The federal court found in the Judgment 4A_518/2020 of 25 August 2021that a Data processing that violates Art. 328b CO is unlawful, but may be based on a justification pursuant to Art. 13 DPA.
The parties had agreed in the employment contract on the use of a company cell phone for exclusively professional purposes. The employee returned the reset company cell phone to the employer on the occasion of the termination. In order to secure evidence in view of the pending proceedings, the employer obtained access to the employee’s private WhatsApp histories. The courts awarded the employee compensation of CHF 5,000 for the emotional distress suffered as a result.
The Federal Supreme Court considered that data processing for the purpose of gathering evidence can stand up to Art. 328b OR, but in doing so the Proportionality principle had to be observed. Because the employer would have had milder measures at its disposal that would have achieved the same goal, this data processing violated this principle. Although the employment contract stipulated that the company cell phone could only be used for business purposes, the employer had also known that the employee was using the company cell phone for private purposes. It had given him the opportunity to delete private data before returning it. It was therefore contrary to good faith to access the employee’s private data five months after the company cell phone had been returned.
However, the Federal Supreme Court’s comments on Art. 328bOR are particularly noteworthy. First of all, it states that in the doctrine of Dissent regarding the scope and nature of Art. 328b CO exists. Part of the doctrine is of the opinion that any data processing without reference to the workplace according to Art. 328b CO is per se inadmissible. Art. 328b OR is a prohibition norm. In contrast, it is argued that Art. 328b CO substantiates the principle of proportionality and the requirement of purpose limitation. Thus, the grounds for justification of the DPA would also apply in the scope of application of Art. 328b CO. In this respect, Art 328b CO is a processing principle.
The Federal Supreme Court did not deal with the doctrine in more detail. It merely noted, but nevertheless, that the prevailing doctrine is of the opinion that Art. 328b OR is a Concretization of the principle of proportionality and the principle of purpose limitation handle:
Pour la majorité toutefois, cette norme concrétise les principes de proportionnalité et de finalité ancrés à l’art. 4 al. 2 et 3 LPD (E. 4.2.4).
Accordingly, a data processing that violates Art. 328b CO, if applicable, on a justification ground within the meaning of Art. 13 DPA support
Lorsque le traitement de données n’entre pas dans le cadre de l’art. 328b CO, il est présumé illicite et doit pouvoir se fonder sur un autre motif justificatif au sens de l’art. 13 LPD (E. 4.2.4).
Thus, on the one hand, the Federal Supreme Court confirms the opinion of the lower court regarding the scope of Art. 328b CO [Cour de justice du canton de Genève (C/6596/2017 – 5, CAPH/163/2020).]. The lower court also stated – also without discussion – that data processing outside of Art. 328b OR could be justified according to Art. 13 DSG.
Tout traitement de données relatif à un employé constitue une atteinte illicite à sa personnalité, au sens des articles 328 et 328b CO, à moins qu’il ne repose sur un motif justificatif. Un tel motif peut résulter de la loi, en particulier de l’art. 328b CO, d’un intérêt prépondérant privé ou public, ou du consentement de la victime. (E. 2.2)
At the same time contradicts the federal court ruling the practice of the Zurich Supreme Court [OGer ZH, LA180031‑O/U, dated March 20, 2019According to this, Art. 328b OR is lex specialis to the DPA. In view of the mandatory character, a justification in the sense of Art. 13 DPA cannot eliminate the unlawfulness:
Art. 328b OR is lex specialis to the data protection provisions in the Federal Data Protection Act. Data processing in the employment relationship is generally inadmissible unless it is justified by reference to the suitability of the employee or the performance of the employment contract. Any processing of data that does not have a sufficient connection to the workplace is therefore inadmissible.. It is therefore not allowed even if it would be allowed under the Data Protection Act. Unlike in the area of data protection law, the existence of a justification is therefore not in principle able to eliminate the unlawfulness (E. 2.c.aa).
In view of the mandatory nature of Art. 328b CO the justification of consent (Art. 13 para. 1 FADP) cannot eliminate the unlawfulness of data processing under Art. 328b CO. (E. 2.c.cc)
Although the Federal Supreme Court did not discuss the scope and nature of Art. 328b CO in detail, this ruling is nevertheless the first supreme court precedent on this issue and thus sets the course for a uniform interpretation of Art. 328b CO throughout Switzerland.