The Protection of Personal Data Against Public Authorities
Public administrations process a considerable amount of personal data relating to citizens: civil status, tax situation, medical data, social files, police data. Data protection constitutes a fundamental right (art. 13 FC) that applies equally in the relationship between citizens and the State. The Federal Act on Data Protection (FADP), revised and in force since 1 September 2023, as well as cantonal laws, govern this processing. PBM Avocats defends the rights of individuals in Geneva and Lausanne.
Legal Framework: Federal FADP vs. Cantonal Laws
| Level | Applicable Law | Supervisory Authority |
|---|---|---|
| Confederation | FADP (federal public law) + OFADP | FDPIC (Federal Data Protection Commissioner) |
| Canton of Geneva | LIPAD (Law on Public Information, Access to Documents and Protection of Personal Data) | Cantonal Commissioner GE (PPDT) |
| Canton of Vaud | LVPD (Vaud Law on the Protection of Personal Data) | Cantonal Commissioner VD |
The Rights of Data Subjects Vis-à-Vis Authorities
Persons whose data is processed by public authorities have the following rights:
- Right of access: obtain confirmation that data about you is being processed and obtain a copy (art. 25 FADP). The authority must respond within 30 days
- Right of rectification: have inaccurate or incomplete data corrected
- Right of erasure: request the deletion of data processed unlawfully or whose retention is no longer justified
- Right of objection: object to certain types of processing (profiling, marketing)
- Right to information: be informed of data collection (transparency principles)
Principles of Data Processing by the Administration
Any processing of data by a public authority must comply with fundamental principles:
- Legality: processing must rest on a formal legal basis (art. 17 FADP for the public sector)
- Proportionality: only data necessary for the purpose may be collected and processed
- Purpose limitation: data may only be used for the purposes for which it was collected
- Accuracy: data must be accurate and updated if necessary
- Limited retention: data may only be retained for as long as necessary
- Security: appropriate technical and organisational measures to protect data
Sensitive Data: Enhanced Protection
Certain categories of data benefit from enhanced protection (art. 5 let. c FADP):
- Data on health and disability
- Data on political, religious or philosophical opinions
- Data on race and ethnicity
- Biometric data (fingerprints, facial recognition)
- Genetic data
- Data on social assistance measures or criminal proceedings
The processing of such sensitive data requires a particularly clear legal basis and a justification of overriding public interest.
Mass Digital Surveillance and Its Limits
The development of digital technologies (artificial intelligence, big data, facial recognition cameras) poses growing challenges to data protection vis-à-vis authorities. In Switzerland:
- The Federal Act on the Surveillance of Postal and Telecommunications Traffic (SPTA) governs the surveillance of telecommunications
- The Intelligence Act (IntelA) provides for special surveillance measures subject to judicial authorisation
- Cantonal laws regulate public video surveillance
- The case law of the European Court of Human Rights (ECtHR) applies in Switzerland and limits mass surveillance practices
Does the new 2023 FADP apply to Swiss administrative authorities?
The revised FADP (in force since 1 September 2023) applies to private persons. For federal authorities, the adapted Federal Act on Data Protection (FADP) applies. Cantonal authorities are governed by cantonal data protection laws. Geneva has its own law (LIPAD), Vaud has the LVPD. The principles are similar but the procedures and supervisory authorities differ.
Can I ask an administrative authority to provide me with the data it holds about me?
Yes. The right of access is a fundamental right (art. 25 FADP and cantonal equivalents). You may ask any public authority to confirm whether it processes data about you and to obtain a copy of that data. The authority generally has 30 days to respond. In the event of refusal or partial response, you may appeal to the competent authorities.
Can one request the rectification or erasure of incorrect data held by the State?
Yes. If data processed by an authority is inaccurate, incomplete or outdated, you may request its rectification or erasure. The authority may refuse if it has a legal obligation to retain the data. In the event of refusal, you may contact the cantonal or federal Data Protection Commissioner, or appeal to the competent administrative court.
Are public surveillance cameras (CCTV) regulated by law?
Yes. Surveillance by cameras in public spaces by authorities is subject to strict rules: formal legal basis, respect for the principle of proportionality, information to persons filmed, limited retention period. In Switzerland, cantonal and municipal laws regulate public video surveillance. The ECtHR (ECHR) has also set strict limits on mass surveillance.
How to contest unlawful processing of data by a public administration?
You may: (1) send a cessation request directly to the relevant authority; (2) contact the cantonal or federal Data Protection Commissioner for mediation or a recommendation; (3) bring an action before the competent administrative court. In the event of a serious infringement of personality rights, damages and compensation for moral harm may be claimed.