Showing 171 controls
19.1
The controller shall inform the data subject in an appropriate manner when collecting personal data; this duty to provide information also applies if the data is not collected from the data subject.
19.2
It shall provide the data subject on collecting the data with the information required for the data subject to exercise their rights under this Act and to guarantee transparent data processing; it sha...
19.2.a
the controller's identity and contact details;
19.2.b
the purpose of processing;
19.2.c
if applicable, the recipients or the categories of recipients to which personal data is disclosed.
19.3
If the data is not collected from the data subject, the controller shall also inform the data subject of the categories of processed personal data.
19.4
If the personal data are disclosed abroad, the controller shall also inform the data subject of the State or the international body to which such data are disclosed and if applicable of the guarantees...
19.5
If the data is not collected from the data subject, the controller shall also inform the data subject of the information specified in paragraphs 2–4 at the latest one month after receiving the data. I...
20.1
The duty to provide information under Article 19 ceases to apply if one of the following requirements is satisfied:
20.1.a
The data subject already has the information concerned.
20.1.b
The processing is required by law.
20.1.c
The controller is a private person who is required by law to preserve confidentiality.
20.1.d
The requirements of Article 27 are satisfied.
20.2
If the personal data is not collected from the data subject, the duty to provide information also ceases to apply if any one of the following requirements is satisfied:
20.2.a
It is not possible to provide the information.
20.2.b
Providing the information requires disproportionate effort.
20.3
The controller may restrict, delay or dispense with the provision of the information in the following cases:
20.3.a
It is required to do so because of overriding third party interests.
20.3.b
Providing the information defeats the purpose of the processing.
20.3.c
The controller is a private person and the following requirements are satisfied:
20.3.c.1
The controller is required to do so because of its own overriding interests.
20.3.c.2
The controller does not intend to disclose the personal data to third parties.
20.3.d
The controller is a federal body and any one of the following requirements is satisfied:
20.3.d.1
The measure is required to satisfy overriding public interests, in particular to protect Switzerland's internal or external security.
20.3.d.2
The communication of the information may compromise an enquiry, an investigation or administrative or judicial proceedings.
21.1
The controller shall inform the data subject about any decision that is based exclusively on automated processing and that has a legal consequence for or a considerable adverse effect on the data subj...
21.2
It shall on request allow the data subject to express their point of view. The data subject may request that the automated individual decision be reviewed by a natural person.
21.3
Paragraphs 1 and 2 do not apply if:
21.3.a
the automated individual decision is directly connected with the conclusion or the processing of a contract between the controller and the data subject and the data subject's request is granted; or
21.3.b
the data subject has explicitly consented to the decision being automated.
21.4
If the automated individual decision is issued by a federal body, it must designate the decision accordingly. Paragraph 2 does not apply if, in accordance with Article 30 paragraph 2 of the Administra...
22.1
If processing is likely to result in a high risk to the data subject's personality or fundamental rights, the controller shall carry out a data protection impact assessment beforehand. If several simi...
22.2
The existence of a high risk, in particular when using new technologies, depends on the nature, extent, circumstances and purpose of the processing. A high risk arises in particular:
22.2.a
in the case of the large-scale processing of sensitive personal data;
22.2.b
if public areas are systematically monitored on a large scale.
22.3
The data protection impact assessment shall include a description of the planned processing, an evaluation of the risks to the data subject's personality or fundamental rights and a description of the...
22.4
Private controllers are exempt from having to carry out a data protection impact assessment if they are required by law to process the data.
22.5
A private controller may dispense with carrying out a data protection impact assessment if it uses a system, product or service that is certified under Article 13 for the intended use, or if it compli...
22.5.a
The code of conduct is based on a data protection impact assessment.
22.5.b
It provides for measures to protect the personality and the data subject's fundamental rights.
22.5.c
It has been submitted to the FDPIC.
23.1
If the data protection impact assessment indicates that the planned processing despite the measures planned by the controller will still pose a high risk to the personality or the data subject's funda...
23.2
The FDPIC shall inform the controller within two months of any objections to the planned processing. This deadline may be extended by one month if the data processing is complex.
23.3
If the FDPIC objects to the planned processing, he or she shall propose suitable measures to the controller.
23.4
A private controller may dispense with consulting the FDPIC if it has consulted the data protection officer under Article 10.
24.1
The controller shall notify the FDPIC of any breach of data security that is likely to lead to a high risk to the data subject's personality or fundamental rights as quickly as possible.
24.2
In the notification, it shall as a minimum specify the nature of the breach of data security, its consequences and the measures taken or planned.
24.3
The processor shall notify the controller of any breach of data security as quickly as possible.
24.4
The controller shall inform the data subject if this is required for their protection or if the FDPIC so requests.
24.5
It may limit, delay or dispense with the provision of information to the data subject if:
24.5.a
there is a reason for doing so pursuant to Article 26 paragraph 1 letter b or paragraph 2 letter b or the provision of information is prohibited by a statutory duty of confidentiality;
24.5.b
the provision of information is impossible or requires disproportionate effort; or
24.5.c
the provision of information to the data subject is equally guaranteed by making a public announcement.
24.6
A notification made pursuant to this Article may only be used against the person required to notify in criminal proceedings with that person's consent.
10.1
Private controllers may appoint a data protection officer.
10.2
The data protection officer is the contact point for the data subjects and for the authorities responsible for data protection in Switzerland. He or she has the following tasks in particular:
10.2.a
training and advising the private controller in matters of data protection;
10.2.b
providing support on applying the data protection regulations.
10.3
Private controllers may invoke the exception in Article 23 paragraph 4 if the following requirements are satisfied:
10.3.a
The data protection officer exercises his or her function towards the controller in a professionally independent manner and is not bound by any instructions.
10.3.b
He or she does not carry out any activities that are incompatible with his or her tasks as a data protection officer.
10.3.c
He or she has the required expertise.
10.3.d
The controller publishes the contact details of the data protection officer and notifies the FDPIC thereof.
12.1
The controller and the processor shall each maintain a record of their processing activities.
12.2
The controller's record shall as a minimum contain:
12.2.a
the identity of the controller;
12.2.b
the purpose of processing;
12.2.c
a description of the categories of data subjects and the categories of processed personal data;
12.2.d
the categories of recipients;
12.2.e
if possible, the retention period for the personal data or the criteria for determining this period;
12.2.f
if possible, a general description of the measures taken to guarantee data security under Article 8;
12.2.g
if the data are disclosed abroad, details of the State concerned and the guarantees under Article 16 paragraph 2.
12.3
The processor's record shall contain information on identity of the processor and of the controller, the categories of processing carried out on behalf of the controller, and the information mentioned...
12.4
The federal bodies shall notify the FDPIC of their records of processing activities.
12.5
The Federal Council shall provide exceptions for legal entities that have fewer than 250 employees and whose data processing poses a negligible risk of harm to the personality of the data subjects.
14.1
Private controllers with registered office or domicile abroad shall appoint a representative in Switzerland if they process the personal data of persons in Switzerland and the data processing meets th...
14.1.a
The processing is connected with the offer of goods or services or the monitoring of the behaviour of persons in Switzerland.
14.1.b
The processing is on a large scale.
14.1.c
The processing is carried out regularly.
14.1.d
The processing poses a high risk to the personality of the data subjects.
14.2
The representative shall serve as the contact point for the data subjects and the FDPIC.
14.3
The controller shall publish the name and the address of the representative.
15.1
The representative shall maintain a record of controller's processing activities that contains the information set out in Article 12 paragraph 2.
15.2
On request, he or she shall provide the FDPIC with the information contained in the record.
15.3
On request, the representative shall provide data subjects with information on how they can exercise their rights.
16.1
Personal data may be disclosed abroad if the Federal Council has decided that the legislation of the State concerned or the international body guarantees an adequate level of protection.
16.2
In the absence of a decision by the Federal Council under paragraph 1, personal data may be disclosed abroad only if an adequate level of data protection is guaranteed by:
16.2.a
a treaty under international law;
16.2.b
data protection clauses in an agreement between the controller or the processor and its contractual partner, notice of which has been given to the FDPIC beforehand;
16.2.c
specific guarantees drawn up by the competent federal body, notice of which has been given to the FDPIC beforehand;
16.2.d
standard data protection clauses that the FDPIC has approved, issued or recognised beforehand; or
16.2.e
binding corporate rules that have been approved in advance by the FDPIC or by the authority responsible for data protection in a State that guarantees an adequate level of protection.
17.1.a
The data subject has explicitly consented to disclosure.
17.1.b.1
between the controller and the data subject; or
17.1.b.2
between the controller and its contractual partner in the interests the data subject.
17.1.c.1
safeguard an overriding public interest; or
17.1.c.2
establish, exercise or enforce legal rights before a court or another competent foreign authority.
17.1.d
Disclosure is necessary to protect the life or the physical integrity of the data subject or a third party, and it is not possible to obtain the consent of the data subject within a reasonable time.
17.1.e
The data subject has made the data generally accessible and has not explicitly prohibited processing.
17.1.f
The data originate from a statutory register that is public or accessible to persons with a legitimate interest, provided the statutory requirements for access are met in the case concerned.
17.2
The controller or the processor shall inform the FDPIC on request about the disclosure of personal data under paragraph 1 letters b number 2, c and d.
6.1
Personal data must be processed lawfully.
6.2
The processing must be carried out in good faith and be proportionate.
6.3
Personal data may only be collected for a specific purpose that the data subject can recognise; personal data may only be further processed in a manner that is compatible with this purpose.
6.4
They shall be destroyed or anonymised as soon as they are no longer required for the purpose of processing.
6.5
Any person who processes personal data must satisfy themselves that the data are accurate. They must take all appropriate measures to correct, delete or destroy data that are incorrect or incomplete i...
6.6
If the consent of the data subject is required, such consent is only valid if given voluntarily for one or more specific instances of processing based on appropriate information.
6.7.a
processing sensitive personal data;
6.7.b
high-risk profiling by a private person; or
6.7.c
profiling by a federal body.
7.1
The controller is obliged to arrange the data processing in technical and organisational terms so that the data protection regulations, and in particular the principles under Article 6, are respected....
7.2
The technical and organisational measures must in particular be appropriate with regard to the state of the art, the nature and the extent of the data processing and the risk that the processing poses...
7.3
The controller is obliged to ensure by means of suitable default settings that the processing of personal data is limited to the minimum required for the purpose intended, unless the data subject spec...
8.1
The controller and the processor shall guarantee a level of data security appropriate to the risk by taking suitable technical and organisational measures.
8.2
The measures must make it possible to avoid breaches of data security.
9.1
The processing of personal data may be assigned by contract or by the legislation to a processor if:
9.1.a
the data is processed only in the manner in which the controller itself is permitted to do it; and
9.1.b
no statutory or contractual duty of confidentiality prohibits assignment.
9.2
The controller must satisfy itself in particular that the processor is able to guarantee data security.
9.3
The processor may only assign processing to a third party with prior approval from the controller.
9.4
It may claim the same grounds for justification as the controller.
3.1
This Act applies to circumstances that have an effect in Switzerland, even if they were initiated abroad.
25.2
The data subject shall receive the information required to be able to exercise their rights under this Act and to guarantee transparent data processing. In every case, they are entitled to the followi...
25.2.a
the identity and the contact details of the controller;
25.2.b
the processed personal data as such;
25.2.c
the purpose of processing;
25.2.d
the retention period for the personal data or, if this is not possible, the criteria for determining this period;
25.2.e
the available information about the source of the personal data, if it has not been collected from the data subject;
25.2.f
if applicable, whether an automated individual decision has been taken and the logic behind the decision;
25.2.g
if applicable, the recipients or the categories of recipients to which personal data is disclosed, as well as the information specified in Article 19 paragraph 4.
25.4
If the controller arranges for personal data to be processed by a processor, it remains under a duty to provide information.
25.6
The controller must provide information free of charge. The Federal Council may provide for exceptions, in particular if the effort required is disproportionate.
25.7
The information shall in general be provided within 30 days.
26.1.a
a formal law so provides, in particular in order to preserve professional secrecy;
26.1.b
this is required to safeguard overriding third-party interests; or
26.1.c
the request for information is obviously unjustified, in particular if does not serve the purpose of data protection or is clearly frivolous.
26.2.a.1
The controller's own overriding interests require the measure.
26.2.a.2
The controller does not intend to disclose the personal data to third parties.
26.2.b.1
The measure is required to satisfy overriding public interests, in particular Switzerland's internal or external security.
26.2.b.2
The communication of the information may compromise an enquiry, an investigation or administrative or judicial proceedings.
26.4
The controller must indicate why it is refusing, restricting or delaying the provision of the information.
28.1.a
the controller is carrying out the automated processing of the data; and
28.1.b
the data are being processed with the consent of the data subject or in direct connection with the conclusion or the performance of a contract between the controller and the data subject.
28.2
The data subject may also request the controller to transfer their personal data to another controller if the requirements in paragraph 1 are met and no disproportionate effort is required.
28.3
The controller must deliver or transfer the personal data free of charge. The Federal Council may provide for exceptions, in particular if the effort is disproportionate.
29.2
The controller must give reasons why it has decided to refuse, restrict or delay the delivery or transfer.
30.1
Any person who processes personal data must not unlawfully breach the data subjects' personality rights.
31.1
A breach of personality rights is unlawful unless it is justified by the consent of the data subject, by an overriding private or public interest, or by the law.
31.2
The controller may have an overriding interest in the following cases in particular:
31.2.a
The controller processes personal data relating to a contracting party in direct connection with the conclusion or the performance of a contract.
31.2.b
The controller is or intends to be in commercial competition with another person and for this purpose processes personal data that are not disclosed to third parties; legal entities that belong to the...
31.2.c
The controller processes personal data to verify the creditworthiness of the data subject, provided the following requirements are satisfied:
31.2.c.1
The matter involves neither sensitive personal data nor high-risk profiling.
31.2.c.2
The data are only disclosed to third parties if the third parties require the data for the conclusion or the performance of a contract with the data subject.
31.2.c.3
The data are no more than ten years old.
31.2.c.4
The data subject has attained the age of majority.
31.2.d
The controller processes the personal data professionally and exclusively for publication in the editorial section of a periodically published medium or the controller uses the data, if they are not p...
31.2.e
The controller processes the personal data for purposes not related to specific persons, in particular for research, planning or statistics, provided the following requirements are satisfied:
31.2.e.1
The controller anonymises the data as soon as the purpose of processing permits; if anonymity is impossible or if it requires disproportionate effort, the controller shall take appropriate measures to...
31.2.e.2
If the matter involves sensitive personal data, the controller shall disclose such data to third parties in such a manner that the data subject is not identifiable; if this is not possible, it must be...
31.2.e.3
The results are published in such a manner that data subjects are not identifiable.
31.2.f
The controller collects personal data relating to a public figure that relate to that person's public activities.
32.1
The data subject may request that incorrect personal data be corrected unless:
32.1.a
a statutory provision prohibits the correction;
32.1.b
the personal data are processed for archiving purposes that are in the public interest.
32.2
Actions to protect the personality are governed by the Articles 28, 28a and 28g–28l of the Civil Code. The applicant may in particular request that:
32.2.a
a specific data processing activity be prohibited;
32.2.b
a specific disclosure of personal data to third parties be prohibited;
32.2.c
personal data be deleted or destroyed.
32.3
If neither the accuracy nor the inaccuracy of the relevant personal data can be established, the applicant may request that the data be marked as being disputed.
32.4
The applicant may also request that any correction, deletion or destruction, prohibition of processing or disclosure to third parties, marking as disputed or judgment be communicated to third parties...