Amendments to Switzerland’s data protection law are now fully in force from 1 January this year after a one year transition period. Marc-Frédéric Schäfer explains the implications.

In the first use of his new enforcement powers to impact the private sector, Switzerland’s Data Protection Commissioner, Hanspeter Thür, successfully requested the Federal Administrative Court to order Dun & Bradstreet to withdraw a service.

Romandie News reported on 21 January that Dun & Bradstreet had offered to Swiss employers a service which would check employees or prospective employees’ backgrounds regarding credit history and other personal information to help companies assess their suitability for employment.

The Swiss Federal Data Protection Commissioner’s application to the court for a restraining order to stop the company offering this service was on 15 December. The Federal Administrative Court responded quickly with a written decision on 14 January.

In Switzerland, the Federal Data Protection and Information Commissioner (FDPIC) has no legal power to impose sanctions. If he detects methods of data processing which are capable of breaching the privacy of individuals, he may recommend that the methods of processing are changed or abandoned. If a recommendation made by the FDPIC is not complied with or is rejected, he may refer the matter to the Federal Administrative Court for a decision.

This procedure is rather lengthy. Before the FDPIC can recommend changing or abandoning methods of processing, he has to investigate the data processing in detail. The whole proce-dure until the Federal Administrative Court delivers a judgment normally takes up to one year. Therefore, the Swiss legislature gave the FDPIC the possibility to seek interim measures, if he establishes in an investigation that data subjects are threatened with a disadvantage that cannot be easily remedied.

Creative commercial credit agencies

In Switzerland, information for business about the creditworthiness of individuals is profitable. However, there is fierce competition between approximately 16 commercial credit agencies, as the market size is about  15 million Swiss Francs. Therefore commercial credit agencies are always looking for new business opportunities to sell their data to new customers.

Last year, two products appeared on the market, which attracted the attention of the FDPIC. One was a job applicant, and the other offered a service checking the financial affairs of people who wanted to rent a house or flat.

The D&B case

The Federal Administrative Court had to judge a case against a commercial agency, Dun & Bradstreet, which was selling personal data about the creditworthiness of individuals to human resources managers (HR managers). The agency advertised a new online service called “staff-check”. With this service, HR managers could check if potential candidates applying for a job are creditworthy. The information provided contained, for example, the payment behaviour, current and former residence, add information about the neighbourhood. Based on the sales letter, the FDPIC estimated that the service would breach Swiss data protection law.

In particular, the FDPIC did not recognise an overriding private or public interest which would have justified the data processing (according to art. 13 of the Federal Act on Data Protection). He argued that a daily growing number of data subjects may suffer immediate disadvantages which can not easily be made good again.

Furthermore the provision of agency reports to HR managers was estimated to be disproportionate as in most cases the data processing is neither appropriate nor useful to assess whether a candidate is qualified for a job. As a result, the FDPIC came to the conclusion that the data processing of the credit agency breaches Swiss privacy law.

Therefore, he applied for interim measures against Dun & Bradstreet and asked for the immediate suspension of the “staff-check” service. After the FDPIC informed Dun & Bradstreet that it was taking the matter to the federal Administrative Court, the company immediately stopped the dissemination of their service. Already four customers had subscribed to the service.

The decision

The Federal Administrative Court adopted civil law procedures even though the case was strictly a public law case. As a result, the court took a decision on whether to order interim stop powers to the FDPIC based on the immediate (prima facie) evidence provided by the Data Protection Commissioner’s files. The Federal Administrative Court confirmed that the necessary requirements for the FDPIC to initiate an investigation were fulfilled and that it was probable that the Commissioner would find a violation and would issue a recommendation that Dun & Bradstreet should stop this service.

Furthermore it came to the conclusion that the data processing is capable of infringing the personal rights of data subjects. It estimated that the concerned individuals could not anticipate that their personal data would be processed in this way and that the data processing is neither adequate nor necessary. Therefore it considered that the data processing was disproportionate and not carried out in good faith. Not only was the usage of the data by the HR managers judged illegal but also the disclosure of personal data to third parties.

It also seemed evident to the Federal Administrative Court that data subjects may suffer immediate disadvantages which can not easily be made good again. In comparison to the potential loss of the credit agency due to a delayed launch of the service, the disadvantages of the data subjects seem to be more serious. As a result, the court came to the conclusion that the immediate action is proportionate and thus accepted the motion of the FDPIC. The Federal Administrative court prohibited the disclosure of personal data to third parties under the service known as “staff-check”.

Immediate action process

For the first time the Federal Administrative Court had to deal with the question if and how far immediate actions can be taken to protect privacy.

Before issuing a recommendation, the FDPIC has to investigate a case in detail. This is rather time-consuming and requires the cooperation of the data processor. The Federal Administrative Court correctly noticed that the recommendation as an instrument is not always sufficient to provide precautionary protection for the concerned data subjects. Therefore, it affirms that interim measures can be used by the FDPIC to avoid imminent breaches of data protection law.

As a welcome side-effect, after having attained interim measures, the FDPIC has a stronger position for further investigations as the defendant data processor has a vital interest to co-operate.

On this note, the judgment of the Federal Administrative Court may point the way to the future work of the FDPIC. If interim measures can stop such an isolated case, it will be possible to stop methods of processing capable of breaching the privacy of larger numbers of people more effectively.

Overall the decision of the Federal Administrative Court has strengthened the position of the FDPIC and thus opened a door to better data protection in Switzerland.

The European Privacy Officers Network has a Briefing on Swiss data protection law with leading lawyers on 28 April followed by a Roundtable with the Federal DP Commissioner and his senior advisers on 29 April, both in Zurich. www.privacylaws.com/epon_24.

The author is Dr. oec. Marc-Frédéric Schäfer, lic. iur. HSG., lawyer at the FDPIC.
The Federal Administrative Court’s Judgment (A-8028/2008) is available from PL&B.