Data protection: Which data is collected about me and how can I find that out?

Why do we need data protection law?

If you use customer cards or shop online, then you leave behind a trail of data every time. Companies collect this in order to adapt their products to your needs, design new customer services, and analyze our purchasing behavior, for example. Would you like to know what data companies are collecting about you? The Swiss Federal Act on Data Protection (FADP) gives every person the right to demand information from the holders of a data collection about whether they collect and process data and if yes, which data this is.

 

How does a request for information on data protection work?

The owner of the data collection has to inform you of at least the following so that, if needed, you can assert your rights under data protection law and transparent data processing is guaranteed:

1. The identity and contact details of the person responsible.
2. The processed personal data as such. For example, this also includes pseudonymous data, but not anonymous data.
3. The purpose of processing so that it is clear whether the processing fulfills this purpose.
4. Term of retention of the personal data or, if this is not possible, the criteria used to determine the term.
5. Information on the origin of the personal data. If this was not obtained from the affected person themselves, the identity of the origin must be disclosed. This serves to ensure that the affected person can also assert their rights against the person responsible. 
6. If available, the automatic individual decision and logic on which the decision was based.
7. If available, the recipients or corresponding categories of recipients to whom this personal data is disclosed. 
8. If personal data is disclosed abroad, information regarding which country or international entity is receiving the data must be disclosed. 

 
Does a company always have to give me information on my personal data?

The right to information according to the new FADP can be restricted under certain circumstances:

1. If formal laws prescribe such a restriction, for example as is the case with the professional secrecy of attorneys or bank-client confidentiality,
2. If the restriction is necessary to protect overriding interests of third parties, for example to protect the privacy of other persons,
3. Or if the request for information is obviously unjustified or pursues a purpose in violation of data protection law.

In addition, the responsible party can refuse, restrict, or delay the provision of information if it is in the legitimate interest of the responsible party or no personal data is transferred to third parties. In any case, the responsible person must provide information on the reason for the restriction, ideally in writing, to prove the legality of their decision.

 

In which way do I have to submit my request for information?

You no longer have to assert your right to information in writing. However, you have to be able to prove your identity, for example with a copy of your ID. The holder of the data collection must then provide the information or a justified decision to limit your right to information within 30 days. 

 

How will I receive my data?

The information is usually provided in writing, as a printout/copy or via email. The owner of the data collection can also allow you to access the data on site. However, they are not obligated to do so. Supplying false or incomplete data in response to a request for information may result in a fine of up to CHF 250,000.

Does the request for information cost anything?

A contribution toward the cost of providing the information may only be requested if it involves a particularly large effort or if the applicant has already received the desired information in the past. This contribution toward the cost may not exceed CHF 300 and you must be notified before you receive the information so that you have the opportunity to withdraw your application without cost.