In accordance with the Federal Act on Data Protection (FADP), any person may request information from the controller of a data file as to whether their personal data is being processed and may, if necessary, have the data corrected or destroyed. This right to information allows everyone to maintain control over the data collected about them. It is key to enabling those affected to assert their rights under the law and ensures transparency regarding what use is made of the data. Nevertheless, each person must take action themselves to exercise this right.
Right to information
The FADP sets out a non-exhaustive list of information that must always be provided to the person exercising their right to access their personal data. In all cases, the person requesting information must be provided with information on the identity and contact details of the controller of the data. Furthermore, the data subject must be informed of the personal data that has been processed and the purpose of the processing. He or she must also be informed of the period of time the data will be kept or, if this is not possible, the criteria for defining the period of time. The data subject must also be provided with the available information on the origin of the data (in cases where they have not provided the data themselves), and shall be informed in relevant cases of any automated individual decision-making, as well as of the logic on which the decision is based. Finally, the data subject must also be informed of the recipients or categories of recipients to whom the data may have been disclosed. If the recipients are located abroad, the information must specify the country concerned and, where appropriate, the guarantees of adequate protection that are provided or the application of one of the exceptions.
It is not necessary for a person to justify their request to the data controller when exercising their right to access their data, or to have their data corrected or destroyed. In principle, the information must be provided free of charge within 30 days. It should be noted that requests requiring a disproportionate effort may incur fees (up to a maximum of CHF 300).
In certain cases, the right to information may be refused, restricted or deferred, in particular if overriding private or public interests oppose it. In such a case, the data controller must indicate the reason that communication of the information is being refused, restricted or deferred. Any federal body refusing or granting only limited access must communicate a decision to you, and you have the right to appeal that decision. The reasoning given must enable the person concerned to check whether the restriction of their right to information is justified. The procedural implementation of data subjects' rights is strengthened because the FADP now provides for easier access to justice by waiving court fees in civil proceedings.
Last modification 12.07.2023