-
- Art. 5a FC
- Art. 6 FC
- Art. 10 FC
- Art. 16 FC
- Art. 17 FC
- Art. 20 FC
- Art. 22 FC
- Art. 29a FC
- Art. 30 FC
- Art. 32 FC
- Art. 42 FC
- Art. 43 FC
- Art. 43a FC
- Art. 55 FC
- Art. 56 FC
- Art. 60 FC
- Art. 68 FC
- Art. 75b FC
- Art. 77 FC
- Art. 96 para. 2 lit. a FC
- Art. 110 FC
- Art. 117a FC
- Art. 118 FC
- Art. 123b FC
- Art. 136 FC
- Art. 166 FC
-
- Art. 11 CO
- Art. 12 CO
- Art. 50 CO
- Art. 51 CO
- Art. 84 CO
- Art. 143 CO
- Art. 144 CO
- Art. 145 CO
- Art. 146 CO
- Art. 147 CO
- Art. 148 CO
- Art. 149 CO
- Art. 150 CO
- Art. 701 CO
- Art. 715 CO
- Art. 715a CO
- Art. 734f CO
- Art. 785 CO
- Art. 786 CO
- Art. 787 CO
- Art. 788 CO
- Transitional provisions to the revision of the Stock Corporation Act of June 19, 2020
- Art. 808c CO
-
- Art. 2 PRA
- Art. 3 PRA
- Art. 4 PRA
- Art. 6 PRA
- Art. 10 PRA
- Art. 10a PRA
- Art. 11 PRA
- Art. 12 PRA
- Art. 13 PRA
- Art. 14 PRA
- Art. 15 PRA
- Art. 16 PRA
- Art. 17 PRA
- Art. 19 PRA
- Art. 20 PRA
- Art. 21 PRA
- Art. 22 PRA
- Art. 23 PRA
- Art. 24 PRA
- Art. 25 PRA
- Art. 26 PRA
- Art. 27 PRA
- Art. 29 PRA
- Art. 30 PRA
- Art. 31 PRA
- Art. 32 PRA
- Art. 32a PRA
- Art. 33 PRA
- Art. 34 PRA
- Art. 35 PRA
- Art. 36 PRA
- Art. 37 PRA
- Art. 38 PRA
- Art. 39 PRA
- Art. 40 PRA
- Art. 41 PRA
- Art. 42 PRA
- Art. 43 PRA
- Art. 44 PRA
- Art. 45 PRA
- Art. 46 PRA
- Art. 47 PRA
- Art. 48 PRA
- Art. 49 PRA
- Art. 50 PRA
- Art. 51 PRA
- Art. 52 PRA
- Art. 53 PRA
- Art. 54 PRA
- Art. 55 PRA
- Art. 56 PRA
- Art. 57 PRA
- Art. 58 PRA
- Art. 59a PRA
- Art. 59b PRA
- Art. 59c PRA
- Art. 62 PRA
- Art. 63 PRA
- Art. 67 PRA
- Art. 67a PRA
- Art. 67b PRA
- Art. 75 PRA
- Art. 75a PRA
- Art. 76 PRA
- Art. 76a PRA
- Art. 90 PRA
-
- Vorb. zu Art. 1 FADP
- Art. 1 FADP
- Art. 2 FADP
- Art. 3 FADP
- Art. 5 lit. f und g FADP
- Art. 6 Abs. 6 and 7 FADP
- Art. 7 FADP
- Art. 10 FADP
- Art. 11 FADP
- Art. 12 FADP
- Art. 14 FADP
- Art. 15 FADP
- Art. 19 FADP
- Art. 20 FADP
- Art. 22 FADP
- Art. 23 FADP
- Art. 25 FADP
- Art. 26 FADP
- Art. 27 FADP
- Art. 31 para. 2 lit. e FADP
- Art. 33 FADP
- Art. 34 FADP
- Art. 35 FADP
- Art. 38 FADP
- Art. 39 FADP
- Art. 40 FADP
- Art. 41 FADP
- Art. 42 FADP
- Art. 43 FADP
- Art. 44 FADP
- Art. 44a FADP
- Art. 45 FADP
- Art. 46 FADP
- Art. 47 FADP
- Art. 47a FADP
- Art. 48 FADP
- Art. 49 FADP
- Art. 50 FADP
- Art. 51 FADP
- Art. 54 FADP
- Art. 57 FADP
- Art. 58 FADP
- Art. 60 FADP
- Art. 61 FADP
- Art. 62 FADP
- Art. 63 FADP
- Art. 64 FADP
- Art. 65 FADP
- Art. 66 FADP
- Art. 67 FADP
- Art. 69 FADP
- Art. 72 FADP
- Art. 72a FADP
-
- Art. 2 CCC (Convention on Cybercrime)
- Art. 3 CCC (Convention on Cybercrime)
- Art. 4 CCC (Convention on Cybercrime)
- Art. 5 CCC (Convention on Cybercrime)
- Art. 6 CCC (Convention on Cybercrime)
- Art. 7 CCC (Convention on Cybercrime)
- Art. 8 CCC (Convention on Cybercrime)
- Art. 9 CCC (Convention on Cybercrime)
- Art. 11 CCC (Convention on Cybercrime)
- Art. 12 CCC (Convention on Cybercrime)
- Art. 25 CCC (Convention on Cybercrime)
- Art. 29 CCC (Convention on Cybercrime)
- Art. 32 CCC (Convention on Cybercrime)
- Art. 33 CCC (Convention on Cybercrime)
- Art. 34 CCC (Convention on Cybercrime)
FEDERAL CONSTITUTION
CODE OF OBLIGATIONS
FEDERAL LAW ON PRIVATE INTERNATIONAL LAW
LUGANO CONVENTION
CODE OF CRIMINAL PROCEDURE
CIVIL PROCEDURE CODE
FEDERAL ACT ON POLITICAL RIGHTS
CIVIL CODE
FEDERAL ACT ON CARTELS AND OTHER RESTRAINTS OF COMPETITION
FEDERAL ACT ON INTERNATIONAL MUTUAL ASSISTANCE IN CRIMINAL MATTERS
DEBT ENFORCEMENT AND BANKRUPTCY ACT
FEDERAL ACT ON DATA PROTECTION
SWISS CRIMINAL CODE
CYBERCRIME CONVENTION
In a nutshell
By referring to two isolated provisions of the Federal Law on Administrative Criminal Law (VStrR), the business owner liability is introduced in the FADP. Art. 64 makes it possible, in the case of an infringement in a business establishment, under certain circumstances to pass on a fine actually to be imposed on the responsible natural person to the business establishment, if this fine amounts to a maximum of 50,000 Swiss francs.
I. General
1 Because it is the responsibility of the cantons to prosecute and judge criminal acts within the meaning of Chapter 8 (Art. 65 para. 1), the Federal Act of 22 March 1974 on Administrative Criminal Law (VStrR) is in principle not applicable (Art. 1 VStrR e contrario). However, Art. 64 para. 1 now expressly refers to Art. 6 and 7 of the Criminal Procedure Code with regard to offences in business establishments.
2 With the reference to Art. 6 of the Criminal Procedure Code (determination of the person responsible for an infringement in a business establishment) and Art. 7 of the Criminal Procedure Code (subsidiary responsibility of the business establishment), the liability of the principal is introduced in the FADP. This is intended to enable "an appropriate allocation of criminal responsibility in companies", i.e. to its management level (management persons with decision-making and directive powers).
3 The maximum amount of the fine pursuant to para. 2 (which modifies the provision of Art. 7 FADP), up to which the business enterprise (instead of the natural person) may be ordered to pay the fine, was still set at 100,000 Swiss francs in Art. 53 VE-FADP. Controversial statements in the consultation process led to the maximum fine ultimately being set at 50,000 francs. The substantially higher maximum fine compared to Art. 7 FADP can be explained by the fact that the range of fines for violations of the FADP (fines of up to 250,000 Swiss francs) far exceeds the amount provided for in Art. 7 FADP (5,000 Swiss francs), and the maximum fine had to be increased so that in practice there would still be room for application of the provision of Art. 64 para. 2.
II. Offenses in business establishments
A. Applicability of Art. 6 and 7 CCC (para. 1)
4 Art. 64 para. 1 refers to Art. 6 and 7 of the Criminal Code for "offences in business establishments", and thus to two isolated articles within the Criminal Code. The assessment of the fine, for example, is therefore not based on Art. 8 CCC, but on Art. 106 para. 3 SCC. Since, according to Art. 1 of the Criminal Code, the Criminal Code does not apply to criminal violations of the FADP, this explicit reference is necessary if a kind of "principal's liability" is to be introduced into the FADP (see also above, n. 1 ff.).
5 Any entrepreneurial activity in which capital and labor are actively used to participate in economic life is considered a "business operation". It is therefore a matter of criminal acts committed in the course of economic activities in a company. Art. 6 para. 1 of the Criminal Code does not cover acts that are committed merely on the occasion of carrying out business activities.
6 Art. 6 para. 1 ICC establishes the so-called perpetrator principle: the perpetrator is the one who has committed the act. For example, an employee who uses a tool of an online service provider without being asked and authorized to do so by a superior for the performance of his or her duties, in the course of which personal data is processed, but the employee has not taken care to conclude a legally sufficient data processing contract (criminal liability under Art. 61 para. 1 lit. b). Another example would be the unauthorized disclosure of secret personal data by an employee to a third party in the exercise of her profession (criminal liability under Art. 62).
7 The prerequisite for the principal's liability (principal's liability within the meaning of Art. 6 para. 2 VStrR) is, from an objective point of view, the existence of a guarantor's duty, whereby this cannot be derived from Art. 6 para. 2 VStrR, but follows "from the responsibility for the business as a source of danger and/or from the responsibility for the conduct of subordinates". One might think here, for example, of a compliance officer who is contractually responsible for ensuring compliance with the requirements of data protection law in the company or of the personnel officer who is contractually responsible for the processing of personnel data. Delegation of responsibility is permitted by law, whereby the delegating person remains responsible for the selection, instruction and supervision of the person concerned. Another prerequisite is the existence of authority on the part of the principal: In order for the principal's liability to apply, it must have been possible for the principal to prevent the act or to nullify its effects. From a subjective point of view, Art. 6 para. 2 VStrR requires intent or negligence. In the case of offences which (like the criminal provisions of Chapter 8 of the FADP) are structured as intentional offences, however, it is disputed whether it is sufficient for the applicability of the principal's liability and thus for the principal's criminal liability that the latter merely negligently failed to prevent the infringement or to nullify its effects. According to the opinion expressed here, it is required for the applicability of the principal's liability that the principal has violated the guarantor's obligation at least possibly intentionally. If the directly acting perpetrator (who committed the infringement) acted merely negligently, the principal's liability is excluded from the outset in the case of such incidental acts.
8 If the principal, employer, client or person represented is a legal entity, a general or limited partnership, a sole proprietorship or a group of persons without legal personality, Art. 6 para. 2 Criminal Code applies "to the guilty organs, members of organs, managing partners, persons actually in charge or liquidators" (Art. 6 para. 3 Criminal Code; cf. also Art. 29 SCC).
B. Sentencing of the business to a fine (para. 2)
1. General
9 Art. 64 para. 2 is based on the provision of Art. 7 para. 1 VStrR, but adapts the scope of application to the maximum fine provided for in the FADP and speaks more generically of the "business establishment" instead of the "legal person", "collective or limited partnership" and the "sole proprietorship" (cf. also above, n. 3 and n. 5).
10 Pursuant to Art. 64 para. 2, a fine may be imposed on a business establishment (instead of the criminal natural persons) in the event of a criminal offence in the business establishment (committed by one or more natural persons; see below, n. 11 f.) if
a fine of no more than 50,000 Swiss francs is eligible (see below, n. 13 f.) and (cumulatively)
the investigation of the persons liable to prosecution under Art. 6 CCC would require investigative measures that would be disproportionate to the penalty imposed (see below, n. 15 f.).
2. Offence in the course of business
11 In order to impose a fine on a business operation, it is first of all necessary that there is an "infringement in the course of business". All objective and subjective elements of the offense for which the business operation is to be fined must be fulfilled, and there must be no grounds for justification or exclusion of guilt. For the concept of "business operation" see above, n. 5.
12 In practice, however, the subjective elements of the offense will not be provable, since the offending natural persons are precisely not identifiable. In order to overcome this hurdle and not exclude the application of Art. 64 from the outset, culpability must be "objectified" or the requirements for proving the subjective elements of the offense must be relaxed, for example by the criminal authority being content with the finding "that the intention clearly results from the act committed." In any case, however, there is no room for the application of Art. 64 if it is established that the subjective elements of the offense are not fulfilled in the case of the persons alleged to have committed the offense within the business operations.
3. Fine of a maximum of 50,000 francs
13 According to Art. 7 para. 1 ICC, the upper limit of the amount of the fine up to which it is possible to order a company instead of a natural person to pay a fine is 5,000 francs. This upper limit corresponds to half of the maximum fine of 10,000 francs provided for in Art. 106 para. 1 SCC. In deviation from Art. 106 para. 1 SCC, the maximum amount of the fine in the scope of application of the FADP (pursuant to Arts. 60-63) is 250,000 francs. In view of this substantially higher maximum amount, an increase also in the upper limit of the fine amount up to which a conviction of a business operation is possible was imperative. According to Art. 64 para. 2, this upper limit is 50,000 francs, which corresponds to 1/5 of the maximum fine amount of 250,000 francs.
14 According to Art. 106 para. 3 SCC, in determining the amount of the fine, the court shall take into account the circumstances of the offender "so that he suffers the penalty appropriate to his fault." Because the perpetrator of the offense precisely cannot be located, the fine is to be assessed on the basis of objective fault. The circumstances of the specific violation, such as the lack of a company-internal division into individual areas of responsibility, are decisive.
4. Investigative measures to identify the offending persons would be disproportionate
15 The circumstances of the individual case are also relevant when examining whether investigative measures to identify the offending persons would be disproportionate with regard to the forfeited penalty. Because Art. 64 para. 2 is an "optional provision", the criminal authorities have a relatively considerable discretion in determining whether this provision should be applied (and thus also in answering the question of whether investigative measures to identify the offending persons would be disproportionate). There is no entitlement to the application of Art. 64 para. 2, nor can the criminal authority simply choose between action against the offending natural persons and against the business operation. Before the competent criminal authority can consider punishing the business operation on the basis of Art. 64, it must conduct "a minimum of investigative measures" to identify the offending natural persons; it is not acceptable for the criminal authority to rely on Art. 64 out of sheer convenience. When (further) investigative measures would be disproportionate must also be assessed with a view to the amount of the (potentially) forfeited fine, for which the investigations must in any case have gone so far that the amount can at least be roughly estimated.
16 In the case of FADP violations subject to penalties, it will often be clearly determined from an organizational point of view or at least relatively easy to determine in the specific case who performed the actions in question (e.g., response to a request for information or release of the privacy statement). In this respect, the practical relevance of the provision of Art. 64 is likely to be rather low; convictions of business entities to pay a fine are likely to remain the exception.
5. Passing on the Fine
17 If the above-mentioned conditions are met, the competent criminal authority may pass on the fine to the business enterprise. In determining the amount of the fine, the culpability and the financial circumstances of the natural person(s) who actually committed the offence are decisive, and not those of the business operation.
18 If only certain natural persons responsible for the infringement can be identified, but not others, it is debatable whether it is possible to pass on the fine applicable to the persons not identified. It is correct to require that passing on is also possible in this constellation.
Bibliography
Beretta Allison, Sanctionner en vertu des art. 6 et 7 DPA, in: Jusletter vom 8.7.2019, 64, https://jusletter.weblaw.ch/juslissues/2019/986/sanctionner-en-vertu_20314b3ff6.html, besucht am 8.8.2023.
Macaluso Alain/Garbarski Andrew M., Kommentierung zu Art. 7 VStrR, in: Frank Friedrich/Eicker Andreas/Markwalder Nora/Achermann, Jonas (Hrsg.), Basler Kommentar, Verwaltungsstrafrecht, Basel 2020.
Rosenthal David/Gubler Seraina, Die Strafbestimmungen des neuen DSG, SZW 1/2021, S. 52 ff.; Schwob Renate, Kommentierung zu Art. 6 VStrR, in: Frank Friedrich/Eicker Andreas/Markwalder Nora/Achermann, Jonas (Hrsg.), Basler Kommentar, Verwaltungsstrafrecht, Basel 2020.
Wohlers Wolfgang, Kommentierung zu Art. 64 DSG, in: Baeriswyl Bruno/Pärli Kurt/Blonski, Dominika (Hrsg.), Stämpflis Handkommentar, Datenschutzgesetz, 2. Aufl., Bern 2023.
Materialis
Botschaft zum Bundesgesetz über die Totalrevision des Bundesgesetzes über den Datenschutz und die Änderung weiterer Erlasse zum Datenschutz vom 15.9.2017, BBl 2017 S. 6941 ff. (zit. Botschaft 2017), abrufbar unter https://www.admin.ch/opc/de/federal-gazette/2017/6941.pdf, besucht am 8.8.2023.
Erläuternder Bericht des Bundesamts für Justiz BJ zum Vorentwurf für das Bundesgesetz über die Totalrevision des Datenschutzgesetzes und die Änderung weiterer Erlasse zum Datenschutz vom 21.12.2016, abrufbar unter https://www.bj.admin.ch/dam/bj/de/data/staat/gesetzgebung/datenschutzstaerkung/vn-ber-d.pdf.download.pdf/vn-ber-d.pdf (zit. Erläuternder Bericht VE-DSG), besucht am 8.8.2023.
Zusammenfassung des Bundesamts für Justiz BJ der Ergebnisse des Vernehmlassungsverfahrens vom 10.8.2017 betreffend Vorentwurf für das Bundesgesetz über die Totalrevision des Datenschutzgesetzes und die Änderung weiterer Erlasse zum Datenschutz vom 21.12.2016 (zit. Zusammenfassung Vernehmlassung VE-DSG), abrufbar unter https://www.bj.admin.ch/dam/bj/de/data/staat/gesetzgebung/datenschutzstaerkung/ve-ber-d.pdf.download.pdf/ve-ber-d.pdf, besucht am 8.8.2023.