With the new E-Government Act (EGovG), the Canton of Lucerne aims to structurally advance the digital transformation of public administration. During its May 2026 session, the Cantonal Parliament clearly endorsed the Government Council’s counterproposal to the popular initiative “Digitalisation Now!”, while simultaneously emphasising that digitalisation must not result in a “digital only” administration. Public authorities must remain accessible through analogue channels. This political consensus is both correct and necessary.

The proposed legislative framework — in particular the new E-Government Act (EGovG) — is intended to form the foundation of a modern, digitally interconnected administration. At the same time, the debate demonstrates that the real legal and strategic challenges are only beginning. The key question is no longer whether public administration should be digitalised, but how. Concepts such as “digital first” and “once only” raise significant concerns relating to data protection and fundamental rights which must be addressed more precisely during the legislative process.

Digitalisation Is Not an End in Itself

The Lucerne proposal pursues understandable objectives: more efficient administrative procedures, standardised core services, digital workflows and the reduction of repeated data entry. In particular, the so-called “once-only principle” initially appears both citizen-friendly and economically sensible.

From a legal perspective, however, this principle is highly sensitive. If citizens and businesses are expected to provide data only once, this inevitably means that different administrative units will gain access to data already collected elsewhere. This gives rise to the central constitutional question: which authority may access which data, for what purpose, and on the basis of which statutory provision?

At present, the proposal remains too vague in this respect. Swiss public law continues to be governed by the principle of purpose limitation: personal data may only be processed for the purpose for which it was originally collected or where a sufficiently clear legal basis exists. Any serious approach to digital government therefore requires an equally serious assessment of which authorities genuinely require access to which categories of data. Transparency towards affected individuals is essential. Citizens must be able to understand which public bodies access their data and for what reason.

Generalised interconnection of administrative data without a clearly identified operational need creates the risk that data will be used beyond its original purpose. Such an approach would be difficult to reconcile with the constitutional right to informational self-determination under Article 13 paragraph 2 of the Swiss Federal Constitution. Under Swiss data protection law, it is not sufficient that data is merely technically accessible. What matters is whether its use is proportionate, transparent and sufficiently defined by law.

Digital Sovereignty: Switzerland Must Not Repeat the Cloud Mistake

The debate surrounding the EGovG also raises a strategic issue extending far beyond Lucerne: digital sovereignty.

For many years, Switzerland underestimated the implications of dependencies in the cloud sector. Today, both public institutions and private organisations face the reality that critical digital infrastructures increasingly depend on a small number of international technology providers. This dependency cannot easily be reversed.

From the perspective of the Cantonal Government, there appears to be little immediate regulatory need in this area. Yet developments surrounding artificial intelligence suggest that history may repeat itself. Because technological progress is complex and dynamic, there is a real risk that regulatory and strategic decisions will once again be taken too late. This makes it all the more important to establish technologically neutral and sustainable principles at an early stage.

Depending on the criticality of the systems involved, such principles may include:

• clear interoperability requirements,
• avoidance of unnecessary vendor lock-ins,
• transparent governance structures,
• and consideration of a “second source” principle in order to reduce critical dependence on individual IT service providers.

Digital sovereignty does not mean technological isolationism. Rather, it means retaining effective control over data, systems and strategic decision-making capabilities. Genuine digital sovereignty requires more than organisational coordination alone.

Digital Administration (“Digital First”) — A Paradigm Shift

The EGovG follows a clear approach: public services are to be delivered primarily through digital channels (“digital first”), based on a centralised e-government infrastructure. User accounts, authentication systems and standardised interfaces are intended to facilitate seamless interaction between administrative entities. The Government’s commitment not to pursue a “digital only” approach demonstrates a welcome degree of proportionality.

Nevertheless, the constitutional right to privacy and protection of personal data under Article 13 paragraph 2 of the Federal Constitution requires state data processing activities to be clearly defined, proportionate and purpose-specific. In this regard, the Lucerne proposal remains partially too broad. In particular, concerns arise as to whether the planned interconnection of administrative data is sufficiently limited by law. Combined with pilot projects developed without an explicit statutory basis, this risks undermining public trust. Without clearly defined purposes, there is a danger of gradual expansion of state data use, with corresponding implications for informational self-determination.

There is also a structural transparency problem: the greater the flow of data between authorities, the more difficult it becomes for affected individuals to understand who processes which information and at what time. This places one of the central pillars of data protection law under pressure: the individual’s ability to retain control over their personal data.

Criticism by the Data Protection Authority: Correctly Focused

The Cantonal Data Protection Commissioner has identified several key weaknesses:
unclear purpose limitations, insufficient legal specificity, lack of transparency and inadequately defined security requirements.

From a constitutional and rule-of-law perspective, this criticism is entirely justified. It reflects core principles of Swiss data protection law: legality, purpose limitation, proportionality and data security. In a system designed around extensive data interconnection, these principles must not merely be referenced politically; they must be precisely codified and technically implemented.

Digitalisation Requires Democratic Debate — Not Merely Technical Implementation

It is encouraging that the political debate within the Lucerne Cantonal Parliament has recognised the risks of purely technocratic digitalisation. Several parliamentarians stressed that digitalisation must not lead to the exclusion of analogue access channels. This principle is fundamental: digitalisation must serve people — not the other way around.

The EGovG therefore provides an important basis for discussion. Not because it already contains all the answers, but because it opens the necessary debate: where does digitalisation create genuine added value? Where does it create new risks? And what constitutional safeguards are required for a modern digital administration?

Particularly in data-driven administrative processes, efficiency alone is insufficient. What matters is that digitalisation is implemented transparently, proportionately and in compliance with fundamental rights. Only then can long-term trust be established among both citizens and businesses.

Where the Legislature Must Tighten the Framework

The Cantonal Parliament now faces an important strategic choice. If digitalisation of public administration is to succeed in a sustainable and legally compliant manner, the following issues require particular attention:

• clear statutory limits on data use instead of broad general clauses,
• binding rules governing the once-only principle combined with transparency obligations,
• traceable data flows and effective control rights for citizens,
• concrete safeguards for digital sovereignty, particularly in relation to cloud services and IT outsourcing,
• mandatory privacy and security standards, including Privacy by Design.

Conclusion: Efficiency Requires the Rule of Law

The Lucerne proposal represents an important step towards a modern digital administration. Politically, it is more realistic and balanced than a rigid constitutional “digital first” obligation. At the same time, it demonstrates how closely digitalisation, data protection and fundamental rights are interconnected.

Efficiency gains must not come at the expense of informational self-determination. Sustainable digital transformation can only succeed if it rests on a clear legal foundation — transparent, controllable and technologically sovereign. It must not result in core questions of data protection and digital sovereignty remaining unresolved.

The upcoming legislative debates provide an opportunity to transform a pure digitalisation project into a constitutionally robust model of modern governance. This requires clear limits on data use, transparent data flows and strategic safeguards against new technological dependencies. Digitalisation should not occur merely because it is technically possible, but because it is proportionate, meaningful and democratically legitimate.

Data protection law protects individuals – but not every individual who invokes data protection law. The ECJ has made it clear: anyone, that does not use the right of access to monitor their own data, but instead deliberately uses it as a lever to pursue claims for damages, forfeits that protection. 

CJEU JUDGMENT (Brillen Rottler) C-526/24 OF 19 MARCH 2026 

Facts of the case 

In March 2023, TC subscribed to the newsletter of a German optician (Brillen Rottler). Just 13 days later, he submitted a request for access under Article 15 of the GDPR. The company refused to provide the information, citing publicly available information purportedly demonstrating a systematic approach on the part of TC: signing up for services -> request for information -> claim for damages. TC brought an action seeking payment of at least EUR 1,000 in compensation. 

Key Holdings 

• Even a first request for information may be deemed “excessive”: Article 12(5) GDPR permits refusal not only in the case of repeated requests, but also in respect of a single initial request, provided that an abusive intent can be established. What matters is not the frequency of requests, but the intent of the applicant.  

• Burden of proof lies with the controller: If the company wishes to reject a request for information on the grounds that it is abusive, it bears the full burden of proof – and this is a two-stage process. First, it must objectively demonstrate that, despite being formally correct, the request does not serve the actual purpose of the right to information, namely the monitoring and verification of its own data processing. It must then subjectively prove that the applicant intended from the outset to artificially create the conditions for a claim for damages. 

• Public sources as evidence: The company may use publicly available information (e.g. media reports, blog posts about known ‘data protection trolls’) to support its case, provided such information is corroborated by further evidence.   

• Compensation even without unlawful data processing: Article 82(1) of the GDPR grants a right to compensation not only in the event of unlawful data processing, but also in the event of a mere breach of the right of access under Article 15 of the GDPR. The infringement of procedural rights in itself gives rise to liability. 

• Non-material damage – not automatic: The loss of control over data or uncertainty regarding its processing may constitute non-material damage. However, compensation is not payable if the causal link is broken by the data subject’s own conduct – in particular, if they have deliberately provoked the breachin order to generate a claim.   

SCOPE OF THE RIGHT OF ACCESS (Art. 15 GDPR) – WHAT IS COVERED, WHAT IS NOT? 

Covered by the right of access (Art. 15 GDPR) 

• The right to know whether personal data is being processed at all.   

• Where data is being processed: information regarding the data itself, the purposes of processing, categories of data, recipients, retention period, the origin of the data, and any automated decision-making. 

• The right to exercise access free of charge and, as a rule, within one month. 

• Compensation for non-material damage resulting from the infringement of the right of access (including loss of control and uncertainty regarding processing) 

Not covered by the right of access or not worthy of protection 

• Requests for information that do not serve the purpose of monitoring one’s own data processing, but are made abusively to obtain compensation. 

• Compensation where the data subject has caused the damage (e.g. loss of control) through their own abusive conduct – the causal link is broken.   

• Compensation without proof of actual damage incurred – no automatic entitlement arising from the mere infringement. 

CONSEQUENCES FOR SWITZERLAND AND ITS JUDICIAL PRACTICE 

Relevance for Switzerland 

Although the GDPR does not apply directly in Switzerland, the revised Data Protection Act (FADP, in force since 1 September 2023) is closely aligned with European requirements. Swiss courts regularly refer to the GDPR and ECJ case law as an aid to interpretation for the EU-compatible application of the FADP.   

Strengthening of the prohibition of abuse of rights (Art. 2 of the Swiss Civil Code) 

The judgment confirms and reinforces the application of Art. 2(2) of the Swiss Civil Code (“The manifest abuse of a right shall not be protected by law”) in data protection law. Swiss courts are likely to adopt the logic of the ECJ: it is not the number of requests, but the improper intention that is decisive.  

Art. 26(1)(c) FADP permits the refusal of access in the case of ‘manifestly vexatious’ requests or those with a purpose contrary to data protection. The ECJ judgment provides valuable criteria for the practical application of this provision. 

Key difference: Higher threshold for compensation (Art. 32(3) FADP) 

Whilst the ECJ recognises the loss of control as a potentially compensable non-pecuniary loss, Art. 32(3) FADP requires a serious infringement of personal rights for a claim for compensation. The mere refusal to provide information or the associated uncertainty is unlikely to meet this threshold in Switzerland in most cases. 

This represents a significantly higher hurdle for ‘data protection trolls’ in Switzerland than under EU law and is likely to render the business model of systematic requests for information for the purpose of obtaining damages largely unattractive in Switzerland. 

Consistency regarding the causal link   

The ECJ’s comments on the interruption of the causal link by the conduct of the person concerned are fully consistent with the principles of Swiss tort law (contributory negligence). Anyone who deliberately provokes a breach forfeits their claim.   

CONSEQUENCES FOR BUSINESSES 

The judgment is not a free pass to reject requests for information across the board – the burden of proof for misuse lies entirely with the company. Incorrect or delayed information opens the door to claims for damages – regardless of whether the request was made in good faith or abusively.    

For Swiss companies, there is the additional factor that the revised FADP has imposed comparable disclosure obligations since September 2023. Whilst the threshold for claims for compensation is higher than under EU law, this does not relieve companies of the obligation to provide timely and complete information. 

In practical terms, it is therefore advisable to streamline information processes and assign responsibilities clearly within the organisation, to formulate responses in a comprehensible manner rather than simply providing raw data, and to structure data management in such a way that information can be provided quickly and in full. 

CONCLUSION 

With its ruling, the ECJ has drawn an important line against the abuse of the right of access under data protection law: anyone who requests information under Article 15 of the GDPR not to monitor their own data processing, but specifically to construct claims for damages, is acting abusively – and forfeits both the right to access and the right to compensation. ForSwitzerland, the ruling confirms the application of the prohibition of abuse of rights (Art. 2 of the Swiss Civil Code) in data protection law. At the same time, the Swiss Data Protection Act (FADP) sets the bar even higher than EU law by requiring a serious infringement of personal rights for claims for compensation, which makes the business model of “data protection trolls” unattractive.    

Smartphones are now often the central evidence hub in criminal proceedings. Almost everyone carries one, which makes them one of the most important data carriers for investigators. That is precisely why access to them must never become a legal vacuum; an effective sealing procedure upon seizure is needed as a safeguard for privacy, personality rights, and professional secrecy.

Law enforcement is under pressure to review digital evidence quickly, while affected individuals often can only challenge a search with a significant delay. That tension is exactly what makes sealing so essential.

Why this issue matters now

Recent media reporting points to a marked rise in sealing-related proceedings involving smartphones; in Zurich alone, the number is said to have increased by 75 percent. At the same time, the federal authorities are working on more efficient procedures for securing electronic evidence while expressly emphasizing data protection and procedural rights.

This shows two things: digital evidence has become indispensable for criminal prosecutors, but the rule-of-law safeguards must operate with equal seriousness. If sealing and unsealing are not handled promptly and carefully, irreparable intrusions into highly sensitive personal data can follow.

The role of sealing

Sealing is not a technical footnote; it is a core procedural safeguard for sensitive information upon seizure. Anyone whose devices or documents are seized and who invokes confidentiality interests can request that the contents remain sealed until a court decides whether inspection is allowed.

This is especially important for smartphones, because they often contain an exceptionally broad digital footprint: chats, photos, health data, location history, work documents, and private communications. A search therefore almost inevitably interferes with privacy and must be justified with particular care.

What the court must assess

In unsealing proceedings, the question is not simply whether the public prosecutor would like to review the data. The compulsory measures court must also determine whether there is sufficient suspicion of an offence and whether the search is proportionate.

This review is crucial in digital cases because the interference is so far-reaching. Authorities must not access an entire device on a blanket basis if the relevant information can already be narrowed down more precisely, or if protected secrets outweigh the investigative interest.

Current developments and practical problems

The current debate around digital evidence reveals a structural problem: proceedings often take too long, even though digital data can quickly lose evidentiary value or appear in massive volumes. At the same time, the affected person’s duty to cooperate is sometimes applied too strictly in practice, although the Federal Supreme Court has stressed in relevant cases that substantiated disclosures can be sufficient.

Added to this is the new statutory three-day deadline for filing a sealing request after seizure, which has been described in legal commentary as a significant tightening and a potential trap. Missing that deadline, or failing to justify the request properly, can mean the irreversible loss of protection.

Why this matters for personality rights

The right to sealing protects not only lawyers, journalists, and other holders of professional secrecy, but ultimately every person whose most intimate life domains are stored on a device. A smartphone search often provides a comprehensive view of someone’s digital life, far beyond what is relevant to the criminal proceedings.

For that reason, the rule of law must not weaken the sealing mechanism simply because some courts have not yet fully adapted to the pace of technological change. The correct response is not less legal protection, but more precise procedures, faster judicial review, and stricter reasoning requirements for any intrusion.

Conclusion

In digital criminal proceedings, sealing is not a luxury; it is a rule-of-law necessity. Especially with smartphones and other data carriers, it determines whether privacy remains effectively protected or whether sensitive data are disclosed too early.

Anyone who wants to make searches of digital devices easier must not gradually dismantle the protection of affected persons. A functioning sealing procedure is the condition for keeping criminal prosecution, personality rights, and privacy in fair balance.

Artificial intelligence (AI) has long been part of our everyday lives. AI has become indispensable in schools, universities and businesses. Given the rapid development of artificial intelligence and its increasing presence in everyday life, it is becoming increasingly important to examine its opportunities and risks.

On February 23, 2026, the Federal Data Protection and Information Commissioner and around 60 other national data protection authorites worldwide published a joint statement on AI-generated images. This statement marks an important step in the international discussion on privacy and data protection in the digital age.

Deepfakes and AI: Why Data Protection Authorities Worldwide Are Issuing Warnings

Data protection authorites have expressed serious concerns about systems that use artificial intelligence to generate realistic images or videos of identifiable individual without their consent. Such technologies carry a high risk of abuse, for example through the creation of non-consensual, intimate depictions (known as deepfakes). Childern and other vulnerable groups are particularly at risk of becoming targets of cyberbullying, sexual exploitation or identity theft.

Laws in Switzerland: Are AI-generated images permitted?

In many juristictions – including Switzerland – the creation or distribution of images that have not been created with consent can have criminal consequences. From a data protection perspective, that use of AI systems to create realistic images raises significant questions regarding the legality of data processing and the protection of privacy. Personal data my only be used if there is a legal basis for doing so or if the data subject has given their expressed consent. Companies offering such systems must ensure that appropriate technical and organizational measures are taken to prevent misuse and unauthorized processing.

Recommendations for working with AI

The joint statement by the data protection authorities sets out several key principles that all organizations should follow:

• Impementation of robust protective measures to prevent the misuse of personal data and the creation of non-consensual intimate depictions and other harmful content, especially involving children.
• Ensuring meanigful transparency regarding the capabilities of AI systems, the protective mechanisms implementet, permissible uses, and the potential consequences of misuse.
• Provision of effective and easily accesible procedures through which data subjects can request the removal of harmful content relating to them.
• Special protection for children and other vulnerable groups.

Conclusion: Techological progress requires responsibility

The risks posed by AI-generated images are global and require urgent regulatory action. While AI offers enormous opportunities, technological progress must not come at the expense of privacy, data protection and other fundamental rights.

Our law firm advises businesses on the legally compliant use of AI and on data protection issues. Please feel free to contact us with any questions regarding generative AI, data protection and your digitalisation projects..

In its ruling of 6 October 2025, the Federal Administrative Court upheld the FDPIC’s decision on the ‘Pfarrer-Check’ database and clarified the application of the revised Data Protection Act (DPA) to publicly accessible personal data.

The decision provides important clarity for operators of online platforms, directories and campaign websites when dealing with personal data from the internet.

An overview of the Federal Administrative Court ruling A-2941/2024

In its ruling of 6 October 2025, A-2941/2024, the Federal Administrative Court upheld the decision of the Federal Data Protection and Information Commissioner (FDPIC) in the so-called ‘Pfarrer-Check’ case. In the court’s opinion, the public recording of over 6,000 church officials in an online database without their consent violates the revised Federal Act on Data Protection (FADP).

Facts of the ‘Pfarrer-Check’ case

The association ‘Bürgerforum Schweiz’ operated a publicly accessible database on its website containing personal data on over 6,000 individuals from the church community. The database contained names, places of residence and postcodes, employers or religious denominations, fields of activity, positions and a status (‘recorded’, “requested”, ‘responded’) in connection with a questionnaire on religious views.

According to the operator, the purpose of the database was to enable a distinction to be made between ‘genuine’ and ‘watered-down’ churches. In its ruling of 9 April 2025, the FDPIC ordered the deletion of the entries published without the consent of the persons concerned. The association lodged an appeal against this ruling, which the Federal Administrative Court did not admit.

Applicable law & procedure

The court first confirmed that the revised Federal Data Protection Act (FADP, in force since 1 September 2023) is applicable. The decisive factor is the date on which the formal investigation was opened; mere informal preliminary investigations and responses to enquiries do not constitute a pending investigation within the meaning of transitional law.

The complainant alleged that the lower court had violated her right to inspect the files by only making the reports available to her in anonymised form. However, the court considered the EDÖB’s action to be lawful: the public interest in effective data protection supervision outweighs the operator’s interest in the identity of the whistleblowers.

Key material points (data protection principles and justification)

Proportionality

In the court’s opinion, publishing the status ‘recorded’ or ‘requested’ was neither appropriate nor necessary to achieve the purpose stated by the association (distinguishing between “genuine” and ‘fake’ churches). The information that someone has received a questionnaire but has not answered it leaves room for interpretation without offering any objective added value for the purpose of data processing.

Limitation of Purpose

The individuals concerned had published their contact details on their institutions’ websites so that they could be contacted in connection with their professional activities. The mere fact that the data is publicly accessible does not mean that it may be used for any purpose, in particular for an evaluative campaign database. The court qualifies the use for the ‘Pfarrer-Check’ as a change of purpose that was not apparent to the persons concerned.

Transparency

The persons concerned must be actively and clearly informed about the actual data processing. This did not happen. In particular, the persons concerned were not sufficiently informed that their data would be published even if they did not complete the questionnaire. A mere reference to the operator’s website does not satisfy the transparency requirements of the DPA. Active, comprehensible information about the nature, purpose and scope of the data processing is required.

Justification

The court denies the existence of a justification within the meaning of Article 31 of the FADP. Neither was there valid consent, nor could the association invoke a legal basis or an overriding public interest. A self-defined ‘public interest’ without any basis in law or the constitution is not sufficient to justify serious violations of privacy.

The appeal to Article 31 para. 2 of the FADP (person of public interest) is also unsuccessful. In weighing up the interests, the court considers the status ‘requested’ to have a high potential for infringement because it allows negative speculation about the attitude and integrity of the person concerned, while the status ‘recorded’ only has a medium intensity.

The court therefore concludes that the complainant has unlawfully infringed the personality rights of the persons concerned.

Significance of the judgment in practice

Since the new FADP came into force, the FDPIC has already carried out numerous low-threshold interventions and issued more than 14 formal investigations in the form of rulings. Only four of these rulings have been challenged before the Federal Administrative Court to date. The decision thus shows that the courts fundamentally support the FDPIC’s approach and consistently enforce the basic principles of data protection law, even in the case of publicly accessible online data.

The decision sends a clear signal to operators of online databases, directories, campaign and rating platforms: even if data is publicly accessible, proportionality, purpose limitation, transparency and a viable obligation to justify remain central.

Our experts in data protection and ICT law assist organisations in the legally compliant design of online platforms, websites and projects under the revised DPA.
Get in touch with us for an initial consultation on matters of Data Protection.

In its ruling, the court refuses to unseal seized data carriers and documents belonging to a journalist, thereby strengthening freedom of press. The current decision of the Zurich District Court of 2 July 2025 deals with the unsealing of seized data carriers and documents in the case of Inside Paradeplatz journalist Lukas Hässig, after the journalist correctly filed for sealing on the grounds of protecting his sources. The decision of the Compulsory Measures Court shows the conditions under which a request for unsealing is approved or, as in this case, not approved.

Facts and background of the Hässig case

The focus is on an investigative journalist, editor of the Inside Paradeplatz platform. He is accused of sharing information and data from Bank Julius Bär & Co. AG, which is subject to banking secrecy and/or trade secrets, in his magazine ‘Inside Paradeplatz’. In connection with the resumption of criminal proceedings against the respondent for an offence under Article 47 Banking Act, a search was carried out at his home and place of work. Various items and data carriers were seized. Referring to the protection of journalistic sources, the respondent requested that all seized items be sealed.

The public prosecutor’s office then filed a request for unsealing with the Compulsory Measures Court of the Zurich District Court. The respondent commented on the request for unsealing and requested that it be dismissed.

Note: The judgment shows that the criminal investigation by the public prosecutor’s office had already been suspended twice. In the most recent suspension order, the public prosecutor’s office itself had denied the admissibility of a search on the grounds of source protection, which the court took up in its judgment.

Legal requirements for unsealing

A request for sealing is used to assert permissible confidentiality interests pursuant to Article 248 para. 1 of the Swiss Criminal Procedure Code when searching records. Once the request for sealing has been filed, the criminal authority first seals the seized data carriers and documents. In the unsealing proceedings, the Compulsory Measures Court is then obliged to examine any objections to the admissibility of the search. A general decision must therefore be made as to whether the search is admissible.

A search of records within the meaning of Article 246 ff. Swiss Criminal Procedure Code, i.e. ‘documents, audio, video and other recordings, data carriers and equipment for processing and storing information’, is permissible if:

• The items are subject to a seizure (Art. 246 Swiss Criminal Procedure Code)
• There is sufficient suspicion of a crime (Art. 197 para. 1 lit. b Swiss Criminal Procedure Code)
• It is proportionate with regard to the constitutionally protected sphere of intimacy and privacy (Art. 197 para. 1 lit. c Swiss Criminal Procedure Code)

According to Article 246 of the Swiss Criminal Procedure Code, documents, audio, video and other recordings, data carriers and equipment for processing and storing information may only be searched if there is reason to suspect that information subject to seizure is contained in these items. According to Article 263 para. 1 of the Swiss Criminal Procedure Code, items and assets that are used as evidence (lit. a) are subject to seizure if they are needed to secure procedural costs, fines, penalties and compensation (lit. b), if they are to be returned to the injured party (lit. c), confiscated (lit. d) or used to cover claims for compensation by the state in accordance with Article 71 of the Swiss Criminal Code.

Unlike the court of law, the Compulsory Measures Court does not have to exhaustively weigh up all incriminating and exonerating evidence. What is required is a sufficiently concrete probability that the alleged offence was actually committed. According to the highest court ruling, reasonable suspicion can be equated with the concept of initial suspicion pursuant to Article 309 para. 1 lit. a of the Swiss Criminal Procedure Code.
Compared to pre-trial detention (Art. 224 ff. Swiss Criminal Procedure Code), the unsealing and searching of records appears to be significantly less intrusive. The requirements for reasonable suspicion are therefore less stringent. Reference can be made to substantiated criminal complaints or reports. The grounds for suspicion must be examined on the basis of the results of the investigation to date.

Furthermore, the Compulsory Measures Court must weigh up the interests involved and examine whether the house search and the search of the sealed data are proportionate to the constitutionally protected intimate and private sphere of the respondent.
The owner of the records or objects may request sealing if there are obstacles to seizure in accordance with Article 264 of the Swiss Criminal Procedure Code (Art. 248 Swiss Criminal Procedure Code). These obstacles to seizure also prevent the unsealing of previously sealed records and objects.

When assessing the proportionality of this compulsory measure, the severity of the offences under investigation is also taken into account (Art. 197 para. 1 lit. d Swiss Criminal Procedure Code).

Considerations of the coercive measures court in its ruling of 2 July 2025

No reasonable suspicion

The criminal investigation against the respondent has now been ongoing for six years. The investigation files do not indicate that the suspicion against the respondent has intensified in recent years or at least months. The Compulsory Measures Court finds that no suspicion against the respondent can be established, even to a minimal degree. Sufficient suspicion is denied.

Proportionality and source protection

The public prosecutor’s office argues that the respondent cannot invoke source protection under Art. 28a para. 1 of the Swiss Criminal Code and Art. 172 of the Swiss Criminal Procedure Code and thus a right to refuse to give evidence. The Compulsory Measures Court argues that the respondent acted in the interests of society and fulfilled his duty as an investigative journalist. It considers the priority given to criminal prosecution and possible punishment for a breach of banking secrecy over the legitimate right of the public to be informed about alleged far-reaching violations of the law in the financial sector to be manifestly wrong. According to the Compulsory Measures Court, the interest in prosecution in this case is not sufficiently weighty to outweigh the protection of sources. The proportionality of the search must also be denied.

Finally, the Compulsory Measures Court finds that the conditions for unsealing and searching the seized data carriers and documents are not met.

Significance for the media, lawyers and those affected

The ruling thus rightly emphasises the high hurdles for interference in journalistic work. Source protection enjoys strong protection in Switzerland, as it is enshrined in the Constitution and the ECHR. Finally, criminal proceedings such as the unsealing and searching of records require careful consideration of the interests involved – especially in the case of media professionals.

For affected journalists and media companies, this means that access to confidential data is only permitted in exceptional cases where there are concrete and serious grounds for suspicion of criminal activity.

Our law firm provides advice on criminal procedure law, media law, source protection and the enforcement of personal rights. Please feel free to contact us without obligation if you have any questions about criminal proceedings and the search of records.

FAQ Criminal proceedings and sealing:

1. How does the sealing of data carriers or documents occur in criminal proceedings?

Seized data carriers or documents are sealed if the person concerned claims that the contents of the records are subject to special protection, for example due to professional secrecy (e.g. protection of journalistic sources, lawyers, doctors). Sealed data may only be searched after a court decision has been made.

2. Under what conditions can a request for unsealing be successful?

To this end, the public prosecutor’s office submits a request for unsealing to the Compulsory Measures Court. Unsealing is possible if there is concrete and sufficient suspicion against the person concerned and the search appears proportionate to their fundamental rights. The Compulsory Measures Court always examines the proportionality and the suspicion.

3. What is the right to refuse to give evidence and who can invoke it?

The right to refuse to give evidence allows certain professional groups – e.g. lawyers, journalists, doctors – to refuse to testify and to keep their sources or client data confidential. This protection applies as long as they are not suspected of having committed serious crimes themselves.

The right to refuse to give evidence allows any person to refuse to testify during questioning for their own protection (Art. 169 Swiss Criminal Procedure Code) or to protect personal relationships such as their spouse or close relatives (Art. 168 Swiss Criminal Procedure Code). However, sealing is only protected under Art. 264 of the Swiss Criminal Procedure Code in cases of qualified confidentiality protection, e.g. items and documents from another person’s communications with their lawyer.

4. Is the protection of journalists’ sources also guaranteed in court?

Yes, journalists can invoke source protection. Courts and public prosecutors may only seize and unseal their data in exceptional cases – namely when there are clear indications of a criminal offence and public interests, namely in the criminal investigation, outweigh other considerations.

5. What can I do if I receive a summons to appear as a witness but wish to refuse to provide information?

You must attend the appointment, but you can exercise your right to refuse to give evidence if you are bound to secrecy as a relative or because of your profession. Inform the authorities of this in good time and seek legal advice if necessary.

As a company, it is worth recognizing which tasks should be handled in-house and where the company is better off concentrating on its core business in order to increase efficiency and reduce costs. Particularly in IT, it makes sense to consider bringing in an external service provider, if not only then also for information security reasons. And while companies and service providers like to focus on performance, both would do well to be able to answer the fundamental questions of data protection.

Outsourcing from a data protection perspective

Cloud providers, web hosts, agencies and call centres or IT support companies take on tasks in companies that also entail access to or the processing of personal data held by the company. According to the Federal Act on Data Protection (FADP), the processing of personal data can be transferred to a so-called processor. In this case, the company, as the so-called controller, remains responsible for ensuring that data protection is complied with. The company must ensure careful selection, appropriate instruction and necessary monitoring. The service provider has a reciprocal interest in delineating the duties transferred and clarifying which services are to be remunerated and how.

DPA – Data Privacy Agreement

In practice, the agreement on data processing (or order processing according to GDPR) has become established, often abbreviated as DPA. Instead of a separate DPA, data protection can also be regulated as an annex to the contract, as is common in the Anglo-American region with the so-called Data Privacy Addendum, or (also) DPA for short. More important than where, is that the responsibilities and obligations are regulated in accordance with the DPA or GDPR. Similar pitfalls present themselves time and again.

Important to regulate

The basic principle of both the FADP and the GDPR is to ensure that the processor only processes the transferred data in accordance with the instructions of the client. Suitable technical and organisational measures must be taken to ensure that the rights of the data subject are protected. Accordingly, in addition to the basic scope of the order, and thus the data processing, data security in particular must be determined. On the one hand, this should be appropriate to the risk and effective, and on the other hand, it must correspond to the state of the art. Depending on the sector, audits, pen tests and certifications may also be used for this purpose. 

In principle, the processor processes personal data for controller’s purposes, i.e. the company’s. As a service provider, processors therefore are not permitted to process this personal data for their own purposes – otherwise they would become controllers themselves (sometimes also referred to as a “joint controller”). For such a change of purpose, a processor must be able to assert its own justification, primarily the express consent of the data subject.

Pitfalls in DPA

The issue of subcontracting, i.e. the use of so-called subcontractors, is often forgotten or overlooked. These must be disclosed before the contract is concluded and must only be used after the contract has been concluded with the prior authorization of the company, i.e. the controller. In addition, when outsourcing abroad, there are also considerations regarding the disclosure of personal data abroad and data security in general (see also below on outsourcing with a US context).

As mentioned above, the company remains responsible as the controller. To this end, it may make sense to regulate support obligations with contractual agreements (e.g. obligations to cooperate) and/or to take specific organizational measures. This primarily concerns the rights of data subjects (information, rectification, erasure), but also instruments and obligations under the law (data protection violations, data protection impact assessments, etc.).

It is not uncommon for regulations on responsibility and liability as well as the resulting costs to be missing – or they are unilaterally transferred. It seems sensible to adapt liability to the dynamics of the service relationship, in particular how independently the service provider acts for the company. The costs in particular should be made transparent and are probably best orientated towards the polluter-pays principle. 

Outsourcing in a US context

If data is disclosed abroad during outsourcing, it must also be checked whether the countries in which the data is processed have an adequate level of data protection. This is primarily based on the decision of the Federal Council, i.e. the list of countries with an adequate level of data protection in accordance with the Swiss Data Protection Ordinance (DPO). If the service provider is located in a country that does not offer a level of data protection comparable to that in Switzerland, or if the data is processed in countries that do not offer an adequate level of protection compared to Switzerland, additional measures must be taken. Standard data protection clauses (also known as “Standard Contractual Clauses” SCC) are the first thing to consider.

The USA is therefore a special case. With the invalidation of the EU-US Privacy Shield – and subsequently the Swiss-US Privacy Shield – as a result of the Schrems II ruling by the European Court of Justice in July 2020, the processing of confidential data by a US provider in compliance with data protection regulations has become more complex. In the meantime, SCC was used as a workaround – without legal certainty as to whether this would be sufficient. Now the new Swiss-U.S. Data Privacy Framework for certified U.S. companies offers adequate protection for personal data. To this extent, the Federal Council has now put the USA back on the list of countries with an adequate level of data protection and will in future allow the transfer of personal data from Switzerland to certified companies in the USA without additional guarantees. The Federal Council has brought the corresponding amendment to the DPO into force on September 15, 2024.