Art. 1 Aim
This Act aims to protect the privacy and the fundamental rights of persons when their data is processed.
235.1
English is not an official language of the Swiss Confederation. This translation is provided for information purposes only and has no legal force.
of 19 June 1992 (Status as of 1 March 2019)
The Federal Assembly of the Swiss Confederation,
based on Articles 95, 122 and 173 paragraph 2 of the Federal Constitution1,2
and having regard to the Federal Council Dispatch dated 23 March 19883,
decrees:
2 Amended by No 3 of the FA of 19 March 2010 on the Implementation of Framework Decision 2008/977/JHA on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters, in force since 1 Dec. 2010 (AS 2010 3387 3418; BBl 2009 6749).
This Act aims to protect the privacy and the fundamental rights of persons when their data is processed.
1 This Act applies to the processing of data pertaining to natural persons and legal persons by:
2 It does not apply to:
The following definitions apply:
4 Amended by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).
5 Amended by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).
6 Repealed by No I of the FA of 24 March 2006, with effect from 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).
1 Personal data may only be processed lawfully.7
2 Its processing must be carried out in good faith and must be proportionate.
3 Personal data may only be processed for the purpose indicated at the time of collection, that is evident from the circumstances, or that is provided for by law.
4 The collection of personal data and in particular the purpose of its processing must be evident to the data subject.8
5 If the consent of the data subject is required for the processing of personal data, such consent is valid only if given voluntarily on the provision of adequate information. Additionally, consent must be given expressly in the case of processing of sensitive personal data or personality profiles.9
7 Amended by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).
8 Inserted by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).
9 Inserted by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).
1 Anyone who processes personal data must make certain that it is correct. He must take all reasonable measures to ensure that data that is incorrect or incomplete in view of the purpose of its collection is either corrected or destroyed.10
2 Any data subject may request that incorrect data be corrected.
10 Second sentence inserted by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).
1 Personal data may not be disclosed abroad if the privacy of the data subjects would be seriously endangered thereby, in particular due to the absence of legislation that guarantees adequate protection.
2 In the absence of legislation that guarantees adequate protection, personal data may be disclosed abroad only if:
3 The Federal Data Protection and Information Commissioner (the Commissioner, Art. 26) must be informed of the safeguards under paragraph 2 letter a and the data protection rules under paragraph 2 letter g. The Federal Council regulates the details of this duty to provide information.
11 Amended by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).
1 Personal data must be protected against unauthorised processing through adequate technical and organisational measures.
2 The Federal Council issues detailed provisions on the minimum standards for data security.
12 Inserted by No I of the FA of 24 March 2006 (AS 2007 4983; BBl 2003 2101). Repealed by No 3 of the FA of 19 March 2010 on the Implementation of Framework Decision 2008/977/JHA on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters, with effect from 1 Dec. 2010 (AS 2010 3387 3418; BBl 2009 6749).
1 Any person may request information from the controller of a data file as to whether data concerning them is being processed.
2 The controller of a data file must notify the data subject:13
3 The controller of a data file may arrange for data on the health of the data subject to be communicated by a doctor designated by the subject.
4 If the controller of a data file has personal data processed by a third party, the controller remains under an obligation to provide information. The third party is under an obligation to provide information if he does not disclose the identity of the controller or if the controller is not domiciled in Switzerland.
5 The information must normally be provided in writing, in the form of a printout or a photocopy, and is free of charge. The Federal Council regulates exceptions.
6 No one may waive the right to information in advance.
13 Amended by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).
14 Amended by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).
1 The controller of a data file may refuse, restrict or defer the provision of information where:
2 A federal body may further refuse, restrict or defer the provision of information where:
3 As soon as the reason for refusing, restricting or deferring the provision of information ceases to apply, the federal body must provide the information unless this is impossible or only possible with disproportionate inconvenience or expense.
4 The private controller of a data file may further refuse, restrict or defer the provision of information where his own overriding interests so require and he does not disclose the personal data to third parties.
5 The controller of a data file must indicate the reason why he has refused, restricted or deferred access to information.
15 Amended by No 3 of the FA of 19 March 2010 on the Implementation of Framework Decision 2008/977/JHA on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters, in force since 1 Dec. 2010 (AS 2010 3387 3418; BBl 2009 6749).
1 The controller of a data file that is used exclusively for publication in the edited section of a periodically published medium may refuse to provide information, limit the information or defer its provision provided:
2 Journalists may also refuse restrict or defer information if the data file is being used exclusively as a personal work aid.
1 The processing of personal data may be assigned to third parties by agreement or by law if:
2 The instructing party must in particular ensure that the third party guarantees data security.
3 Third parties may claim the same justification as the instructing party.
16 Inserted by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).
1 In order to improve data protection and data security, the manufacturers of data processing systems or programs as well as private persons or federal bodies that process personal data may submit their systems, procedures and organisation for evaluation by recognised independent certification organisations.
2 The Federal Council shall issue regulations on the recognition of certification procedures and the introduction of a data protection quality label. In doing so, it shall take account of international law and the internationally recognised technical standards.
17 Amended by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).
1 The Commissioner maintains a register of data files that is accessible online. Anyone may consult the register.
2 Federal bodies must declare all their data files to the Commissioner in order to have them registered.
3 Private persons must declare their data files if:
4 The data files must be declared before they are opened.
5 In derogation from the provisions in paragraphs 2 and 3, the controller of data files is not required to declare his files if:
6 The Federal Council regulates the modalities for the declaration of data files for registration, the maintenance and the publication of the register, the appointment and duties of the data protection officer under paragraph 5 letter e and the publication of a list of controllers of data files that are relieved of the reporting obligation under paragraph 5 letters e and f.
18 Inserted by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).
1 Anyone who processes personal data must not unlawfully breach the privacy of the data subjects in doing so.
2 In particular, he must not:
3 Normally there is no breach of privacy if the data subject has made the data generally accessible and has not expressly prohibited its processing.
19 Amended by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).
1 A breach of privacy is unlawful unless it is justified by the consent of the injured party, by an overriding private or public interest or by law.
2 An overriding interest of the person processing the data shall in particular be considered if that person:
1 The controller of the data file is obliged to inform the data subject of the collection of sensitive personal data or personality profiles; this duty to provide information also applies where the data is collected from third parties.
2 The data subject must be notified as a minimum of the following:
3 If the data is not collected from the data subject, the data subject must be informed at the latest when the data is stored or if the data is not stored, on its first disclosure to a third party.
4 The duty of the controller of the data file to provide information ceases to apply if the data subject has already been informed or, in cases under paragraph 3, if:
5 The controller of the data file may refuse, restrict or defer the provision of information subject to the requirements of Article 9 paragraphs 1 and 4.
20 Amended by No 3 of the FA of 19 March 2010 on the Implementation of Framework Decision 2008/977/JHA on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters, in force since 1 Dec. 2010 (AS 2010 3387 3418; BBl 2009 6749).
1 Actions relating to protection of privacy are governed by Articles 28, 28a and 28l of the Civil Code22. The plaintiff may in particular request that data processing be stopped, that no data be disclosed to third parties, or that the personal data be corrected or destroyed.
2 Where it is impossible to demonstrate that personal data is accurate or inaccurate, the plaintiff may request that a note to this effect be added to the data.
3 The plaintiff may request that notification of third parties or the publication of the correction, destruction, blocking, and in particular the prohibition of disclosure to third parties, the marking of the data as disputed or the court judgment.
4 Actions on the enforcement of a right to information shall be decided by the courts in a simplified procedure under the Civil Procedure Code of 19 December 200823.
21 Amended by Annex 1 No II 14 of the Civil Procedure Code of 19 Dec. 2008, in force since 1 Jan. 2011 (AS 2010 1739; BBl 2006 7221).
1 The federal body that processes or arranges for the processing of personal data in fulfilment of its tasks is responsible for data protection.
2 If federal bodies process personal data together with other federal bodies, with cantonal bodies or with private persons, the Federal Council may specifically regulate the control of and responsibility for data protection.25
24 Amended by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).
25 Amended by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).
1 Federal bodies may process personal data if there is a statutory basis for doing so.
2 They may process sensitive personal data and personality profiles only if a formal enactment expressly provides therefor or if, by way of exception:
26 Amended by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).
1 The Federal Council may, having consulted the Commissioner and before a formal enactment comes into force, approve the automated processing of sensitive personal data or personality profiles if:
2 A test phase may be mandatory for the practical implementation of data processing if:
3 The Federal Council shall regulate the modalities of automated data processing in an ordinance.
4 The competent federal body shall provide the Federal Council with an evaluation report at the latest within two years of the pilot system coming into operation. The report contains a proposal on whether the processing should be continued or terminated.
5 Automated data processing must be terminated in every case if within five years of the pilot systems coming into operation no formal enactment has come in force that contains the required legal basis.
27 Inserted by No I of the FA of 24 March 2006 (AS 2006 4873; BBl 2003 2101, 2006 3547). Amended by No I of the FA of 24 March 2006, in force since 15 Dec. 2006 (AS 2007 4983; BBl 2003 2101).
1 In the case of systematic surveys, in particular by means of questionnaires, the federal organ shall disclose the purpose of and the legal basis for the processing, and the categories of persons involved with the data file and of the data recipients.
2 …28
28 Repealed by No I of the FA of 24 March 2006, with effect from 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).
1 Federal bodies are obliged to inform the data subject of the collection of personal data; this duty to provide information also applies where the data is collected from third parties.
2 The data subject must be notified as a minimum of the following:
3 If the data is not collected from the data subject, the data subject must be informed at the latest when the data is stored or if the data is not stored, on its first disclosure to a third party.
4 The duty of the controller of the data file to provide information ceases to apply if the data subject has already been informed or, in cases under paragraph 3, if:
5 If the duty to provide information would compromise the competitiveness of a federal body, the Federal Council may limit the application of the duty to the collection of sensitive personal data and personality profiles.
29 Inserted by No 3 of the FA of 19 March 2010 on the Implementation of Framework Decision 2008/977/JHA on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters, in force since 1 Dec. 2010 (AS 2010 3387 3418; BBl 2009 6749).
1 Federal bodies may refuse, restrict or defer the provision of information subject to the requirements of Article 9 paragraphs 1 and 2.
2 As soon as the reason for refusal, restriction or deferral ceases to apply, the federal bodies are bound by the duty to provide information unless compliance is not possible or possible only with disproportionate inconvenience or expense.
30 Inserted by No 3 of the FA of 19 March 2010 on the Implementation of Framework Decision 2008/977/JHA on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters, in force since 1 Dec. 2010 (AS 2010 3387; BBl 2009 6749).
1 Federal bodies may disclose personal data if there is legal basis for doing so in accordance with Article 17 or if:31
1bis Federal bodies may also disclose personal data within the terms of the official information disclosed to the general public, either ex officio or based on the Freedom of Information Act of 17 December 200434 if:
2 Federal bodies may on request also disclose the name, first name, address and date of birth of a person if the requirements of paragraph1 are not fulfilled.
3 Federal bodies may make personal data accessible online if this is expressly provided for. Sensitive personal data and personality profiles may be made accessible online only if this is expressly provided for in a formal enactment.36
3bis Federal bodies may make personal data generally accessible by means of automated information and communication services if a legal basis is provided for the publication of such data or if they make information accessible to the general public on the basis of paragraph1bis. If there is no longer a public interest in the accessibility of such data, the data concerned must be removed from the automated information and communication service.37
4 The federal body shall refuse or restrict disclosure, or make it subject to conditions if:
31 Amended by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).
32 Amended by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).
33 Amended by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).
35 Inserted by Annex No 4 of the Freedom of Information Act of 17 Dec. 2004, in force since 1 July 2006 (AS 2006 2319; BBl 2003 1963).
36 Second sentence amended by No I of the FA of 24 March 2006, with effect from 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).
37 Inserted by Annex No 4 of the Freedom of Information Act of 17 Dec. 2004, in force since 1 July 2006 (AS 2006 2319; BBl 2003 1963).
1 A data subject that credibly demonstrates a legitimate interest may request the federal body concerned to block the disclosure of certain personal data.
2 The federal body shall refuse to block disclosure or lift the block if:
3 Any blocking of disclosure is subject to Article 19 paragraph 1bis.38
38 Inserted by Annex No 4 of the Freedom of Information Act of 17 Dec. 2004, in force since 1 July 2006 (AS 2006 2319; BBl 2003 1963).
1 In accordance with the Archiving Act of 26 June 199840, federal bodies shall offer the Federal Archives all personal data that is no longer in constant use.
2 The federal bodies shall destroy personal data designated by the Federal Archives as not being of archival value unless it:
39 Amended by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).
41 Amended by No 3 of the FA of 19 March 2010 on the Implementation of Framework Decision 2008/977/JHA on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters, in force since 1 Dec. 2010 (AS 2010 3387 3418; BBl 2009 6749).
1 Federal bodies may process personal data for purposes not related to specific persons, and in particular for research, planning and statistics, if:
2 The requirements of the following provisions need not be fulfilled:
1 If a federal body acts under private law, the provisions for the processing of personal data by private persons apply.
2 Supervision is governed by the provisions on federal bodies.
42 Repealed by Art. 31 of the FA of 21 March 1997 on Measures to Safeguard Internal Security, with effect from 1 July 1998 (AS 1998 1546; BBl 1994 II 1127).
1 Anyone with a legitimate interest may request the federal body concerned to:
2 If it is not possible to prove the accuracy or the inaccuracy of personal data, the federal body must mark the data correspondingly.
3 The applicant may in particular request that the federal body:
4 The procedure is governed by the Federal Act of 20 December 196843 on Administrative Procedure (Administrative Procedure Act). The exceptions contained in Articles 2 and 3 of the Administrative Procedure Act do not apply.
5 …44
44 Repealed by Annex No 26 of the Administrative Court Act of 17 June 2005, with effect from 1 Jan. 2007 (AS 2006 2197 1069; BBl 2001 4202).
For as long as proceedings relating to access to official documents within the meaning of the Freedom of Information Act of 17 December 200446 that contain personal data are ongoing, the data subject may within the terms of such proceedings claim the rights accorded to him on the basis of Article 25 of this Act in relation to those documents that are the subject matter of the access proceedings.
45 Inserted by Annex No 4 of the Freedom of Information Act of 17 Dec. 2004, in force since 1 July 2006 (AS 2006 2319; BBl 2003 1963).
1 The Commissioner is appointed by the Federal Council for a term of office of four years. The appointment must be approved by the Federal Assembly.
2 The employment relationship is governed by the Federal Personnel Act of 24 March 200048, unless this Act provides otherwise.
3 The Commissioner shall exercise his duties independently, without receiving directives from any authority.49 He is assigned to the Federal Chancellery for administrative purposes.
4 He has a permanent secretariat and his own budget. He appoints his own staff.
5 The Commissioner is not subject to the system of assessment under Article 4 paragraph 3 of the Federal Personnel Act of 24 March 2000.
47 Amended by No 3 of the FA of 19 March 2010 on the Implementation of Framework Decision 2008/977/JHA on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters, in force since 1 Dec. 2010 (AS 2010 3387 3418; BBl 2009 6749).
49 Amended by No II 1 of the FA of 28 Sept. 2018 on the Implementation of Directive (EU) 2016/680 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, in force since 1 March 2019 (AS 2019 625; BBl 2017 6941).
1 The Commissioner's term of office may be extended twice.51
1bis This term of office shall be extended automatically unless the Federal Council has issued an order based on materially adequate grounds that the term of office should not be extended.52
2 The Commissioner may request the Federal Council to be discharged from office at the end of any month subject to six months advance notice.
3 The Federal Council may dismiss the Commissioner from office before the expiry of his term of office if he:
50 Inserted by No 3 of the FA of 19 March 2010 on the Implementation of Framework Decision 2008/977/JHA on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters, in force since 1 Dec. 2010 (AS 2010 3387 3418; BBl 2009 6749).
51 Amended by No II 1 of the FA of 28 Sept. 2018 on the Implementation of Directive (EU) 2016/680 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, in force since 1 March 2019 (AS 2019 625; BBl 2017 6941).
52 Inserted by No II 1 of the FA of 28 Sept. 2018 on the Implementation of Directive (EU) 2016/680 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, in force since 1 March 2019 (AS 2019 625; BBl 2017 6941).
1 The Commissioner may not carry on another occupation.
2 The Federal Council may permit the Commissioner to carry on another occupation provided this does not compromise his independence and standing. The decision shall be published.
53 Inserted by No 3 of the FA of 19 March 2010 on the Implementation of Framework Decision 2008/977/JHA on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters (AS 2010 3387 3418; BBl 2009 6749). Amended by No II 1 of the FA of 28 Sept. 2018 on the Implementation of Directive (EU) 2016/680 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, in force since 1 March 2019 (AS 2019 625; BBl 2017 6941).
1 The Commissioner54 supervises compliance by federal bodies with this Act and other federal data protection regulations of the Confederation. The Federal Council is excluded from such supervision.
2 The Commissioner investigates cases either on his own initiative or at the request of a third party.
3 In investigating cases, he may request the production of files, obtain information and arrange for processed data to be shown to him. The federal bodies must assist in determining the facts of any case. The right to refuse to testify under Article 16 of the Administrative Procedure Act55 applies by analogy.
4 If the investigation reveals that data protection regulations are being breached, the Commissioner shall recommend that the federal body concerned change the method of processing or abandon the processing. He informs the department concerned or the Federal Chancellery of his recommendation.
5 If a recommendation is not complied with or is rejected, he may refer the matter to the department or to the Federal Chancellery for a decision. The decision is communicated to the data subjects in the form of a ruling.56
6 The Commissioner has a right of appeal against the ruling under paragraph 5 and against the decision of the appeal authority.57
54 Term in accordance with Annex No 4 of the Freedom of Information Act of 17 Dec. 2004, in force since 1 July 2006 (AS 2006 2319; BBl 2003 1963). This amendment is taken into account throughout this Act.
56 Second sentence amended by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).
57 Inserted by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).
The Commissioner advises private persons on data protection matters.
1 The Commissioner shall investigate cases in more detail on his own initiative or at the request of a third party if:
2 To this end, he may request files, obtain information and arrange for processed data to be shown to him. The right to refuse to testify under Article 16 of the Administrative Procedure Act60 applies by analogy.
3 On the basis of his investigations, the Commissioner may recommend that the method of processing be changed or abandoned.
4 If a recommendation made by the Commissioner is not complied with or is rejected, he may refer the matter to the Federal Administrative Court for a decision. He has the right to appeal against this decision.61
58 Amended by No I of the FA of 24 March 2006, in force since 1Jan. 2008 (AS 2007 4983; BBl 2003 2101).
59 Amended by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).
61 Amended by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).
1 The Commissioner shall submit a report to the Federal Assembly at regular intervals and as required. He shall provide the Federal Council with a copy of the report at the same time. The regular reports are published.62
2 In cases of general interest, he informs the general public of his findings and recommendations. He may only publish personal data subject to official secrecy with consent of the authority responsible. If it refuses its consent, the President of the division of the Federal Administrative Court responsible for data protection makes the final decision.63
62 Amended by No 3 of the FA of 19 March 2010 on the Implementation of Framework Decision 2008/977/JHA on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters, in force since 1 Dec. 2010 (AS 2010 3387 3418; BBl 2009 6749).
63 Amended by No Annex No 26 of the Administrative Court Act of 17 June 2005, in force since 1 Jan. 2007 (AS 2006 2197 1069; BBl 2001 4202).
1 The Commissioner has the following additional tasks in particular:64
2 He may also advise bodies of the Federal Administration even if, in accordance with Article 2 paragraph 2 letters c and d, this Act does not apply. The bodies of the Federal Administration may permit him to inspect their files.
64 Amended by Annex No 4 of the Freedom of Information Act of 17 Dec. 2004, in force since 1 July 2006 (AS 2006 2319; BBl 2003 1963).
65 Amended by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).
66 Inserted by Annex No 4 of the Freedom of Information Act of 17 Dec. 2004 (AS 2006 2319; BBl 2003 1963). Amended by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).
67 Amended by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).
68 Amended by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).
70 Inserted by No II 1 of the FA of 28 Sept. 2018 on the Implementation of Directive (EU) 2016/680 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, in force since 1 March 2019 (AS 2019 625; BBl 2017 6941).
71 Repealed by Annex No I of the FA of 30 Sept. 2011 on Research involving Human Beings, with effect from 1 Jan. 2014 (AS 2013 3215; BBl 2009 8045).
72 Amended by Annex No 26 des Administrative Court Act of 17 June 2005, in force since 1 Jan. 2007 (AS 2006 2197 1069; BBl 2001 4202).
1 Legal protection is governed by the general provisions on the administration of federal justice.
2 If the Commissioner establishes in a case investigation under Article 27 paragraph 2 or under Article 29 paragraph 1 that the data subjects are threatened with a disadvantage that cannot be easily remedied, he may apply to the President of the division of the Federal Administrative Court responsible for data protection for interim measures to be taken. The procedure is governed by analogy by Articles 79-84 of the Federal Act of 4 December 194773 on Federal Civil Procedure.
1 On complaint, private persons are liable to a fine if they:74
2 Private persons are liable to a fine76 if they wilfully:
74 Amended by Art. 333 of the Criminal Code in the version of the FA of 13 Dec. 2002, in force since 1 Jan. 2007 (AS 2006 3459; BBl 1999 1979).
75 Amended by No 3 of the FA of 19 March 2010 on the Implementation of Framework Decision 2008/977/JHA on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters, in force since 1 Dec. 2010 (AS 2010 3387 3418; BBl 2009 6749).
76 Amended by Art. 333 of the Criminal Code in the version of the FA of 13 Dec. 2002, in force since 1 Jan. 2007 (AS 2006 3459; BBl 1999 1979).
77 Amended by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).
1 Anyone who without authorisation wilfully discloses confidential, sensitive personal data or personality profiles that have come to their knowledge in the course of their professional activities where such activities require the knowledge of such data is, on complaint, liable to a fine.78
2 The same penalties apply to anyone who without authorisation wilfully discloses confidential, sensitive personal data or personality profiles that have come to their knowledge in the course of their activities for a person bound by professional confidentiality or in the course of training with such a person.
3 The unauthorised disclosure of confidential, sensitive personal data or personality profiles remains an offence after termination of such professional activities or training.
78 Amended by Art. 333 of the Criminal Code in the version of the FA of 13 Dec. 2002, in force since 1 Jan. 2007 (AS 2006 3459; BBl 1999 1979).
1 The Federal Council shall issue the implementing provisions.
2 …79
3 It may provide for derogations from Articles 8 and 9 in relation to the provision of information by Swiss diplomatic and consular representations abroad.
4 It may also specify:
5 It may conclude international treaties on data protection provided they comply with the principles of this Act.
6 It regulates how data files must be secured where the data may constitute a danger to life and limb for the data subjects in the event of war or other crisis.
79 Repealed by Art. 25 of the Archiving Act of 26 June 1998, with effect from 1 Oct. 1999 (AS 1999 2243; BBl 1997 II 941).
1 Unless there are cantonal data protection regulations that ensure an adequate level of protection, Articles 1-11a, 16, 17, 18-22 and 25 paragraphs 1-3 of this Act apply to the processing of personal data by cantonal bodies in the implementation of federal law.80
2 The cantons shall appoint a controlling body to ensure compliance with data protection requirements. Articles 27, 30 and 31 are applicable in an analogous manner.
80 Amended by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).
1 The controllers of data files must register existing data files that must be registered under Article 11 within one year of the commencement of this Act at the latest.
2 They must take the required measures within one year of the commencement of this Act to be able to provide the information required under Article 8.
3 Federal bodies may continue to use an existing data file with sensitive personal data or with personality profiles until 31 December 2000 without fulfilling the requirements of Article 17 paragraph 2.81
4 In matters relating to asylum and foreign nationals, the period mentioned in paragraph 3 is extended until the commencement of the totally revised Asylum Act of 26 June 199882 and the amendments to the Federal Act of 26 March 193183 on the Residence and Permanent Settlement of Foreign Nationals.84
81 Amended by No I of the FD of 26 June 1998, in force until 31 Dec. 2000 (AS 1998 1586; BBl 1998 1579 1583).
83 [BS 1 121; AS 1949 221, 1987 1665, 1988 332, 1990 1587 Art. 3 para. 2, 1991 362 No II 11 1034 No III, 1995 146, 1999 1111 2262 Annex No 1, 2000 1891 No IV 2, 2002 685 No I 1 701 No I 1 3988 Annex No 3, 2003 4557 Annex No II 2, 2004 1633 No I 1 4655 No I 1, 2005 5685 Annex No 2, 2006 979 Art. 2 No 1 1931 Art. 18 No 1 2197 Annex No 3 3459 Annex No 1 4745 Annex No 1, 2007 359 Annex No 1. AS 2007 5437 Annex No I]
84 Inserted by No II of the FD of 20 June 1997, in force since 1 Jan. 1998 (AS 1997 2372; BBl 1997 I 877). The Acts mentioned come into force on 1 Oct. 1999.
The appointment of the Commissioner and the termination of his employment relationship are subject to the previous law until the end of the legislative period in which this amendment comes into force.
85 Inserted by No 3 of the FA of 19 March 2010 on the Implementation of Framework Decision 2008/977/JHA on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters, in force since 1 Dec. 2010 (AS 2010 3387 3418; BBl 2009 6749).
Within a year of the commencement of this Act, the controllers of data files must take the required measures to inform data subjects in accordance with Article 4 paragraph 4 and Article 7a.
…88
88 The amendments may be consulted under AS 1993 1945..