--- title: "Switzerland — Algorithmic, Biometric & Surveillance Governance | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/switzerland/algorithmic-biometric-and-surveillance-governance/ source_html: /jurisdictions/switzerland/algorithmic-biometric-and-surveillance-governance/index.html description: "Switzerland — Algorithmic, Biometric & Surveillance Governance: algorithmic_biometric_and_surveillance_governance Algorithmic, Biometric & Surveillance Governance 6 sub-modules 6 claims Amber ▾ # Biometric/genetic categorisation and FDPIC AI en" generated_at: 2026-10-25T04:46:50Z content_sha256: 5a0653a3d81445d7c4d407df3ee0f48de96b4adbf73e812d2bca964c86a00cf1 generator: "fe-fleet/md-twin@1.0" --- # Switzerland — Algorithmic, Biometric & Surveillance Governance | Data Protection Monitor ### D8Algorithmic, Biometric & Surveillance Governance6 sub-modules6 claimsAmber▾# Biometric/genetic categorisation and FDPIC AI engagement are confirmed; the profiling/ADM regime is structurally narrower than the GDPR and carries residual ambiguity. Primary framework Federal Act on Data Protection (FADP), revised version, Arts 2(2)(c), 21, 31 Supervisory authority [Federal Data Protection and Information Commissioner (FDPIC / EDÖB)](http://www.edoeb.admin.ch) Traffic-light rationale — Amber Biometric/genetic categorisation and FDPIC AI engagement are confirmed; the profiling/ADM regime is structurally narrower than the GDPR and carries residual ambiguity. #### Sub-modules (6) #### Profiling RestrictionsAmber A right equivalent to GDPR Article 21 does not exist per se; Swiss law instead provides a narrower opt-out-style objection right under Art 31(2)(b) revFADP. Claims (1): - A right equivalent to Article 21 of the GDPR does not exist per se under Swiss law; Article 31(2)(b) of the revised FADP instead provides a data subject right to object, essentially limited to an opt-out right. #### Automated Decision Making TransparencyAmber Article 21 of the revFADP imposes information duties on controllers in respect of automated individual decision-making, with willful provision of false information in that context subject to criminal sanction. Claims (1): - Article 21 of the revFADP concerns automated individual decision-making, and willful provision of false or incomplete information in that context is subject to criminal penalty under Article 60. #### Ai Risk AssessmentsAmber The FDPIC has issued a press release addressing the intersection of artificial intelligence and data protection, indicating active regulatory attention though no confirmed dedicated Swiss AI-specific statutory risk-assessment regime. Claims (1): - The FDPIC has issued a press release specifically addressing artificial intelligence and data protection. #### Biometric RegimeAmber The FDPIC issued a decision addressing PostFinance's use of voice-recognition (biometric) technology, reflecting active enforcement engagement with biometric processing; biometric data is also now expressly a sensitive-data category under the revFADP. Claims (1): - The FDPIC issued a decision concerning PostFinance's use of voice-recognition biometric technology. #### Genetic DataGreen Genetic data was brought within the FADP's sensitive personal data category as part of the FADP revision. Claims (1): - Genetic data was brought within the FADP's sensitive personal data category as part of the revision process leading to the revFADP. #### State Surveillance CarveoutsAmber Article 2(2)(c) of the FADP provides that the Act may not apply to processing of personal data within the frame of administrative, civil or criminal proceedings once pending, though the requirements of the FADP still apply to investigations carried out by police prior to such proceedings becoming pending. Claims (1): - Article 2(2)(c) of the FADP provides that the Act may not apply to processing of personal data in the frame of administrative, civil, or criminal proceedings once pending, though FADP requirements still apply to police investigations carried out prior to such proceedings becoming pending. Category narrative 104 words The revFADP does not replicate a general GDPR Article 21-style objection right but does impose information duties on controllers regarding automated individual decision-making (Art 21 revFADP information obligations, distinct numbering from the GDPR). Biometric and genetic data were brought within the sensitive-data category by the revision, and the FDPIC has demonstrated active enforcement interest in biometric processing (e.g., a decision concerning PostFinance's voice-recognition system) and has issued a press release specifically addressing AI and data protection. State-surveillance carve-outs exist via Art 2(2)(c) FADP, which disapplies the Act to processing within pending administrative, civil, or criminal proceedings (though pre-proceeding police investigatory processing remains in scope). no periodic updates on record for this sub-brief Evidence 6 Sources and claims (6) - Probable[OneTrust DataGuidance](https://www.dataguidance.com/sites/default/files/switzerland_-_third_country_assessment_guidance_note_dataguidance.pdf) — A right equivalent to Article 21 of the GDPR does not exist per se under Swiss law; Article 31(2)(b) of the revised FADP instead provides a data subject right to object, essentially limited to an opt-out right.observed 2026-08-03 - Probable[International Association of Privacy Professionals](https://iapp.org/news/a/revised-swiss-data-protection-law-soon-in-effect-with-new-scope-obligations-implications) — Article 21 of the revFADP concerns automated individual decision-making, and willful provision of false or incomplete information in that context is subject to criminal penalty under Article 60.observed 2026-08-03 - Uncertain[OneTrust DataGuidance](https://www.dataguidance.com/news/switzerland-fdpic-issues-press-release-ai-and-data) — The FDPIC has issued a press release specifically addressing artificial intelligence and data protection.observed 2026-08-03 - Uncertain[OneTrust DataGuidance](https://www.dataguidance.com/news/switzerland-fdpic-issues-decision-postfinance-voice) — The FDPIC issued a decision concerning PostFinance's use of voice-recognition biometric technology.observed 2026-08-03 - Probable[International Association of Privacy Professionals](https://iapp.org/news/a/revision-of-the-swiss-data-protection-act-evolution-but-not-revolution) — Genetic data was brought within the FADP's sensitive personal data category as part of the revision process leading to the revFADP.observed 2026-08-03 - Probable[OneTrust DataGuidance](https://www.dataguidance.com/sites/default/files/switzerland_-_third_country_assessment_guidance_note_dataguidance.pdf) — Article 2(2)(c) of the FADP provides that the Act may not apply to processing of personal data in the frame of administrative, civil, or criminal proceedings once pending, though FADP requirements still apply to police investigations carried out prior to such proceedings becoming pending.observed 2026-08-03