Page 1

Federal Data Protection and Transparency Officer
PFPDT

Rights of the data subject
in terms of processing
personal data

May 2014

Feldeggweg 1, 3003 Bern
Phone. 058 463 74 84, Fax 058 465 99 96
www.edoeb.admin.ch

Page 2

Table of contents:
Rights of the data subject with regard to the processing of personal data ............... 1
Table of contents: .............................................. .................................................. ............................... 2
1.
1.1
1.2

Purpose of data protection ............................................ ........................................... 3
Some concepts to know .............................................. .................................................. . 3
Scope of data protection law ...................................... ........... 4

2.
2.1
2.2

Lawfulness of the processing of personal data ............................................ .................... 6
Data processing by private persons ........................................... .................... 6
Data processing by federal bodies ........................................... ...................... 6

3.
3.1
3.1.1
3.1.2
3.1.3
3.1.4
3.1.5
3.2
3.2.1
3.2.2
3.3

Rights of the data subject ............................................. ........................................... 7
Permission to access .............................................. .................................................. ........................... 7
What information can you request? .................................................. ................. 7
How to get them? .................................................. .................................................. ......... 7
How much does the right of access cost? .................................................. ........................................... 8
In which cases can one not claim a right of access? .............................................. 8
What to do in case of total or partial rejection of your request? ................................................. 8
File register ............................................... .................................................. ............... 9
Files subject to the duty of declaration in the public sector ........................................ .... 9
Files subject to the duty of declaration in the private sector ........................................ ... 10
Right to rectify, block or delete data concerning you ............................. 11

4.

From the law to accountability in the field of data protection ... 12

2/12

Page 3

1. Purpose of data protection
Our society lives in the information age. The State and economic circles have considerably increased
their information needs relating to citizens and consumers. Technologies
modern information systems are constantly opening up new possibilities for the collection and processing of
data.
This development is undoubtedly positive. However, it also generates risks for the parparticular. Citizens are faced with a situation in which they can no longer
control how their data is collected by the State or economic circles, how they
are used or communicated. They thus lose part of their autonomy.
We must regulate the processing of personal data, in order to be able to control this development. He
On the one hand, it is necessary to set up independent bodies which regularly monitor the processing
of data carried out by authorities or private individuals. On the other hand, the people concerned
have the opportunity to review that their data is being used correctly.
The Federal Act on Data Protection (DPA) is in force since 1 st July 1993. The LPD
applies to all the processing of personal data carried out by the federal administration
or by private persons. Data processing by cantonal or municipal authorities
is governed by cantonal law.
Data protection law does not protect data, but personality and fundamental rights.
of natural persons (human beings) and legal entities (e.g. companies) such as the right to
privacy or the right to individual self-determination in matters of information. The nationality of the
data subject has no impact on data protection.
The aim of data protection is not to prevent the free flow of information. She wants thiswhile ensuring that this flow ends where privacy begins. It thus allows a world of
information that is correct. It tends to protect individuals vis-à-vis the company, the consumer
vis-à-vis the company or the worker vis-à-vis the employer.
This brochure should help make all data subjects aware of their rights in relation to
of data protection and to allow it to exercise them. This implies that she knows who is dealing with
data about them, what data are processed and for what purposes they are used.

1.1 Some concepts to know
• Personal data:
All information that relates to an identified or identifiable person.
• Person concerned:
The natural or legal person (natural person, companies, association) about whom
data is processed.

3/12

Page 4

• Sensitive data:
Personal data on religious, philosophical, political or trade union opinions or activities
wedges, health, the private sphere or belonging to a race, social assistance measures, proscriminal or administrative consequences or sanctions.
• Personality profile:
An assemblage of data which makes it possible to appreciate the essential characteristics of the personality
of a natural person.
• Treatment:
Any transaction relating to personal data - regardless of the means and procedures used
- in particular the collection, conservation, use, modification, communication, archiving or
destruction of data.
• Communication:
Making personal data accessible, for example by authorizing their consultation, by
transmitting or disseminating them.
• File:
Any set of personal data whose structure allows the data to be searched by persounds concerned.
• Federal body:
The federal authority or service as well as the person in charge of a task of the Confederation (eg sickness funds).
• File master:
The private person or federal body that decides on the purpose and content of the file.

1.2 Scope of data protection law
The LPD applies to all federal bodies and to all private persons (in particular
companies).
Who are the authorities and persons thus targeted?
Are federal bodies:
• federal authorities or services (federal departments and offices as well as their divisions and
respective sections).

4/12

Page 5

• other federal institutions governed by public law (e.g. corporations, establishments and foundations,
who process personal data in the performance of public tasks for the
account of the Confederation, in particular the federal polytechnics, the SUVA or the Institut
Federal Intellectual Property).
• natural or legal persons governed by private law, insofar as they are entrusted with
public tasks, such as sickness funds.
Are private persons:
• first and foremost natural and legal persons governed by private law (citizens, companies
sales, etc.)
• persons governed by public law (federal bodies), when they act in the private sphere (eg the
Position in its relations with its customers).

5/12

Page 6

2. Lawfulness of the processing of personal data
Any collection of personal data can only be undertaken in a lawful manner.
Personal data should only be processed for the purpose of:
• indicated when they are collected, or
• provided for by law, or
• which emerges from the circumstances.

2.1 Data processing by private persons
Unlawful interference with the personality of the person concerned must not be made.
No one has the right to process data against the express will of the data subject,
unless a justifying reason provided for in the data protection law allows it (article 13 LPD)

2.2 Data processing by federal bodies
Federal bodies are only entitled to process personal data if there is a basis there.
scabies.

6/12

Page 7

3. Rights of the data subject
3.1 Right of access
Everyone, regardless of their age, domicile or nationality, has the right to
request access to the data stored on his account (article 8 LPD).

3.1.1 What information can you request?
You can be informed about:
• all the data concerning you contained in the file, including their origin,
• the purpose of the processing (i.e. the corresponding administrative task or the specific purpose) and whether
the legal basis for the processing,
• the categories of data processed,
• the participants in the file and
• the persons and bodies to which data is communicated (recipients of the data).

3.1.2 How to get them?
Contact the file master. You can identify the latter through the Account Register.
les (see chapter 3.2).
Make your request in writing. As a general rule, a copy of an identity document attached to your demande is enough to legitimize you. Sending by registered post is not necessary, but recommended for
evidentiary reasons.
As a rule, information is not provided over the telephone, as most of the time it is not possible to
not identify you with certainty.
The request for access and the communication of the requested information can be made by
electronic insofar as the data controller expressly provides for it and takes appropriate measures
adequate to ensure the identification of the data subject and to protect the data of the
ring affected by any access by unauthorized third parties during the communication of information
(art. 1, al. 2, OLPD).
It will often not be possible for you to obtain immediate satisfaction if you show up in
person with the master of the file. On the other hand, you will be able, in agreement with him, to consult your data.
born on the spot.
Write as precisely as possible about what you want to get information about (eg.
"Information concerning grants", "data relating to my loan agreement", or "relating to
7/12

Page 8

my lease contract ”, or even“ relating to my employment contract ”, but not“ everything that
the federal administration has about me ”).
The information or the reasoned decision restricting or refusing the right of access (Articles 9 and 10
LPD) must be provided to you within 30 days of receipt of the request (Article 1 OLPD).

3.1.3 How much does the right of access cost?
In principle, you do not have to pay anything, the right of access being free. However, participation in
fees may exceptionally be requested when:
• You have already obtained the requested information within the last twelve months. But if you
can justify a legitimate interest, for example the unannounced modification of the data you
concerning during this period, no financial participation can then be required of you;
• the communication of information involves a considerable volume of work, eg. if the
data has already been made partially anonymous or requires extensive research (for
manual files).
The cost contribution amounts to a maximum of 300 francs!

3.1.4 In which cases can one not claim a right of access?
As a general rule, the communication of the requested information can be refused, restricted or
deferred if:
• a law in the formal sense provides for it;
• the preponderant interests of a third party so require.
In addition to the aforementioned cases, federal bodies may also refuse, restrict or postpone
communication of the requested information if:
• an overriding public interest, in particular the internal or external security of the Confederation
requires it;
• the communication of information risks compromising a criminal investigation or other
investigation procedure.
Private persons can ultimately refuse, restrict or delay the communication of information.
requests if their own overriding interests so require and they do not communicate
data to third parties.

3.1.5 What to do in case of total or partial rejection of your request?
In principle, you have the right to full access, i.e. relating to all data concerning you
contained in the file.

8/12

Page 9

To the extent that you receive incomplete information, the body responsible for providing the information
gnements must expressly inform you of this, so that you can have the
well-founded.
This body is required to indicate on which legal provision or on what facts it is based, in order to refuse,
restrict or delay the communication of the requested information.
If you have any doubts about the outcome of your access request, you can proceed
as following:
• with regard to the masters of private files you can open a legal action in execution of the right
access to your home or that of the file master. The judge will rule according to a simple procedure
and fast;
• In the event that an office refuses to give you the requested information or gives it to you
incompletely without justifying reasons within the meaning of article 9 LPD, you can demand a decision
formal agreement within the meaning of article 5 of the Federal Law of 20 December 1968 on the administrative procedure.
trative (PA; RS 172.021) in conjunction with article 25 LPD. Against this decision, you have the pospossibility of appealing to the Federal Administrative Court.
Attach to your action or appeal a copy of the correspondence you have had with the supervisor
file.
It goes without saying that you can always appeal to the Federal Data Protection Officer and to the
transparency who will be happy to advise you.

3.2 File register
You can consult the file register at any time.
The register of files contains information on federal bodies and private persons who
process personal data. It is an instrument intended to ensure the publicity of the files. This is
so to speak "the key" to exercising the right of access. The register also gives you other elements
information concerning the processing of your data. He also serves as an auxiliary to the Federal Agent for
data protection and transparency in the performance of its advisory and
control.
The register tells you who processes data on your account and to what extent. You can
this will determine which files you want to request access to. The register finally mentions,
for each file published, the body to which you should send your request.
Federal bodies must declare all files in which they process personal data.
to the Federal Data Protection and Transparency Officer. On the other hand, the private sector
a limited obligation to declare their files.

3.2.1 Files subject to the duty of declaration in the public sector
The register contains the following information for each file:
• the name and address of the master of the file;
9/12

Page 10

• the name and full name of the file;
• the person or body to which the right of access can be exercised;
• the legal basis and purpose of the file;
• the categories of data processed (this section indicates the types of data containing
naked in the file, eg. name, address, profession, date of birth);
• the circle of people concerned and their approximate number;
• the categories of data recipients;
• the categories of participants in the file.
You will not find in the question answer log to know if there is any data you need.
identifying are processed, and if so, what data is processed. However, this register allows you to
before determining the files in which you are most likely to find information
about you.

3.2.2 Files subject to the duty of declaration in the private sector
Private persons must declare their files:
• if sensitive data or
• personality profiles are processed regularly, or
• if personal data is communicated regularly to third parties.
• The register contains the following information for each file:
• the name and address of the master of the file;
• the name and full name of the file;
• the person to whom the right of access can be exercised;
• the purpose of the file;
• the categories of data processed (this section contains the types of data containing
naked in the file, eg. name, address, profession and date of birth);
• the categories of data recipients;
• the categories of participants in the file, that is to say the third parties who are entitled to introduce data.
born in the file or to make changes to it.
You will not find in the question answer log to know if there is any data you need.
identifying are processed, and if so, what data is processed. However, this register allows you to

10/12

Page 11

before determining the files in which you are most likely to find information
about you.
This exception in favor of the media is justified, given that most of the data stored in their
files have already been published, and that the persons concerned have been informed of their existence either
before their broadcast, or during this one.

3.3 Right to rectify, block or delete data concerning you
Any body that processes personal data is required to spontaneously rectify the data
inaccurate. But it is also the responsibility of the person concerned to notify the controller of a file that the
data that he processes on his account are inaccurate or out of date.
Exception: data deposited in the Federal Archives cannot be corrected. Only can their
be added the mention of their contentious or inaccurate character.
How to obtain the realization of the rights of rectification, blocking or erasure? (article 15, resp.
25 LPD)
• Public sector:
The execution of claims against federal bodies is governed by the Federal Procedure Act
administrative. This implies that you can appeal within thirty days against the decision of an orFederal government before the Federal Administrative Court.
• Private sector:
You can assert your legal claims against private individuals in ordinary civil courts.
naires. Actions and provisional measures relating to the protection of personality are governed by
Articles 28 to 28l of the Civil Code.
Some additional indications:
• Data blocking: you can eg. have your address blocked by Swissdi-rectories
so that it does not disseminate it for advertising purposes or cause your address to appear on the "Robinson list"
of the Swiss Mail Order Association.
• Data deletion: you can eg. require it following a postulation, when one no longer has
need your file.

11/12

Page 12

4. From law to accountability in the field
data protection

The incorrect processing of personal data can have negative and detrimental effects on the persounds concerned, and in different ways. The data protection law therefore provides
safeguards, in order to prevent the collection and processing of information from being detrimental to
the development of the personality.
However, the extent to which the avenue opened by this law will be used depends largely on
of your reactions. Indeed, the data protection law leaves to a large extent to the perthe care of asserting their rights is concerned. This law is first and foremost YOUR law, and it gives you
the means to defend your interests.
You can demand the respect of the rights that the law has arranged for you when processing data
personal information about you. Your data is at stake! It is therefore to you that the legislator is addressing
first of all. It is through your willingness to exercise your rights to information and control that the
willingness of data processors to apply data protection law.
A well-understood awareness of data protection will lead to the self-checking of personnel.
sounds that process your data. For example, you can ask them if the communication of certain
certain information is necessary, or if required by law. Carefully read the "clauses
of consent to data processing ”and only sign them when you are convinced that
the confidentiality of your private and family life is guaranteed.

12/12

