Part 12 of our series on data protection law in Switzerland
In this part of our series, we explore the transparency requirements under the Federal Act on Data Protection (FADP) and the minimum content of a privacy notice.
The duty to provide information when collecting personal data is regulated in Art. 19 - 21 FADP.
Minimum content of a privacy notice
Under Art. 19 FADP, controllers are required to provide data subjects with clear and adequate information to help them exercise their rights and to ensure transparency in data processing. At a minimum, the privacy notice must include the following:
- The identity and contact details of the controller;
- The purpose of the data processing;
- Where applicable, the recipients or categories of recipients of the personal data;
- If the data is not collected directly from the data subject, the categories of personal data being processed;
- If personal data is transferred abroad—even to a country with adequate protection—the name of the country or international body and the applicable safeguards or legal exceptions.
In addition, Art. 21 FADP requires that data subjects be informed if they are subject to an automated individual decision. In such cases, they must be given the opportunity to express their views on the decision and to request that it be reviewed by a human being.
Formal requirements
When personal data is collected, the information provided to the data subject must be precise, transparent, easy to understand, and easily accessible.
- If the data is collected directly from the data subject, this information must be provided at the time of collection.
- If the data is collected indirectly, the controller must inform the data subjects within one month of receiving the data, or at the time of disclosure if the data is shared with a third party before the deadline.
Exceptions
Art. 20 FADP outlines specific exceptions to the duty to provide information when collecting personal data. These include situations where:
- The data subject already has the information;
- The processing is required by law;
- There is an overriding public or private interest.
If the personal data is not collected directly from the data subject, the information obligation also does not apply if it would be impossible to provide the information or if doing so would involve a disproportionate effort.
According to a statement on the FDPIC's website1, these exceptions must be narrowly interpreted.
With respect to automated individual decisions, the duty to provide information does not apply if:
- The decision is directly connected to the conclusion or processing of a contract between the controller and the data subject and the data subject's request is granted (e.g. a contract is concluded on the desired terms), or
- The data subject has given explicit consent to the automated decision-making.
Preview of Part 13
In part 13 of our series, we will examine the requirements under the FADP with respect to data security.
Footnote
1 https://www.edoeb.admin.ch/en/duty-to-provide-information
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
