommentierung zu Art. 15 VwVG, in: Waldmann Bernhard/Weissenberger Philippe (Hrsg.), VwVG – Praxiskommentar Verwaltungsverfahrensgesetz, 2. Aufl., Zürich 2016.
Güngerich Andreas/Bickel Jürg, Kommentierung zu Art. 16 VwVG, in: Waldmann Bernhard/Weissenberger Philippe (Hrsg.), VwVG – Praxiskommentar Verwaltungsverfahrensgesetz, 2. Aufl., Zürich 2016.
Huber René, Kommentierung zu Art. 27 aDSG, in: Maurer-Lambrou Urs/Blechta Gabor-Paul (Hrsg.), Datenschutzgesetz/Öffentlichkeitsgesetz, Basler Kommentar, 3. Aufl., Basel 2014.
Huber René, Kommentierung zu Art. 29 aDSG, in: Maurer-Lambrou Urs/Blechta Gabor-Paul (Hrsg.), Datenschutzgesetz/Öffentlichkeitsgesetz, Basler Kommentar, 3. Aufl., Basel 2014.
Jöhri Yvonne, § 8 Aufgabe und Bedeutung der öffentlichen Datenschutzbeauftragten, in: Passadelis Nicolas/Rosenthal David/Thür Hanspeter (Hrsg.), Datenschutzrecht, Basel 2015, S. 245–278.
Jöhri Yvonne, Kommentierung zu Art. 27 aDSG, in: Rosenthal David/Jöhri Yvonne (Hrsg.), Handkommentar zum Datenschutzgesetz sowie weiteren, ausgewählten Bestimmungen, Zürich 2008.
Reudt-Demont Janine/Gordon Clara-Ann/Egli Luisa, Das revidierte Datenschutzgesetz: Wichtigste Neuigkeiten mit Fokus auf Gesundheitsdaten, LSR 2021, S. 264–269.
Rosenthal David, Das neue Datenschutzgesetz, Jusletter 16.11.2020 (zit. Rosenthal nDSG).
Rosenthal David, Der Entwurf für ein neues Datenschutzgesetz: Was uns erwartet und was noch zu korrigieren ist, Jusletter 27.11.2017 (zit. Rosenthal E-DSG).
Rosenthal David, § 7 Sanktionierung von Datenschutzverstössen, in: Passadelis Nicolas/Rosenthal David/Thür Hanspeter (Hrsg.), Datenschutzrecht, Basel 2015, S. 203–244 (zit. Rosenthal Sanktionierung).
Rosenthal David, Kommentierung zu Art. 29 aDSG, in: Rosenthal David/Jöhri Yvonne (Hrsg.), Handkommentar zum Datenschutzgesetz sowie weiteren, ausgewählten Bestimmungen, Zürich 2008.
Rudin Beat, Verpasste Chance und Handlungsbedarf: Ein Blick auf die Datenschutzrechts-Reform(en) und die Wirksamkeit der Datenschutzaufsicht, digma 2020, S. 180–187.
Walter Jean-Philippe, «Vingt ans de législation sur la protection des données, rétrospectives et perspectives» – L’évolution du droit de la protection des données: perspectives, Jusletter 25.6.2012.
Wiederkehr René/Meyer Christian/Böhme Anna, Kommentierung zu Art. 13 VwVG, in: Wiederkehr René/Meyer Christian/Böhme Anna (Hrsg.), VwVG Kommentar, Zürich 2022.
Wiederkehr René/Meyer Christian/Böhme Anna, Kommentierung zu Art. 15 VwVG, in: Wiederkehr René/Meyer Christian/Böhme Anna (Hrsg.), VwVG Kommentar, Zürich 2022.
Wiederkehr René/Meyer Christian/Böhme Anna, Kommentierung zu Art. 55 VwVG, in: Wiederkehr René/Meyer Christian/Böhme Anna (Hrsg.), VwVG Kommentar, Zürich 2022.
Materials
Botschaft zur Genehmigung des Protokolls vom 10.10.2018 zur Änderung des Übereinkommens zum Schutz des Menschen bei der automatischen Verarbeitung personenbezogener Daten vom 6.12.2019, BBl 2020 S. 565 ff., abrufbar unter https://www.fedlex.admin.ch/filestore/fedlex.data.admin.ch/eli/fga/2020/60/de/pdf-a/fedlex-data-admin-ch-eli-fga-2020-60-de-pdf-a.pdf, besucht am 28.6.2023.
Botschaft zum Bundesgesetz über die Totalrevision des Bundesgesetzes über den Datenschutz und die Änderung weiterer Erlasse zum Datenschutz vom 15.9.2017, BBl 2017 S. 641 ff., abrufbar unter https://www.fedlex.admin.ch/filestore/fedlex.data.admin.ch/eli/fga/2017/2057/de/pdf-a/fedlex-data-admin-ch-eli-fga-2017-2057-de-pdf-a.pdf, besucht am 28.6.2023.
Durchführungsbeschluss 7281/19 des Rates der Europäischen Union zur Festlegung einer Empfehlung zur Beseitigung der 2018 bei der Evaluierung der Anwendung des Schengen-Besitzstands im Bereich des Datenschutzes durch die Schweiz festgestellten Mängel vom 8.3.2019, abrufbar unter https://data.consilium.europa.eu/doc/document/ST-7281-2019-INIT/de/pdf, besucht am 28.6.2023.
Normkonzept zur Revision des Datenschutzgesetzes – Bericht der Begleitgruppe Revision DSG vom 29.10.2014, abrufbar unter https://www.newsd.admin.ch/newsd/message/attachments/75506.pdf, besucht am 28.6.2023.