Liability under the revised Federal Data Protection Act (FADP).
The revised FADP entered into force on 01 September 2023. It provides for criminal sanctions for willful failure to comply with data protection obligations.
In the future, willful disregard of the new data protection obligations under the FADP can be prosecuted and punished with a fine of up to CHF 250,000. The fines are not generally directed against the company. Instead, the FADP provides for the direct sanctioning of responsible individuals (e.g., members of the board of directors, senior management, compliance officers, etc.). The following actions can be sanctioned:
Violations of information and cooperation obligations (Art. 60 FADP):
- Intentionally providing false or incomplete information to individuals, or
- Intentionally providing false information or refusing to cooperate with the supervisory authorities.
Unauthorised transfer of personal data abroad:
Under Art. 61 FADP, private individuals are liable for the unauthorized disclosure of personal data and for failing to comply with the minimum technical and organizational security requirements.
- Intentionally transferring personal data to third countries without legal basis
- Intentionally transferring personal data to data processors without a legal basis
- Deliberate failure to meet minimum TOM requirements
Failure to comply with orders of the supervisory authority (Art. 63 FADP)