Data Protection Monitor
Global Privacy & Data Protection Intelligence

Switzerland (CH) · Module Detail

Switzerland: Algorithmic, Biometric & Surveillance Governance

← Full Switzerland overview Build report with Switzerland Request deeper dive

#

Biometric/genetic categorisation and FDPIC AI engagement are confirmed; the profiling/ADM regime is structurally narrower than the GDPR and carries residual ambiguity.

Primary frameworkFederal Act on Data Protection (FADP), revised version, Arts 2(2)(c), 21, 31
Supervisory authorityFederal Data Protection and Information Commissioner (FDPIC / EDÖB)
Traffic-light rationale — AmberBiometric/genetic categorisation and FDPIC AI engagement are confirmed; the profiling/ADM regime is structurally narrower than the GDPR and carries residual ambiguity.

Sub-modules (6)

Profiling RestrictionsAmber

A right equivalent to GDPR Article 21 does not exist per se; Swiss law instead provides a narrower opt-out-style objection right under Art 31(2)(b) revFADP.

Claims (1):

  • A right equivalent to Article 21 of the GDPR does not exist per se under Swiss law; Article 31(2)(b) of the revised FADP instead provides a data subject right to object, essentially limited to an opt-out right.

Automated Decision Making TransparencyAmber

Article 21 of the revFADP imposes information duties on controllers in respect of automated individual decision-making, with willful provision of false information in that context subject to criminal sanction.

Claims (1):

  • Article 21 of the revFADP concerns automated individual decision-making, and willful provision of false or incomplete information in that context is subject to criminal penalty under Article 60.

Ai Risk AssessmentsAmber

The FDPIC has issued a press release addressing the intersection of artificial intelligence and data protection, indicating active regulatory attention though no confirmed dedicated Swiss AI-specific statutory risk-assessment regime.

Claims (1):

  • The FDPIC has issued a press release specifically addressing artificial intelligence and data protection.

Biometric RegimeAmber

The FDPIC issued a decision addressing PostFinance's use of voice-recognition (biometric) technology, reflecting active enforcement engagement with biometric processing; biometric data is also now expressly a sensitive-data category under the revFADP.

Claims (1):

  • The FDPIC issued a decision concerning PostFinance's use of voice-recognition biometric technology.

Genetic DataGreen

Genetic data was brought within the FADP's sensitive personal data category as part of the FADP revision.

Claims (1):

  • Genetic data was brought within the FADP's sensitive personal data category as part of the revision process leading to the revFADP.

State Surveillance CarveoutsAmber

Article 2(2)(c) of the FADP provides that the Act may not apply to processing of personal data within the frame of administrative, civil or criminal proceedings once pending, though the requirements of the FADP still apply to investigations carried out by police prior to such proceedings becoming pending.

Claims (1):

  • Article 2(2)(c) of the FADP provides that the Act may not apply to processing of personal data in the frame of administrative, civil, or criminal proceedings once pending, though FADP requirements still apply to police investigations carried out prior to such proceedings becoming pending.
Category narrative104 words

The revFADP does not replicate a general GDPR Article 21-style objection right but does impose information duties on controllers regarding automated individual decision-making (Art 21 revFADP information obligations, distinct numbering from the GDPR). Biometric and genetic data were brought within the sensitive-data category by the revision, and the FDPIC has demonstrated active enforcement interest in biometric processing (e.g., a decision concerning PostFinance's voice-recognition system) and has issued a press release specifically addressing AI and data protection. State-surveillance carve-outs exist via Art 2(2)(c) FADP, which disapplies the Act to processing within pending administrative, civil, or criminal proceedings (though pre-proceeding police investigatory processing remains in scope).

no periodic updates on record for this sub-brief

Sources and claims (6)
  1. ProbableOneTrust DataGuidance — A right equivalent to Article 21 of the GDPR does not exist per se under Swiss law; Article 31(2)(b) of the revised FADP instead provides a data subject right to object, essentially limited to an opt-out right.observed
  2. ProbableInternational Association of Privacy Professionals — Article 21 of the revFADP concerns automated individual decision-making, and willful provision of false or incomplete information in that context is subject to criminal penalty under Article 60.observed
  3. UncertainOneTrust DataGuidance — The FDPIC has issued a press release specifically addressing artificial intelligence and data protection.observed
  4. UncertainOneTrust DataGuidance — The FDPIC issued a decision concerning PostFinance's use of voice-recognition biometric technology.observed
  5. ProbableInternational Association of Privacy Professionals — Genetic data was brought within the FADP's sensitive personal data category as part of the revision process leading to the revFADP.observed
  6. ProbableOneTrust DataGuidance — Article 2(2)(c) of the FADP provides that the Act may not apply to processing of personal data in the frame of administrative, civil, or criminal proceedings once pending, though FADP requirements still apply to police investigations carried out prior to such proceedings becoming pending.observed