Disclosure Of Internal Investigation Reports: Key Considerations Under The FADP

In decision 4A_504/2025 of 16 June 2026, the Swiss Federal Supreme Court ("SFSC") clarified the extent to which individuals may obtain access to personal data contained in internal investigation reports. The Court confirmed that Article 25 of the Federal Act on Data Protection ("FADP") grants access only to the requester's personal data, not to the report as such. Where the requested personal information also concerns third parties, a balancing of interests under Article 26 FADP is required, with particular weight given, in the case at hand, to assurances of anonymity and confidentiality. The decision further confirmed that redaction is insufficient where the third parties concerned remain identifiable from the context.

1 INTRODUCTION

Internal investigation reports frequently contain personal data within the meaning of the FADP, which also applies in employment relationships (Article 328b Swiss Code of Obligations). Under Article 25 FADP, individuals may request information as to whether their personal data is being processed and have a right to obtain the information necessary to exercise their rights under the FADP. Under Article 26 FADP, the data controller may, inter alia, refuse, restrict or defer disclosure where overriding third-party interests so require. In decision 4A_504/2025, the SFSC clarified the extent to which personal data contained in internal investigation reports must be disclosed and the circumstances in which access may be restricted under the FADP.

2 BACKGROUND

The case arose because a long-serving professor at an academic institution (the "Institution") requested access to an internal investigation report (the "Report") concerning the working environment within his department. The professor had applied for an extension of his employment. The Institution informed him that it would not decide on the extension until the investigation had been completed. As part of the investigation, the professor and other faculty and staff members were interviewed under assurances of anonymity and confidentiality.

After submission of the Report by the investigator, the Institution did not renew the professor's contract. The professor subsequently requested access to the Report, arguing that it contained personal data relating to him, including assessments of his conduct and role within the department. The Institution refused to disclose the Report, maintaining that the investigation had not been conducted against the professor directly and that disclosure would prejudice the confidentiality interests of other participants. After the cantonal courts ordered only partial disclosure, the dispute ultimately reached the SFSC.

The Report consisted of six parts: Part I: Investigator's Mandate; Parts II and III: Confidentiality Assurances and Chronology of the Investigation; Parts IV and V: Interview Statements and Detailed Analysis; and Part VI: Summary and Conclusions.

3 KEY FACTS

3.1 No Access Through Procedural File Inspection Rights

The professor first sought access to the entire Report through procedural file inspection rights (Articles 29 Federal Constitution, 53 and 156 Civil Procedure Code). He argued that these rights entitled him to inspect the Report, which he considered the key piece of evidence in the proceedings. The SFSC rejected this argument and clarified that procedural file inspection rights cannot be relied upon to obtain access to an internal investigation report where the scope of disclosure under the FADP is itself the subject of the proceedings.

3.2 Access Under the FADP: Scope and Limits

The professor further argued that the Institution violated Article 25 FADP and sought access to the entire Report.

The SFSC first held that Article 25 FADP does not give the professor a right to access the Report as a whole. It only covers the professor's personal data, i.e., information relating to him as an identified or identifiable individual. The professor was therefore entitled to information regarding the purpose of the investigation (Part I of the Report), but not to details of the investigation process itself, such as the timing and number of interviews (Parts II and III), which did not qualify as his personal data. Regarding Parts II and III, the Court further noted that, having participated in the investigation himself and being aware of the confidentiality assurances given to interviewees, the professor already possessed sufficient information to understand the context in which data relating to him had been collected and processed.

The Court further held that Article 25 et seqq. FADP does not extend to third-party data. To the extent that Parts IV and V of the Report (interview statements and the investigator's analysis) contained personal data of the professor but also of the other interviewees, the SFSC had to carry out a balancing of interests under Article 26 FADP. It held that the interviewees' interest in preserving the anonymity and confidentiality assured to them outweighed the professor's personal interest to assess the opinions expressed about him on their potential impact on the non-renewal of his contract. The Court further found that simply redacting the name of the interviewees would not have provided adequate protection, as the professor, given his long-standing role in a relatively small department, could likely have identified the individuals through contextual clues.

With respect to the summary and conclusion of the Report in Part VI, the SFSC confirmed that generic references to "professors" or "certain professors" were insufficient to identify the specific professor (appellant) and therefore did not constitute his personal data. However, he was entitled to access the investigator's conclusions to the extent they were based on data relating to him.

4 KEY TAKEAWAYS

• Internal investigation reports are not automatically, as a whole, subject to disclosure under the FADP; Article 25 FADP extends only to the individuals' personal data.
• Where information relates to both the requester and third parties, a balancing of interests under Article 26 FADP is required.
• Assurances of anonymity and confidentiality given to interviewees can tip the balance and justify restricting access.
• Redaction is not an adequate safeguard where individuals remain identifiable from the context.
• No back door through court proceedings: procedural file inspection rights do not give access to the investigation report where FADP access is at issue.