Switzerland: No Obligation For Facebook Switzerland To Disclose User Data In Criminal Proceedings

In a decision rendered on November 16, 2016, the Swiss Federal Supreme Court ruled that Facebook Switzerland cannot be obliged by state prosecutors of the Canton of Vaud to transfer data on a Facebook-account supposedly set up in Switzerland. The highest court in Switzerland held that Facebook Switzerland is not the owner of the requested data as it has no control over the data. The state prosecutors were told that the they should have lodged a request for international legal assistance targeting at the end of the day Facebook Ireland

In 2015, the state prosecutors' of the Canton of Vaud initiated a criminal proceeding for defamation following a criminal complaint filed by a Belgian journalist. The journalist claimed that a person using a pseudonym had published antisemitic remarks on a Facebook-account opened up in Switzerland. The state prosecutors thereupon ordered Facebook Switzerland and its two managing directors to disclose the identity, the access data as well as the IP-address of the concerned account holder. Facebook Switzerland and its two managing directors lodged complaints with the Cantonal Court of Vaud, claiming that they did not manage the Facebook website themselves. In other words, they alleged that the discloure order had to be addressed towards Facebook Ireland, as the required information was under control of Facebook Ireland. Whilst the Cantonal Court of Vaud rejected this complaint in 2016, Facebook Switzerland and the two managing directors called upon the Swiss Federal Supreme Court

The hightest court in Switzerland now protected the claimants' view saying that both the Swiss Code of Criminal Procedure of 2011 and the International Convention on Cybercrime 2001 provide that only the holder and/or owner of the data or a person exercising a de facto and/or legal control over the data can be addressee of a criminal discloure order. The Swiss Supreme Court further held that none of the documents filed with the cantonal court allowed the conclusion that Facebook Switzerland is the owner of the required data or has a direct access to the user data.

According to the Swiss Supreme Court, it is rather Facebook Ireland to be addressed as a contracting party to the Facebook-users outside the US and Canada which controls the corresponding personal data, whilst the business purpose of Facebook Switzerland is limited to support marketing, the sale of advertising space as well as to public relations and communication, so in order achieve requested data transfer, the state prosecutors of the Canton of Vaud were told to demand the data from Facebook Ireland via means of international legal assistance.

[Rough translation of today's media release by Swiss Supreme Court]

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.