-
- Art. 3 FC
- Art. 5a FC
- Art. 6 FC
- Art. 10 FC
- Art. 13 FC
- Art. 16 FC
- Art. 17 FC
- Art. 20 FC
- Art. 22 FC
- Art. 26 FC
- Art. 29a FC
- Art. 30 FC
- Art. 32 FC
- Art. 42 FC
- Art. 43 FC
- Art. 43a FC
- Art. 55 FC
- Art. 56 FC
- Art. 60 FC
- Art. 68 FC
- Art. 75b FC
- Art. 77 FC
- Art. 96 para. 1 FC
- Art. 96 para. 2 lit. a FC
- Art. 110 FC
- Art. 117a FC
- Art. 118 FC
- Art. 123a FC
- Art. 123b FC
- Art. 130 FC
- Art. 136 FC
- Art. 166 FC
- Art. 178 FC
- Art. 191 FC
-
- Art. 11 CO
- Art. 12 CO
- Art. 50 CO
- Art. 51 CO
- Art. 84 CO
- Art. 97 CO
- Art. 98 CO
- Art. 99 CO
- Art. 100 CO
- Art. 143 CO
- Art. 144 CO
- Art. 145 CO
- Art. 146 CO
- Art. 147 CO
- Art. 148 CO
- Art. 149 CO
- Art. 150 CO
- Art. 701 CO
- Art. 715 CO
- Art. 715a CO
- Art. 734f CO
- Art. 785 CO
- Art. 786 CO
- Art. 787 CO
- Art. 788 CO
- Art. 808c CO
- Transitional provisions to the revision of the Stock Corporation Act of June 19, 2020
-
- Art. 2 PRA
- Art. 3 PRA
- Art. 4 PRA
- Art. 6 PRA
- Art. 10 PRA
- Art. 10a PRA
- Art. 11 PRA
- Art. 12 PRA
- Art. 13 PRA
- Art. 14 PRA
- Art. 15 PRA
- Art. 16 PRA
- Art. 17 PRA
- Art. 19 PRA
- Art. 20 PRA
- Art. 21 PRA
- Art. 22 PRA
- Art. 23 PRA
- Art. 24 PRA
- Art. 25 PRA
- Art. 26 PRA
- Art. 27 PRA
- Art. 29 PRA
- Art. 30 PRA
- Art. 31 PRA
- Art. 32 PRA
- Art. 32a PRA
- Art. 33 PRA
- Art. 34 PRA
- Art. 35 PRA
- Art. 36 PRA
- Art. 37 PRA
- Art. 38 PRA
- Art. 39 PRA
- Art. 40 PRA
- Art. 41 PRA
- Art. 42 PRA
- Art. 43 PRA
- Art. 44 PRA
- Art. 45 PRA
- Art. 46 PRA
- Art. 47 PRA
- Art. 48 PRA
- Art. 49 PRA
- Art. 50 PRA
- Art. 51 PRA
- Art. 52 PRA
- Art. 53 PRA
- Art. 54 PRA
- Art. 55 PRA
- Art. 56 PRA
- Art. 57 PRA
- Art. 58 PRA
- Art. 59a PRA
- Art. 59b PRA
- Art. 59c PRA
- Art. 60 PRA
- Art. 60a PRA
- Art. 62 PRA
- Art. 63 PRA
- Art. 64 PRA
- Art. 67 PRA
- Art. 67a PRA
- Art. 67b PRA
- Art. 73 PRA
- Art. 73a PRA
- Art. 75 PRA
- Art. 75a PRA
- Art. 76 PRA
- Art. 76a PRA
- Art. 90 PRA
-
- Vorb. zu Art. 1 FADP
- Art. 1 FADP
- Art. 2 FADP
- Art. 3 FADP
- Art. 4 FADP
- Art. 5 lit. d FADP
- Art. 5 lit. f und g FADP
- Art. 6 para. 3-5 FADP
- Art. 6 Abs. 6 and 7 FADP
- Art. 7 FADP
- Art. 10 FADP
- Art. 11 FADP
- Art. 12 FADP
- Art. 14 FADP
- Art. 15 FADP
- Art. 19 FADP
- Art. 20 FADP
- Art. 22 FADP
- Art. 23 FADP
- Art. 25 FADP
- Art. 26 FADP
- Art. 27 FADP
- Art. 31 para. 2 lit. e FADP
- Art. 33 FADP
- Art. 34 FADP
- Art. 35 FADP
- Art. 38 FADP
- Art. 39 FADP
- Art. 40 FADP
- Art. 41 FADP
- Art. 42 FADP
- Art. 43 FADP
- Art. 44 FADP
- Art. 44a FADP
- Art. 45 FADP
- Art. 46 FADP
- Art. 47 FADP
- Art. 47a FADP
- Art. 48 FADP
- Art. 49 FADP
- Art. 50 FADP
- Art. 51 FADP
- Art. 52 FADP
- Art. 54 FADP
- Art. 55 FADP
- Art. 57 FADP
- Art. 58 FADP
- Art. 60 FADP
- Art. 61 FADP
- Art. 62 FADP
- Art. 63 FADP
- Art. 64 FADP
- Art. 65 FADP
- Art. 66 FADP
- Art. 67 FADP
- Art. 69 FADP
- Art. 72 FADP
- Art. 72a FADP
-
- Art. 2 CCC (Convention on Cybercrime)
- Art. 3 CCC (Convention on Cybercrime)
- Art. 4 CCC (Convention on Cybercrime)
- Art. 5 CCC (Convention on Cybercrime)
- Art. 6 CCC (Convention on Cybercrime)
- Art. 7 CCC (Convention on Cybercrime)
- Art. 8 CCC (Convention on Cybercrime)
- Art. 9 CCC (Convention on Cybercrime)
- Art. 11 CCC (Convention on Cybercrime)
- Art. 12 CCC (Convention on Cybercrime)
- Art. 16 CCC (Convention on Cybercrime)
- Art. 18 CCC (Convention on Cybercrime)
- Art. 25 CCC (Convention on Cybercrime)
- Art. 27 CCC (Convention on Cybercrime)
- Art. 28 CCC (Convention on Cybercrime)
- Art. 29 CCC (Convention on Cybercrime)
- Art. 32 CCC (Convention on Cybercrime)
- Art. 33 CCC (Convention on Cybercrime)
- Art. 34 CCC (Convention on Cybercrime)
-
- Art. 2 para. 1 AMLA
- Art. 2a para. 1-2 and 4-5 AMLA
- Art. 3 AMLA
- Art. 7 AMLA
- Art. 7a AMLA
- Art. 8 AMLA
- Art. 8a AMLA
- Art. 11 AMLA
- Art. 14 AMLA
- Art. 15 AMLA
- Art. 20 AMLA
- Art. 23 AMLA
- Art. 24 AMLA
- Art. 24a AMLA
- Art. 25 AMLA
- Art. 26 AMLA
- Art. 26a AMLA
- Art. 27 AMLA
- Art. 28 AMLA
- Art. 29 AMLA
- Art. 29a AMLA
- Art. 29b AMLA
- Art. 30 AMLA
- Art. 31 AMLA
- Art. 31a AMLA
- Art. 32 AMLA
- Art. 38 AMLA
FEDERAL CONSTITUTION
MEDICAL DEVICES ORDINANCE
CODE OF OBLIGATIONS
FEDERAL LAW ON PRIVATE INTERNATIONAL LAW
LUGANO CONVENTION
CODE OF CRIMINAL PROCEDURE
CIVIL PROCEDURE CODE
FEDERAL ACT ON POLITICAL RIGHTS
CIVIL CODE
FEDERAL ACT ON CARTELS AND OTHER RESTRAINTS OF COMPETITION
FEDERAL ACT ON INTERNATIONAL MUTUAL ASSISTANCE IN CRIMINAL MATTERS
DEBT ENFORCEMENT AND BANKRUPTCY ACT
FEDERAL ACT ON DATA PROTECTION
SWISS CRIMINAL CODE
CYBERCRIME CONVENTION
COMMERCIAL REGISTER ORDINANCE
FEDERAL ACT ON COMBATING MONEY LAUNDERING AND TERRORIST FINANCING
FREEDOM OF INFORMATION ACT
FEDERAL ACT ON THE INTERNATIONAL TRANSFER OF CULTURAL PROPERTY
- In a nutshell
- I. General
- II. Requirements (para. 1)
- III. Disclosure of personal data (para. 2)
- IV. Duty to provide information and statement (para. 3)
- Bibliography
- Materials
In a nutshell
Art. 55 FADP regulates international administrative assistance between the FDPIC and foreign authorities responsible for data protection. The provision enables cross-border cooperation between data protection authorities and thus contributes significantly to the enforcement of data protection law. Para. 1 regulates the conditions under which the FDPIC may exchange information or personal data with foreign authorities. Para. 2 specifies what information the FDPIC may disclose in connection with such exchanges. Para. 3 sets out the rights of certain persons who may be affected by administrative assistance measures.
I. General
A. Subject matter
1. Basis
1 The purpose of international administrative assistance is to provide mutual and cross-border support to the authorities responsible for data protection (hereinafter: data protection authorities) in the performance of their statutory duties by means of assistance that takes place outside of a procedure governed by procedural law. Art. 55 FADP regulates international administrative assistance between the FDPIC and foreign data protection authorities.
2 Art. 55 is a new provision in the FADP. The previous provision (Art. 31 para. 1 lit. c aDSG) only obliged the FDPIC to cooperate with foreign data protection authorities. This was understood to mean professional exchanges on individual topics or regular cooperation in committees, working groups, or conferences. However, the provision did not provide a sufficient legal basis for the FDPIC to cooperate with foreign authorities and exchange information within the framework of supervising and monitoring federal data protection law. Nevertheless, the FDPIC already cooperated fully with foreign data protection authorities under the aDSG. At that time, cross-border data exchange was largely governed by the general rules of administrative assistance, with primary reference to obligations under international law (Art. 13 ff. Convention 108).
3 Art. 55 FADP now establishes actual procedural rules by regulating the conditions for the exchange of information or personal data with foreign authorities (para. 1) and the information that may be transmitted (para. 2). Para. 3 then gives holders of professional, business, or manufacturing secrets the right to information and the opportunity to comment if the FDPIC discloses information to a foreign authority that may contain such secrets.
4 Art. 55 FADP is in line with European law. Art. 50 of Directive (EU) 2016/680 requires supervisory authorities to provide mutual administrative assistance to each other. At the same time, the provision meets the requirements of Art. 61 DSGVO and Art. 16–21 Convention 108+.
2. International context
5 The aim of Convention 108+ is to create a uniform level of data protection and to strengthen enforcement mechanisms. This includes, in particular, cross-border cooperation between supervisory authorities. Switzerland ratified Convention 108+ on September 7, 2023. Convention 108+ requires ratification by 38 contracting states in order to enter into force. This number had not yet been reached in spring 2025. Subsequent references to Convention 108+ should therefore take into account that it has not yet entered into force. However, it is likely to enter into force soon.
6 Convention 108+ obliges the contracting parties to cooperate and provide mutual assistance in the implementation of the Convention. It provides for various forms of cooperation in a non-exhaustive manner. First and foremost, the supervisory authorities provide each other with administrative assistance, in particular by exchanging all relevant and useful information. This may involve two types of information:
The general exchange of information and documents on the law and administrative practice in the field of data protection. This exchange should not be problematic, as the information can be freely exchanged and made publicly available.
The exchange of confidential information, including personal data. In relation to personal data, Convention 108+ stipulates that such data may only be processed if it is either essential for cooperation (i.e., if cooperation would be ineffective without its provision) or if the data subject has given their explicit, voluntary, and informed consent in relation to the specific case. Otherwise, the exchange of personal data from specific data processing is excluded.
7 In addition to the exchange of relevant and useful information, the objectives of cooperation can also be achieved through coordinated investigations, such as coordinated inquiries or operations, and through the implementation of joint measures.
8 Supervisory authorities are obliged to comply with requests made to them by other supervisory authorities. Art. 20 of Convention 108+ provides for a definitive rejection of requests only if the request is incompatible with the powers of the supervisory authority (lit. a), the request does not comply with the provisions of Convention 108+ (lit. b) or the fulfillment of the request would not be compatible with the sovereignty, national security, or public order (e.g., to ensure the confidentiality of police investigations) of the Contracting Party or with the rights and fundamental freedoms of persons subject to the jurisdiction of that Contracting Party (lit. c).
9 At the level of EU law, there are two legal acts relevant to data protection. The DSGVO is the fundamental act on data protection and regulates the protection of data processed within the internal market. In Article 61, it regulates in detail the mutual assistance between the supervisory authorities of the EU and EEA member states, without the need for special agreements between the member states in individual cases. International administrative assistance is regulated in Article 50(b) DSGVO. The DSGVO is not part of the Schengen acquis and is therefore not binding on Switzerland.
10 Directive (EU) 2016/680 serves to protect personal data processed for the purposes of preventing, investigating, detecting, or prosecuting criminal offenses or enforcing criminal penalties, including the protection against and prevention of threats to public security. As the content of Directive (EU) 2016/680 is based on the DSGVO, the provisions of both legal acts are largely consistent. The Directive is part of the Schengen acquis. As a Schengen-associated state, Switzerland is obliged to accept, implement, and apply further developments of the Schengen acquis, whereby implementation in Switzerland has taken place with regard to the supervisory authority as part of the total revision of the FADP. The obligation of supervisory authorities to provide mutual administrative assistance is laid down in Article 50 of Directive (EU) 2016/680.
B. History
11 In the preliminary draft of the FADP, the provision on international administrative assistance (Art. 47 VE-FADP) was still divided into two paragraphs, with the first paragraph regulating requests for administrative assistance from the FDPIC to foreign authorities and the second paragraph regulating administrative assistance from the FDPIC to foreign authorities. The first paragraph specified the information that the FDPIC may disclose to foreign authorities in order to obtain administrative assistance; the second paragraph laid down the conditions under which the FDPIC may provide administrative assistance to foreign authorities.
12 During the consultation process, some participants argued that the structure of Art. 47 was flawed. They pointed out that the conditions for disclosing information differed depending on whether the FDPIC was the requesting or the requested authority. Several participants ultimately argued that information constituting business or manufacturing secrets should not be disclosed in the context of administrative assistance proceedings between the FDPIC and a foreign data protection authority without the protection of these secrets being guaranteed or the consent of the holder of the secrets being obtained.
13 The structure of the provision underwent a fundamental change in the draft of the FADP and after consultation (Art. 49 E-FADP). Instead of subjecting the FDPIC's requests for administrative assistance to foreign authorities and the FDPIC's administrative assistance to foreign authorities to different regulations, the conditions for the exchange of information or personal data with foreign authorities in para. 1 and the disclosure of personal data in para. 2 were standardized. Para. 2 thus uniformly regulates what information the FDPIC may disclose to foreign authorities to justify its request for administrative assistance or to comply with a request from a foreign authority. The amendments also meant a tightening of the rules: the draft was supplemented with the requirement of reciprocity (Art. 49 para. 1 lit. a E-FADP) and a new para. 3 was added with regard to professional, business, or manufacturing secrets. The concerns expressed in the consultation process regarding the systematics and disclosure of business and manufacturing secrets thus appear to have been heard.
14 In the subsequent deliberations in the Federal Assembly, international administrative assistance no longer gave rise to discussion; the provision was adopted in the version of the draft decree with only minor editorial changes.
C. Purpose of the standard
15 In view of the increasingly cross-border nature of data processing, international cooperation between data protection authorities is becoming increasingly important. The quantitative increase in the cross-border processing of personal data has increased the risk of violations of privacy and data protection in general. To counter this risk, effective and close cooperation in the form of international administrative assistance is essential. The focus is on mutual support between data protection authorities: As part of their supervisory and advisory activities, it is their task to ensure compliance with the relevant data protection regulations, including in a cross-border context, thereby effectively protecting the rights of data subjects.
16 Art. 55 FADP provides the legal basis for the FDPIC to cooperate with foreign data protection authorities and exchange information and personal data as part of its supervisory activities. This enables the FDPIC to exercise its supervisory activities even in cases of cross-border data processing by federal bodies and private individuals, thereby fulfilling its statutory duties. For example, in the context of its supervision and advisory activities relating to cross-border data processing by federal bodies and private individuals, it can contact the data protection authority of the respective recipient country if necessary. This is appropriate, for example, if, due to a lack of local expertise, it needs to draw on the knowledge and information of a foreign data protection authority in order to assess the extent to which the data protection requirements for data exchange are met.
17 International cooperation in the form of administrative assistance always serves to preserve sovereignty. Based on territorial sovereignty in international law, a state has exclusive sovereign authority over its own territory. This must be respected by other states. Authorities of a foreign state may therefore not carry out official acts on foreign territory without the consent of the state concerned. They therefore also have no direct access to data and information located on foreign territory. Administrative assistance makes it possible to overcome this barrier to sovereignty in an orderly procedure by enabling the FDPIC, which has the necessary data and information at its disposal, to provide administrative assistance to foreign data protection authorities. Foreign data protection authorities can thus be referred to the route of administrative assistance. This ultimately prevents foreign data protection authorities from taking extraterritorial (investigative) measures on their own authority. Of course, this also applies in the reverse case, when the FDPIC is dependent on information and personal data held by foreign data protection authorities.
D. Distinctions
1. National administrative assistance
18 In contrast to national administrative assistance, international administrative assistance covers assistance provided to foreign or international authorities or received by the FDPIC from foreign or international authorities. The subject matter is therefore cross-border support between the FDPIC and foreign data protection authorities. It always involves assistance provided to another country. It does not include national administrative assistance provided between the FDPIC and other federal or cantonal authorities for the purpose of fulfilling their respective legal duties, which is governed by Art. 54 FADP.
2. Distinction from legal assistance
19 It is difficult to distinguish between administrative assistance and legal assistance in an international context. While there are at least some criteria for differentiation in the domestic context – even if a clear distinction cannot always be made here either – the legal situation in the international context is even more confusing. Often, the two legal institutions are no longer distinguished at all, but are treated jointly. Some legal scholars therefore call for administrative assistance and legal assistance to be treated together in dogmatic terms. Certain laws then also cover both types of assistance under the same paragraph.
20 However, in our opinion, the distinction is essential due to the associated legal effects. Both the choice of applicable law (legal basis) – and thus the procedural and legal provisions – and the respective requirements and restrictions of the measures may differ: For example, international legal assistance in criminal matters may, under certain circumstances, fall within the scope of Art. 6 of the Convention for the Protection of Human Rights and Fundamental Freedoms (ECHR; SR 0.101). An appeal to the Federal Supreme Court is only admissible in cases of international legal assistance and administrative assistance in tax matters, which generally have a criminal prosecution purpose.
21 The following criteria, which can also be applied in combination, can generally be used to determine administrative and legal assistance:
Type or function of the authorities involved: International legal assistance is provided between judicial authorities. Administrative assistance, on the other hand, is provided between administrative authorities of the requesting and requested states.
Nature of the proceedings supported: In procedural terms, international legal assistance is provided when a foreign or international authority is granted assistance for criminal, administrative, or civil proceedings. It is usually provided in connection with external administrative (i.e., judicial) proceedings. International administrative assistance, on the other hand, involves assistance between authorities of the requesting and requested states outside of proceedings governed by procedural law (judicial proceedings) for the purpose of fulfilling statutory tasks.
22 Since cooperation under Art. 55 FADP involves cross-border assistance between administrative authorities (FDPIC and foreign data protection authorities) and is provided outside of proceedings governed by procedural law, administrative cooperation takes the form of administrative assistance. Art. 55 FADP therefore only regulates international administrative assistance; the FADP does not regulate international legal assistance.
3. Simple administrative cooperation
23 Not all cross-border assistance between the FDPIC and foreign data protection authorities that takes place outside of a procedure governed by procedural law constitutes administrative assistance. Cross-border administrative assistance always relates to specific or identifiable persons and therefore takes place within the framework of a specific case. Para. 1 clearly refers to specific individual cases in which information and personal data are disclosed to a data protection authority so that it can fulfill its legal mandate.
24 Administrative cooperation for the purpose of general information and experience exchange (e.g., on best practices) is simple administrative cooperation. For this purpose, the FDPIC can network with foreign data protection authorities independently of an individual case and the associated specific supervisory activity. This allows for an exchange on relevant issues arising in connection with cross-border data processing and the preparation of opinions or recommendations. Simple administrative cooperation can be based on Art. 58 para. 1 lit. b FADP.
E. Forms of cooperation
25 In the absence of a general law on international administrative assistance, the individual provisions on administrative assistance are scattered across various special laws and international treaties. They are highly heterogeneous, which makes it difficult to categorize them comprehensively. The sectoral approach, on the other hand, makes it possible to take specific account of the particularities of the subject area and the interests and needs of the authorities involved and the persons concerned. The content and scope of formal cooperation with foreign data protection authorities in the area of the FADP is therefore primarily governed by Art. 55 FADP. However, the specific forms of cooperation still need to be defined.
1. Forms of cooperation
26 Art. 55 FADP leaves the form of cooperation open. The provision merely states that the FDPIC may exchange information or personal data with foreign authorities for the purpose of fulfilling their respective statutory tasks in the area of data protection. It is therefore at the discretion of the FDPIC to decide on the intensity and form of cooperation with foreign data protection authorities.
27 The wording of Art. 55 FADP, according to which the FDPIC may exchange information and personal data with foreign authorities, makes it clear that informational administrative assistance is at the heart of the exchange with foreign data protection authorities. This includes the disclosure of factual and personal data for the purpose of supporting the FDPIC and, conversely, by the FDPIC to other foreign data protection authorities for the fulfillment of their respective legal tasks. This form of cooperation may be related to the investigation of suspected violations of the provisions of the respective data protection laws.
28 Art. 55 FADP does not expressly refer to the possibility of conducting coordinated investigations. Nevertheless, the FDPIC is authorized to enter into such forms of cooperation on the basis of Art. 55 FADP. The wording of Art. 55 FADP can certainly be understood to mean that the conduct of coordinated investigations is part of the exchange of information and personal data. Ultimately, cooperation in coordinated investigations is also based on the exchange of information. Furthermore, there is no indication in the materials that forms of cooperation are limited to the exchange of information. Rather, Art. 55 FADP leaves the forms of cooperation open, which argues in favor of the broadest possible understanding of international administrative assistance. In view of the purpose of international administrative assistance, which is to ensure compliance with data protection regulations in a cross-border context as effectively as possible, it stands to reason that all forms of cooperation – provided that the conditions set out in para. 1 are met – fall under international administrative assistance. As a result, the provision of investigative assistance and the conduct of coordinated investigations are also covered by Art. 55 FADP.
29 There is currently no specific legal basis for the recognition and enforcement of decisions by foreign data protection authorities. Even the administrative assistance measures granted by the FDPIC under Art. 55 FADP do not go so far as to include the enforcement of decisions by foreign data protection authorities – such as sanctions – in Switzerland. Given the differences between the catalog of criminal provisions in the FADP and the DSGVO, the enforcement of sanctions imposed by foreign data protection authorities would often fail due to the requirement of double criminality. This is particularly significant because controllers and processors in Switzerland are covered by the territorial scope of the DSGVO and may therefore be subject to its sanctions regime.
2. Multilateral cooperation
30 The increasingly cross-border nature of data processing has led to increased cross-border supervision, which is reflected in the networking of supervisory authorities, in which the FDPIC also participates. For example, the general cross-border exchange of information, which is intended, among other things, to promote the development of cross-border standards, often takes place in multilateral bodies and international networks. These have a varying degree of institutionalization and represent a form of simple administrative cooperation (see N. 23 f.).
3. International treaties
31 Beyond Art. 55 FADP, the Federal Council is free to specifically regulate cooperation between the FDPIC and foreign data protection authorities within the framework of international treaties. The FDPIC would have preferred Art. 55 FADP to have been supplemented to allow it to independently regulate the modalities of cooperation with foreign authorities within the framework of an agreement. However, Art. 67 lit. a FADP stipulates that the Federal Council may independently conclude international treaties concerning international cooperation between data protection authorities.
32 Art. 55 FADP already provides a sufficient basis for the exchange of personal data and, for example, professional, business, and manufacturing secrets under the conditions set out in para. 1. An international treaty is not necessary for this. However, such a treaty is appropriate if long-term cooperation requires a higher degree of cooperation and this is to be formalized. The delimitation of the responsibilities of different data protection authorities can also be regulated within the framework of an international treaty. Finally, an international treaty is necessary if the rights and obligations of data protection authorities are to be established that go beyond Art. 55 of the FADP. Outside the scope of Convention 108+ and Directive (EU) 2016/680, this could include an obligation to provide administrative assistance or the regulation of disclosure to third parties (see N. 8 and N. 10).
F. Limitations
33 In the case of international administrative assistance, it must always be borne in mind that two legal relationships are involved. These can sometimes be in tension with each other. On the one hand, there is a relationship under international law between the requesting and requested states. This relationship is primarily governed by the conditions for providing administrative assistance, as provided for in para. 1. The main question here is to what extent cooperation with the requesting state is permitted in the area of data protection on the basis of para. 1. On the other hand, there is also a legal relationship between the requested state and the person affected by the information or personal data transmitted within the framework of administrative assistance. In this relationship, as far as personal data is concerned, the constitutional right to privacy is balanced against the state's duty to ensure compliance with data protection regulations in a cross-border context. For both relationships, the protection of fundamental rights and data protection law give rise to certain requirements that must be observed when disclosing information and personal data across borders.
34 Art. 13 para. 2 of the Federal Constitution of the Swiss Confederation (FC; SR 101) protects personal and personal data. Informal self-determination ensures that a person can independently decide to whom and when they disclose personal information and whether and for what purpose information about them is processed. The scope of protection is therefore not only affected when personal data is processed improperly. Processing without the consent of the persons concerned is sufficient for this. The disclosure of personal data to third parties is therefore also covered by Art. 13 para. 2 FC. The disclosure of personal data to a foreign data protection authority therefore generally constitutes an infringement of the fundamental rights of the persons concerned.
35 Interference with constitutionally protected rights is permissible under certain conditions (see Art. 36 of the FC). Art. 55 of the Federal Act on Data Protection (FADP) provides a sufficient legal basis for the disclosure of personal data to foreign data protection authorities. There is also a significant public interest in ensuring the most effective possible compliance with data protection regulations in a cross-border context, which ultimately also arises from the protection requirements of Art. 13 para. 2 of the FC itself. The disclosure of personal data to foreign data protection authorities must therefore be proportionate. The individual legal elements of the principles of administrative assistance enshrined in Art. 55 para. 1 FADP – the principles of specificity and confidentiality (see N. 54 ff. and N. 60 ff.), the principle of long arm (see N. 65 ff.) and the possibility of imposing conditions on the disclosure of personal data or anonymizing it (see N. 68 f.) – indirectly contribute to the proportionality of the disclosure in this context. Nevertheless, whenever personal data is disclosed to foreign data protection authorities, the FDPIC must check to what extent the disclosure is proportionate in the specific case. This leads Kerboas/Lennman to comment that such a proportionality check requires a lot of time and resources in each individual case, but sometimes leads to only a minor result.
36 International administrative assistance between the FDPIC and foreign data protection authorities is also subject to the scope of the FADP. This means, first and foremost, that the FDPIC may only disclose personal data if, according to Art. 16 FADP, an adequate level of protection exists in the country of the requesting data protection authority. In relation to the contracting parties to Convention 108+, an adequate level of protection can generally be assumed, subject to special circumstances. The reasons set out in Art. 36 para. 6 FADP also preclude the disclosure of personal data by federal bodies – and thus the FDPIC – to foreign countries. The FDPIC therefore refuses or restricts disclosure in the context of cross-border administrative assistance if this is required by essential public interests, interests of the data subject that are obviously worthy of protection (lit. a) or special data protection provisions (lit. b). With regard to the possibility of refusing or restricting disclosure on the basis of statutory confidentiality obligations, reference can be made to the following explanations (see N. 64 and N. 77).
Public interests that preclude disclosure may include military security, national security, or policing. Such interests also exist if disclosure could compromise the position in negotiations, the opinion-forming and decision-making process of the public body, the effectiveness of investigative, security, or supervisory measures, or relations with foreign countries. Public interests may also include economic, monetary, or currency policy interests. If such interests are affected and it can be assumed with a certain degree of probability that disclosure would cause significant damage, disclosure must be refused.
In the case of the legitimate interests of the person concerned, the primary consideration is the extent to which the disclosure of the information would unreasonably compromise the protection of privacy.
G. Legal protection
37 International administrative assistance is provided between the FDPIC and a foreign data protection authority. The disclosure of information and personal data can initially be described simply as “[...] internal administrative action [...]” or attributed to actual administrative action. The fact that the actual administrative action affects the legal positions of individuals is then a reflex effect of international administrative assistance that it can have on private individuals. Art. 55 FADP does not comment on whether the authorities are obliged to provide administrative assistance for the implementation of an administrative procedure.
38 Effective legal protection naturally requires a suitable object of appeal and thus a decision. If the administrative assistance in the form of information is provided as an administrative act without a decision within the meaning of a real act of the FDPIC, a declaratory decision must first be obtained on the basis of Art. 25a of the Federal Act on Administrative Procedure (Administrative Procedure Act, APA; SR 172.021). In such cases, however, the person concerned will often be unaware of the administrative assistance measure, which means that they cannot actually pursue the route via Art. 25a APA. In the context of effective legal protection, the key question is in which cases there is a right to the issuance of a decision. It is only the decision that opens up the possibility of seeking administrative legal protection.
39 Whether a decision is required for the disclosure of information and personal data by the FDPIC is governed by the general rules of the VwVG. The FADP does not provide for any special legal deviations in this regard. The FDPIC's decision to provide administrative assistance is to be regarded as a decision if legitimate interests of private individuals are affected. Legitimate interests do not require legally protected interests. Purely factual, economic, or non-material interests are sufficient, provided that they appear to be worthy of protection.
40 The concept of interests worthy of protection is based on the status of a party under Art. 6 APA, which in turn is linked to Art. 48 APA. In terms of party status, every person has an interest in a decision that would be legitimate to challenge if a decision were issued. The prerequisite for this is that the person is particularly affected. This person must have a particularly close relationship to the subject matter to be regulated in the decision and therefore be more affected than the general public. Such an impact exists for Wyss, for example, when administrative assistance measures permanently and significantly determine rights and obligations. From this, he concludes that in cases where the legal position is irreversibly changed, a decision must be issued. Conversely, it should be noted that the transfer of personal data or information alone will often “only” constitute a preparatory measure with a view to the subsequent issuance of a decision. The initiation of administrative proceedings does not in itself constitute a decision. In the area of international administrative assistance, however, it is important to note that the transfer of data abroad may in itself constitute an interference with the interests of the persons concerned that are worthy of protection, as confirmed by Art. 16 ff. FADP.
41 More generally, it can be said that the disclosure of personal data always constitutes an interference with informational self-determination. This means that there is always sufficient concern. If the FDPIC concludes that the conditions for administrative assistance under para. 1 are met, it must initiate proceedings for the disclosure of personal data and decide on the disclosure of personal data to a foreign data protection authority in a decision pursuant to Art. 5 and Art. 34 f. APA. The status of party to the proceedings allows the data subject to exercise the rights granted to parties under the APA: this includes, among other things, the right to a fair hearing, the right to inspect files, the right to representation, and the right to receive notification of the decision. Finally, participation in the administrative proceedings is also closely linked to the right to appeal.
42 In the case of the disclosure of professional, business, or manufacturing secrets, a particular interest is also readily apparent. In this context, para. 3 obliges the FDPIC to give the persons concerned the opportunity to comment before disclosing information that may contain professional, business, or manufacturing secrets to a foreign data protection authority. This already follows from the right to a fair hearing under Art. 29 APA. Art. 55 para. 3 FADP therefore does not create any recognizable procedural added value, but serves to clarify the situation.
43 The persons concerned must be involved in the administrative procedure at a time that allows them to effectively exercise their rights as parties. In other words, legal protection must be provided in a timely manner. Before disclosing the information or personal data to the requesting data protection authority, the FDPIC must inform the data subjects of the planned disclosure: once the information or personal data has been disclosed to the requesting data protection authority, domestic legal protection can no longer be effectively applied. Further processing of the information or personal data is determined outside the Swiss legal system. Since the use of the information and personal data abroad cannot be prevented, disclosure to the requesting data protection authority creates an irreversible situation. The Federal Supreme Court has also recognized this in the context of international administrative assistance in tax matters: “Once the data has been transferred abroad, it is generally no longer possible to ensure that it will not be used.”
44 With the FDPIC, a federal authority decides on cooperation with and the disclosure of information and personal data to foreign data protection authorities. If the decision to disclose is made in the form of an order pursuant to Art. 5 APA, the appeal procedure is also governed by the APA. Pursuant to Art. 44 APA, the orders are subject to appeal to the Federal Administrative Court. Decisions concerning international administrative assistance are generally excluded from appeal to the Federal Supreme Court in public law matters. This is intended to relieve the burden on the Federal Supreme Court and enable rapid proceedings through the shortened chain of appeal. Accordingly, the Federal Administrative Court decides in the final instance on international administrative assistance within the scope of the FADP. It is nevertheless conceivable that, with regard to other issues for which the Federal Supreme Court is responsible, a preliminary ruling on the admissibility of international administrative assistance may be necessary.
II. Requirements (para. 1)
A. General
45 Art. 55 para. 1 FADP regulates the conditions under which the FDPIC may exchange information and personal data with foreign authorities for the purpose of fulfilling their respective legal duties in the area of data protection. These conditions are characteristic elements of cross-border administrative assistance. They have developed in the context of mutual legal assistance and are applied to the area of administrative assistance.
1. Competent authorities
46 According to Art. 55 para. 1 FADP, foreign authorities that are responsible for data protection in their country are covered. In other words, the exchange of information and personal data only takes place with foreign data protection authorities. The FADP does not contain any further requirements for qualification as a foreign data protection authority. In our opinion, the supervisory authority as described in Art. 15 of Convention 108+ can be used to understand the term. This provision obliges the contracting parties to establish one or more independent and impartial public supervisory and control authorities that contribute to the protection of natural persons with regard to the processing of their personal data. These authorities may be a single data protection officer or a collegiate body. In addition to independence, it is essential that the supervisory authority has effective supervisory and control instruments at its disposal. The authority must therefore also have investigative powers.
47 Furthermore, a distinction must be made between the data processing bodies of the respective states – including the supervisory authorities in certain economic sectors or industries – and the specific supervisory authorities in the field of data protection. Cross-border cooperation in the context of data protection law takes place primarily at the level of the data processing bodies. In the course of their daily work, these bodies must assess whether the exchange of information and personal data with a foreign authority is permissible. For the data processing bodies, cooperation is governed by the relevant substantive law. Articles 16 and 36 of the FADP must always be observed. The FDPIC, on the other hand, is responsible for supervising these data processing bodies, for which purpose it can rely on the international administrative assistance provided for in Article 55 of the FADP.
2. Scope and content
48 The exchange of information and personal data relates to all statutory tasks of the FDPIC or the foreign data protection authority. The scope of the statutory tasks is determined by national legislation, and the permissibility of the exchange is determined by the request, which must explain to what extent the information or personal data is necessary for the fulfillment of the statutory tasks. The statutory tasks of the FDPIC are listed in Chapter 7 of the FADP. The FDPIC may take all actions to which it is authorized under the provisions of the FADP applicable to its activities in order to fulfill foreign requests for administrative assistance.
49 In addition to information, the FDPIC may also exchange personal data within the meaning of Art. 5 lit. a FADP. The FDPIC may therefore disclose any information relating to an identified or identifiable natural person.
3. Legal nature
50 Art. 55 FADP does not contain any obligation to provide cross-border administrative assistance. It merely authorizes the FDPIC to provide administrative assistance or to request administrative assistance under the conditions set out in para. 1. However, in relation to foreign data protection authorities that are signatories to Convention 108+, the obligation under the convention to provide administrative assistance and the grounds for refusal must be observed (see N. 8).
B. Conditions for admissibility
51 In order for the FDPIC to exchange information and personal data with foreign data protection authorities, the following five conditions must be met cumulatively in accordance with Art. 55 para. 1 FADP. In practice, it is difficult to conclusively assess the extent to which the individual conditions are met. In practice, therefore, the conditions should be set out in writing in the context of granting administrative assistance and communicated to the requesting foreign data protection authority.
1. Reciprocity (lit. a)
52 Art. 55 para. 1 lit. a FADP stipulates that reciprocity of administrative assistance must be ensured between Switzerland and the foreign state. Reciprocity is a characteristic element of administrative assistance. Accordingly, a requesting data protection authority can only request administrative assistance in the form of information and personal data if it is also prepared to grant administrative assistance itself.
53 Such administrative assistance is guaranteed in relation to the contracting parties to Convention 108+ and to the member states of the EU on the basis of Directive (EU) 2016/680. In relation to other foreign data protection authorities, reciprocity is bindingly guaranteed if an international treaty provides for administrative assistance with reciprocal rights. The Federal Council may conclude such international treaties independently on the basis of Art. 67 lit. a FADP. Without an international treaty basis, the FDPIC must obtain assurance of reciprocity in each individual case, whereby it can only comply with the request for administrative assistance on the basis of such assurance.
2. Principle of speciality (lit. b)
54 Art. 55 para. 1 lit. b FADP is an expression of the principle of speciality. The principle of speciality or the principle of purpose limitation is a traditional principle of international law governing international administrative and legal assistance, which derives from extradition law. It is also enshrined in Art. 19 of Convention 108+. The Federal Supreme Court attributes customary international law character to the principle, at least in the area of extradition law. However, the principle is also codified in many federal laws governing administrative assistance.
55 According to the principle, the information and personal data exchanged may be used by the requesting authority only for the data protection procedure on which the request for administrative assistance is based and for which the information or personal data was transmitted. Further use is only permitted if the laws of both states or an international treaty provide for such a possibility and the requested authority that provided the information or personal data approves the further use in the specific individual case. For subsequent and parallel use of the information and personal data in any criminal proceedings, the principles of international legal assistance in criminal matters must be observed.
56 The principle of speciality serves as a barrier that primarily protects the sovereignty of the requested state. At the same time, however, the purpose limitation also serves to strengthen the personal rights of the persons concerned and is intended to ensure the proportionate use of the information and personal data. Unrestricted further use by the requesting state is prohibited by the purpose limitation.
57 In addition to its barrier function, the principle of speciality also acts as a condition of admissibility for the disclosure of information and personal data: the requesting data protection authority must provide sufficient assurance that it will use the information or personal data only for the purpose for which it was transmitted by the requested authority. Based on the principle of good faith under international law, the Federal Supreme Court has so far taken the view that compliance with the principle of speciality by states can be taken for granted. Only if there are concrete indications of misuse in the requesting state should compliance with the principle be reviewed. Against the background of this case law, the FDPIC does not need to obtain assurances if the administrative assistance is based on an international treaty that includes the principle of speciality. Both contracting parties are directly bound to observe the principle of speciality on the basis of the principle of good faith under Art. 26 of the Vienna Convention on the Law of Treaties (SR 0.111). If, on the other hand, administrative assistance is provided exclusively on the basis of Art. 55 para. 1 lit. b FADP, the FDPIC must expressly inform the requesting foreign data protection authority of the requirement of (further) use associated with the principle of speciality and remind it of the limits within which the transmitted information or personal data may be used.
58 In terms of admissibility requirements, the purpose limitation arising from the principle of speciality requires that the requesting data protection authority specify the purpose for which the requested information or personal data is needed. This principle therefore results in an obligation to provide justification.
59 The controllability and enforceability of purpose limitation are, of course, limited. If a foreign data protection authority violates the principle of speciality, the FDPIC may reject future requests for administrative assistance from that authority on the grounds that there is insufficient guarantee of compliance with the principle of speciality. Apart from that, it can be assumed that enforcement must regularly be carried out by the data subject and through individual legal protection. This applies if the personal data of the data subject is actually used in a subsequent procedure as a result of its impermissible reuse – i.e., in a procedure that is not based on the original request for administrative assistance and for which the personal data was not transferred. In such a case, the data subject would have to complain about the impermissible transfer within the framework of the procedure in question. The extent to which this option is available depends in particular on the applicable (possibly foreign) procedural law.
3. Principle of confidentiality (lit. c)
60 Art. 55 para. 1 lit. c FADP is concerned with the protection of special confidentiality interests. The provision requires the requesting authority to undertake to protect these secrets. The scope and content of the secrets to be protected are determined by the relevant criminal law provisions and the relevant case law. For professional secrecy, reference is made to Art. 321 SCC, and for manufacturing and business secrets to Art. 162 SCC and Art. 273 SCC.
61 Professional secrecy applies in particular to clergy, lawyers, doctors, dentists, pharmacists, midwives, and psychologists.
62 The concept of secrecy is generally understood broadly in connection with business secrets; there is no legal definition. According to Federal Supreme Court case law, facts that are neither obvious nor generally accessible (relative obscurity) are not considered secrets if the holder of the secret has a legitimate interest in keeping them secret (objective interest in secrecy) and wishes to keep them secret for legitimate reasons (subjective interest in secrecy). Trade secrets are information that could impair the commercial success of the company or distort competition if it became known to competing companies. Trade secrets therefore include all technical, organizational, commercial, and financial facts of economic life that could influence the commercial success of the owner of the secret.
63 Manufacturing secrets are to be treated in the same way as trade secrets: they relate in particular to the technical side of production, i.e., knowledge that contains instructions for technical action. This refers to knowledge that is used in the manufacture of products and that is not recognizable in the product sold and is therefore capable of being kept secret. This includes, for example, information about manufacturing, production, or construction processes and instructions, as well as research results, production and construction plans, or sources of supply.
64 Legal confidentiality obligations do not per se preclude disclosure to foreign data protection authorities. Art. 55 para. 1 lit. c FADP makes it clear that such information may be disclosed provided that the requesting data protection authority maintains professional secrecy and business and manufacturing secrets (see N. 77 ff.); Art. 55 FADP therefore allows for an exception to the statutory confidentiality obligation. However, Art. 55 para. 3 FADP obliges the FDPIC to obtain the opinion of the parties concerned before disclosing information that could contain professional, business, or manufacturing secrets (see N. 78). This makes it clear that a balance must be struck between the interest in disclosing the information and the interests of confidentiality.
4. Principle of the long arm (lit. d)
65 According to Art. 55 para. 1 lit. d FADP, information and personal data may only be disclosed to third parties – including other authorities – if the requested data protection authority has given its prior approval for such disclosure. Third parties primarily refer to third-party authorities in the requesting country that are not involved in the exchange between the FDPIC and the foreign data protection authority.
66 The approval requirement protects the persons concerned from further disclosure of information or personal data relating to them. It also ensures that the FDPIC retains control over the information and personal data. If there is a particular interest, the data subject must be heard before the disclosure is approved; in addition, the other rights of the parties must be safeguarded. This applies in particular to the disclosure of personal data. For further information, please refer to the comments on legal protection (see N. 37 ff.).
67 The FDPIC must obtain a corresponding assurance from the foreign data protection authority. It may refrain from obtaining such an assurance if the prohibition of disclosure to third parties is already effectively ensured by another legal basis, such as an international treaty.
5. Compliance with conditions and restrictions (lit. e)
68 According to Art. 55 para. 1 lit. e FADP, the requesting authority must comply with the conditions and restrictions imposed by the authority that provided it with the information and personal data. This provision allows the disclosure of information and personal data in cases where, without the possibility of conditions or restrictions such as anonymization, a request for administrative assistance would have to be rejected.
69 Since the FDPIC is bound by Art. 36 para. 6 FADP in the context of administrative assistance and this provision already links the disclosure of personal data to the possibility of conditions and restrictions, lit. e is essentially a repetition. However, the provision makes it clear that, even in the context of international administrative assistance, the FDPIC must base the disclosure of personal data on a case-by-case assessment of the interest in administrative assistance and the conflicting interests under Art. 36 para. 6 FADP.
III. Disclosure of personal data (para. 2)
70 Art. 55 para. 2 FADP specifies what information the FDPIC may disclose to the foreign data protection authority in order to justify its request for administrative assistance or to comply with a request from a foreign data protection authority. The list is not exhaustive, as can be seen from the wording “in particular” in the introductory sentence. In other words, the FDPIC may also provide other information to justify its request for administrative assistance or to comply with a request for administrative assistance from a foreign authority.
71 According to the provision, the FDPIC may provide information on the identity of the controller, the processor or other third parties involved (lit. a) as well as on categories of data subjects (lit. b). The mention of categories serves to assign persons to standardized groups that share certain common characteristics. The dispatch cites “consumers,” “members of the armed forces,” and “employees” as examples of such categories.
72 The FDPIC may only disclose the identity of the data subjects if the data subjects have given their consent (lit. c no. 1). Disclosure of identity already occurs when a person can be identified. This may be apparent from the data itself. However, the identity is already identifiable if it can be determined without disproportionate effort from the context of the data or by combining it with other data.
73 The disclosure of identity requires the consent of each individual data subject. Otherwise, disclosure is not permitted. The requirements of Art. 6 para. 6 and para. 7 FADP apply to legally valid consent. Consent is therefore only valid if it is given voluntarily after adequate information has been provided and in relation to the specific disclosure. Adequate information includes details of the responsible person, the objective or purpose, the manner and scope of data processing, the categories of data processed, and details of the transfer of data. Consent is not bound to any form and therefore does not require a written declaration. However, when disclosing particularly sensitive personal data to foreign data protection authorities, consent must be given explicitly. According to the message accompanying the FADP, a declaration of intent is explicit “[...] if it is made in writing or verbally or by means of a sign and the intention expressed is immediately apparent from the words or sign used.”
74 Consent is central to processing by private individuals because it serves as justification for an infringement of privacy. Regardless of consent, however, the FDPIC remains the addressee of fundamental rights. The disclosure of identity to foreign data protection authorities must therefore continue to serve the public interest and be proportionate in order to be justified, due to the interference with Art. 13 para. 2 of the FC (see N. 34 f.). The consent requirement therefore does not serve as justification for the processing of data by federal bodies such as the FDPIC, but as an additional barrier to disclosure.
75 In exceptional cases, the FDPIC may disclose the identity of the persons concerned if the disclosure of the identity of the person concerned is indispensable for the fulfillment of the statutory task by the FDPIC or the foreign data protection authority (lit. c no. 2). The exception is analogous to Art. 36 para. 2 lit. a and lit. b FADP, which sets out such requirements for national administrative assistance, provided that there is no specific legal basis. Indispensability means that the task cannot be fulfilled at all without the disclosure of data.
76 In addition, the FDPIC may provide information about the personal data or categories of personal data processed (lit. d), the purpose of the processing (lit. e), the recipients and categories of recipients (lit. f), and the technical and organizational measures (lit. g).
IV. Duty to provide information and statement (para. 3)
77 Art. 55 para. 3 FADP obliges the FDPIC, in the context of administrative assistance proceedings, to disclose information that may contain professional, business, or manufacturing secrets to a foreign data protection authority only if it has given the persons concerned the opportunity to comment in advance. Both natural and legal persons may be affected. Contrary to what was requested in the consultation, the legislator has not made the disclosure of business and manufacturing secrets subject to the consent of the person concerned.
78 The purpose of the provision is to protect the rights of persons who are holders of professional, business, or manufacturing secrets. To this end, para. 3 provides for a duty to inform and a right to be heard. Before the FDPIC discloses information to a foreign data protection authority that may contain professional, business, or manufacturing secrets, it must inform the persons concerned who are the bearers of these secrets about the possible disclosure. The FDPIC is then obliged to obtain the opinion of the persons concerned. This gives the persons concerned the opportunity to present their point of view to the FDPIC in a statement and to justify why the information relating to professional, business, or manufacturing secrets should not be disclosed to the foreign data protection authority.
79 By informing the persons concerned in advance and giving them the opportunity to comment, the FDPIC helps to ensure that their interests are taken into account and their secrets are protected. The comments should be taken into account in the FDPIC's decision-making process, but they are not binding: para. 3 does not oblige the FDPIC to comply with the comments of the persons concerned. However, it has a duty to take note of the comments and to give them considerable weight in its decision-making. The more the professional, business, or manufacturing secrets of the holder of the secret are affected, the more weight must be given to the comments of the persons concerned.
80 According to Gerschwiler, the persons concerned must be informed as soon as there is a certain probability that professional, business, or manufacturing secrets could be disclosed. This is to be agreed with. The protection of professional, business, and manufacturing secrets can only be effectively guaranteed if the FDPIC does not wait until it is certain that secrets protected by criminal law are affected before informing the persons concerned. In order to be able to effectively take into account the interests of the holders of secrets and to involve them in the decision-making process in a timely manner by giving them the opportunity to comment, a generous standard must be applied. This may also help to avoid subsequent complaints.
81 In exceptional cases, the FDPIC is not obliged to obtain a statement from the persons concerned. This is the case if a statement is not possible or would involve a disproportionate amount of effort. This exception has apparently been made for practical reasons and is intended to prevent the disclosure of information to foreign data protection authorities from being undermined if it is impossible to obtain a statement or only possible with disproportionate effort. Since the FDPIC's disclosure interferes with the criminal law protection of the professional, business, or manufacturing secrets of the persons concerned, it should not be hastily assumed that this is impossible or unreasonable. However, the permissible course of action will ultimately have to be determined by case law.
Bibliography
Bachmann Gregor, Anspruch auf Verfahren und Entscheid, Bern 2019.
Baeriswyl Bruno, Die Einwilligung hilft (nicht) weiter, digma 2020, S. 62–66.
Baeriswyl Bruno, Kommentierung zu Art. 31, in: Bruno Baeriswyl/Kurt Pärli (Hrsg.), Stämpflis Handkommentar, Datenschutzgesetz (DSG), 1. Aufl., Bern 2015.
Baeriswyl Bruno, Kommentierung zu Art. 55 DSG: in: Baeriswyl Bruno/Pärli Kurt/Blonski Dominika (Hrsg.), Stämpflis Handkommentar, Datenschutzgesetz, 2. Aufl., Bern 2023.
Baeriswyl Bruno, Kommentierung zu Art. 6 DSG: in: Baeriswyl Bruno/Pärli Kurt/Blonski Dominika (Hrsg.), Stämpflis Handkommentar, Datenschutzgesetz, 2. Aufl., Bern 2023.
Bai Alain, Der Rechtsschutz gemäss Art. 6 EMRK in Verfahren der internationalen Amtshilfe im Bereich der direkten Steuern, Zürich 2018.
Bellanger François, L’entraide administrative en Suisse, in: Bellanger François/Tanquerel Thierry (Hrsg.), L’entraide administrative, Zürich/Basel 2005, S. 9–28.
Belser Eva Maria/Epiney Astrid/Waldmann Bernhard, Datenschutzrecht, Grundlagen und öffentliches Recht, Bern 2011.
Benhamou Yaniv/Jacot-Guillarmod Emilie, GDPR on the Swiss Territory, Jusletter IT vom 24. Mai 2018.
Biaggini Giovanni, BV Kommentar, 2. Aufl., Zürich 2017.
Blöchlinger Karin, Amtsgeheimnis und Behördenkooperation, Zum Spannungsfeld von Geheimnisschutz und Verwaltungstätigkeit, Zürich 2015.
Bopp Christian, Das Schweizerische Bankgeschäft, 8. Aufl., Zürich 2021.
Breitenmoser Stephan, Internationale Amtshilfe in Finanzmarktsachen in der Rechtsprechung des Bundesverwaltungsgerichts – aktuelle Fragen und Tendenzen, in: Breitenmoser Stephan/ Ehrenzeller Bernhard (Hrsg.), Internationale Amts- und Rechtshilfe in Steuer- und Finanzmarktsachen, Zürich 2017, S. 185–199.
Breitenmoser Stephan/Bai Alain, Internationale Amts- und Rechtshilfe mit Bezügen zum Ausländerrecht, in: Uebersax Peter/Rudin Beat/Hugi Yar Thomas/Geiser Thomas/Vetterli Luzia (Hrsg.), Ausländerrecht, 3. Aufl., Basel 2022, S. 1921–2015.
Breitenmoser Stephan/Weyeneth Robert, Amts- und Rechtshilfe ist nicht gleich Amts- und Rechtshilfe, in: Fankhauser Roland/Widmer Lüchinger Corinne/Klingler Rafael/Seiler Benedikt (Hrsg.), Das Zivilrecht und seine Durchsetzung, Festschrift für Professor Thomas Sutter-Somm, Zürich 2016, S. 1063–1084.
Diggelmann Oliver, Kommentierung zu Art. 13 BV, in: Waldmann Bernhard/Belser Eva Maria/Epiney Astrid (Hrsg.), Basler Kommentar, Bundesverfassung, Basel 2015.
Dix Alexander, Kommentierung zu Art. 61 DSGVO, in: Kühlig Jürgen/Buchner Benedikt (Hrsg.), DS-GVO/BDSG, Datenschutz-Grundversorgung, Bundesdatenschutzgesetz, Kommentar, 3. Aufl., München 2020.
Donatsch Andreas/Heimgartner Stefan/Meyer Frank/Simonek Madeleine, Internationale Rechtshilfe, 2. Aufl., Zürich 2015.
du Pasquier Shelby R., Internationale Amtshilfe: Informationsaustausch und verfahrensrechtliche Aspekte, AJP 2006, S. 74–82.
Egli Patricia, Kommentierung zu Art. 44 BV, in: Ehrenzeller Bernhard et al. (Hrsg.), St. Galler Kommentar, Bundesverfassung, 4. Aufl., Zürich 2023.
Ferrari-Visca Reto, Strafrechtliche Datenschutzbestimmungen, in: Dal Molin Luca/Wesiak-Schmidt Kirsten (Hrsg.), Datenschutz im Unternehmen, Praxishandbuch mit Beispielen und Checklisten, Zürich/St. Gallen 2023, S. 365–427.
Frei Nula, Kommentierung zu Art. 67 DSG, in: Steiner Thomas/Morand Anne-Sophie/Hürlimann Daniel (Hrsg.), Onlinekommentar zum Bundesgesetz über den Datenschutz (Version: 07.09.2023), https://onlinekommentar.ch/de/kommentare/dsg67.
Gächter Thomas/Egli Philipp, Kommentierung zu Art. 43 VwVG, in: Auer Christoph/Müller Markus/Schindler Benjamin (Hrsg.), Kommentar, Bundesgesetz über das Verwaltungsverfahren (VwVG), 2. Aufl., Zürich 2019.
Gerschwiler Stefan, Kommentierung zu Art. 55 DSG, in: Bieri Adrian/Powell Julian (Hrsg.), Orell Füssli Kommentar, DSG, Kommentar zum Schweizerischen Datenschutzgesetz mit weiteren Erlassen, Zürich 2023.
Häberli Thomas, Kommentierung zu Art. 83 BGG, in: Niggli Marcel Alexander/Uebersax Peter/Wiprächtiger Hans/Kneubühler Lorenz (Hrsg.), Basler Kommentar, Bundesgerichtsgesetz, 3. Aufl., Basel 2018.
Häfelin Ulrich/Müller Georg/Uhlmann Felix, Allgemeines Verwaltungsrecht, 8. Aufl., Zürich 2020.
Harrendorf Stefan/König Stefan/Voigt Lea, Kommentierung zu Art. 6 EMRK, in: Meyer-Ladewig Jens/Nettesheim Martin/von Raumer Stefan (Hrsg.), Handkommentar, Europäische Menschenrechtskonvention, 5. Aufl., Baden-Baden 2023.
Husi-Stämpfli Sandra/Rudin Beat, Datenschutz, in: Tschudi Hans Martin/Schindler Benjamin/Ruch Alexander/Jakob Eric/Friesecke Manuel (Hrsg.), Die Grenzüberschreitende Zusammenarbeit der Schweiz, Zürich/St. Gallen 2014, S. 623–648.
Jaag Tobias/Häggi Furrer Reto, Kommentierung zu Art. 43 VwVG, in: Waldmann Bernhard/Weissenberger Philippe (Hrsg.), Praxiskommentar, Verwaltungsverfahrensgesetz, 2. Aufl., Zürich 2016.
Kerboas Cécile/Lennman Catherine, Kommentierung zu Art. 55 DSG, in: Meier Philippe/Métille Sylvain (Hrsg.), Commentaire Romand, Loi fédérale sur la protection des données, Basel 2023.
Kiener Regina/Rütsche Bernhard/Kuhn Mathias, Öffentliches Verfahrensrecht, 3. Aufl., Zürich 2021.
Kölz Alfred/Häner Isabelle/Bertschi Martin/Bundi Livio, Verwaltungsverfahren und Verwaltungsrechtspflege des Bundes, 4. Aufl., Zürich/Genf 2025.
Mazidi Simon, Kommentierung zu Art. 59 DSG, in: Blechta Gabor-Paul/Vasella David (Hrsg.), Basler Kommentar, Datenschutzgesetz/Öffentlichkeitsgesetz, 4. Aufl., Basel 2023.
Mund Claudia, Kommentierung zu Art. 36 DSG: in: Baeriswyl Bruno/Pärli Kurt/Blonski Dominika (Hrsg.), Stämpflis Handkommentar, Datenschutzgesetz, 2. Aufl., Bern 2023.
Opel Andrea, Amtshilfe ohne Information der Betroffenen – eine rechtsstaatlich bedenkliche Neuerung, ASA 83 (2014), S. 265–295 (zit. als Opel, Amtshilfe).
Opel Andrea, Neuausrichtung der schweizerischen Abkommenspolitik in Steuersachen: Amtshilfe nach dem OECD-Standard, Bern 2015 (zit. als Opel, Neuausrichtung).
Oswald Diana, Verfahrensrechtliche Aspekte der internationalen Amtshilfe in Steuersachen, Zürich 2015.
Pasquier Aurélien, Die Sanktionen in der DSGVO, in: Epiney Astrid/Rovelli Sophia (Hrsg.), Datenschutzgrundverordnung (DSGVO): Tragweite und erste Erfahrungen/Le Règlement général sur la protection des données (RPDG): portée et premières expériences, Zürich 2020, S. 99–138.
Poltier Etienne, L’entraide administrative interne, in: Poltier Etienne/Favre Anne-Christine/Martenet Vincent (Hrsg.), L'entraide administrative, Évolution ou révolution?, Zürich 2019, S. 61–102.
Popp Peter, Grundzüge der internationalen Rechtshilfe in Strafsachen, Basel 2001.
Rosenthal David, Das neue Datenschutzgesetz, Jusletter 16. November 2020.
Roth Florian/Mazidi Simon, Kommentierung zu Art. 54 DSG, in: Steiner Thomas/Morand Anne-Sophie/Hürlimann Daniel (Hrsg.), Onlinekommentar zum Bundesgesetz über den Datenschutz (Version: 30.01.2024), https://onlinekommentar.ch/de/kommentare/dsg54.
Rudin Beat, Kommentierung zu Art. 5 DSG: in: Baeriswyl Bruno/Pärli Kurt/Blonski Dominika (Hrsg.), Stämpflis Handkommentar, Datenschutzgesetz, 2. Aufl., Bern 2023.
Schweizer Rainer J., Anforderungen der EGMR-Rechtsprechung an die internationale Amts- und Rechtshilfe, in: Lorandi Franco/Staehelin Daniel (Hrsg.), Innovatives Recht, Festschrift für Ivo Schwander, Zürich 2011, S. 985–1010 (zit. als Schweizer, FS Schwander).
Schweizer Rainer J., Kommentierung zu Art. 44 BV, in: Ehrenzeller Bernhard/Schindler Benjamin/Schweizer Rainer J./Vallender Klaus A. (Hrsg.), St. Galler Kommentar, Bundesverfassung, 3. Aufl., Zürich 2014.
Schweizer Rainer J., Von einer Amts- und Rechtshilfe auf Ersuchen zum internationalen Informationsverbund: Grundsätzliche Aspekte, in: Breitenmoser Stephan/Ehrenzeller Bernhard (Hrsg.), Internationale Amts- und Rechtshilfe in Steuer- und Finanzmarktsachen, Zürich 2017, S. 227–293 (zit. als Schweizer, Informationsverbund).
Seferovic Goran, Kommentierung zu Art. 21 UWG, in: Heizmann Reto/Loacker Leander D. (Hrsg.), Bundesgesetz gegen den unlauteren Wettbewerb (UWG), Kommentar,2. Aufl., Zürich/St. Gallen 2025 (zit. als Seferovic, in: Heizmann/Loacker).
Seiler Hansjörg, Internationale Amtshilfe aus Schweizer Sicht, Liechtensteinische Juristenzeitung 32 (2011), S. 42–50.
Thurnherr Daniela, Verfahrensgrundrechte und Verwaltungshandeln, Zürich/St. Gallen 2013.
Vasella David, Zur Freiwilligkeit und zur Ausdrücklichkeit der Einwilligung im Datenschutzrecht, Jusletter 16. November 2015.
Vest Hans, Kommentierung zu Art. 32 BV, in: Ehrenzeller Bernhard et al. (Hrsg.), St. Galler Kommentar, Bundesverfassung, 4. Aufl., Zürich 2023.
Waldmann Bernhard, Anspruch auf den Erlass einer Verfügung, in: Häner Isabelle/Waldmann Bernhard (Hrsg.), 8. Forum für Verwaltungsrecht – Brennpunkt «Verfügung», Bern 2022, S. 55–85.
Waldmann Bernhard/Kraemer Raphael, Kommentierung zu Art. 44 BV, in: Waldmann Bernhard/Belser Eva Maria/Epiney Astrid (Hrsg.), Basler Kommentar, Bundesverfassung, Basel 2015.
Weber-Dürler Beatrice/Kunz-Notter Pandora, Kommentierung zu Art. 25 VwVG, in: Auer Christoph/Müller Markus/Schindler Benjamin (Hrsg.), VwVG – Bundesgesetz über das Verwaltungsverfahren, Kommentar, 2. Aufl., Zürich 2019 (zit. als Weber-Dürler/Kunz-Notter, in: Auer/Müller/Schindler).
Weissenberger Philippe, Grenzüberschreitende Amtshilfe auf dem Prüfstand – Wege zu mehr Rechtssicherheit, Rechtsschutz und Effizienz, ASA 77 (2009), S. 825–835.
Widmer Thomas, Les amendes «administratives» prévues par l’art. 83 du RGPD peuvent-elles être reconnues et exécutées en Suisse?, sic! 2023, S. 387–390.
Wyss Martin Philipp, Gesetzgebungsbedarf bei der internationalen Amtshilfe?, in: Ehrenzeller Bernhard/Breitenmoser Stephan (Hrsg.), Aktuelle Fragen der internationalen Amts- und Rechshilfe, St. Gallen 2009, S. 217–248.
Materials
Botschaft zum Bundesgesetz über den Datenschutz (DSG) vom 23.3.1988, BBl 1988 II 413 ff. (zit. als Botschaft DSG 1988).
Botschaft zur Auferlegung der Kosten für die Behandlung zweier Amtshilfegesuche des Internal Revenue Service der Vereinigten Staaten von Amerika auf die UBS AG, BBl 2010 3211 (zit. als Botschaft Kostenauferlegung).
Botschaft zum Bundesgesetz über die Totalrevision des Bundesgesetzes über den Datenschutz und die Änderung weiterer Erlasse zum Datenschutz, BBl 2017 6941 ff. (zit. als Botschaft DSG 2017)
Botschaft zur Genehmigung des Protokolls vom 10.10.2018 zur Änderung des Übereinkommens zum Schutz des Menschen bei der automatischen Verarbeitung personenbezogener Daten, BBl 2020 565 ff. (zit. Botschaft Konvention 108+).
Botschaft zur Totalrevision der Bundesrechtspflege, BBl 2001 4202 ff. (zit. als Botschaft Bundesrechtspflege 2001).
Bundesamt für Justiz, Erläuternder Bericht zum Vorentwurf für das Bundesgesetz über die Totalrevision des Datenschutzgesetzes und die Änderung weiterer Erlasse zum Datenschutz vom 21.12.2016, https://www.bj.admin.ch/dam/bj/de/data/staat/gesetzgebung/datenschutzstaerkung/vn-ber-d.pdf.download.pdf/vn-ber-d.pdf, besucht am 1.8.2023 (zit. als Erl. Bericht VE).
Bundesamt für Justiz, Rechtsfragen im Zusammenhang mit der Zusammenarbeit mit ausländischen Behörden (Amtshilfe, Rechtshilfe, Souveränitätsschutz), Bericht vom 14.3.2011, https://www.bj.admin.ch/dam/bj/de/data/sicherheit/gesetzgebung/archiv/zssg/ber-auslandszusammenarbeit-d.pdf.download.pdf/ber-auslandszusammenarbeit-d.pdf, besucht am 1.10.2023 (zit. als BJ, Bericht Zusammenarbeit).
Bundesamt für Justiz, Vorentwurf für das Bundesgesetz über die Totalrevision des Datenschutzgesetzes und die Änderung weiterer Erlasse zum Datenschutz, Zusammenfassung der Ergebnisse des Vernehmlassungsverfahrens vom 10.8.2017, https://www.bj.admin.ch/dam/bj/de/data/staat/gesetzgebung/datenschutzstaerkung/ve-ber-d.pdf.download.pdf/ve-ber-d.pdf, besucht am 1.8.2023 (zit. als Ergebnisse Vernehmlassungsverfahren DSG).
Bundesamt für Justiz, Vorentwurf für das Bundesgesetz über die Totalrevision des Datenschutzgesetzes und die Änderung weiterer Erlasse zum Datenschutz, Stellungnahme der Organisationen A–H, https://www.bj.admin.ch/dam/bj/de/data/staat/gesetzgebung/datenschutzstaerkung/organisationen-a-h.pdf.download.pdf/organisationen-a-h.pdf, besucht am 1.8.2023 (zit. als Vernehmlassungsverfahren DSG, Stellungnahme der Organisationen A–H).
Council of Europe, Explanatory Report to the Protocol amending the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, https://rm.coe.int/cets-223-explanatory-report-to-the-protocol-amending-the-convention-fo/16808ac91a, besucht am 20.9.2023 (zit. als CoE, Explanatory Report).
Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter, 30. Tätigkeitsbericht 2022/23, https://edb.reader.epaper.guru/de-CH/viewer/616971da-d98a-4d01-9554-87a20c0277e9/fd949f38-fa10-4c60-a59a-0354346b8612, besucht am 9.10.2023 (zit. als EDÖB, 30. Tätigkeitsbericht 2022/23).
OECD, Review of the OECD Recommendation on Cross-Border Co-operation in the Enforcement of Laws Protecting Privacy, 22.9.2023, https://www.oecd-ilibrary.org/docserver/67774f69-en.pdf?expires=1696874300&id=id&accname=guest&checksum=20FD51C34B496C02E3550F9EE3868428, besucht am 9.10.2023 (zit. als OECD 2023).