With Judgment A‑4873/2021 of April 11, 2024 the FAC ruled that the right to information under Art. 8 aDSG (which was still applicable under transitional law) does not provide a right to copies of documents, but only to copies of personal data.
An exception should apply if the provision of a document is necessary in individual cases in order to make the information content of a personal data comprehensible (which was not explained in the present case; the FAC’s statement in this regard is therefore an obiter dictum):
6.4.8 In summary, a person requesting information has no fundamental right to photocopies of the documents containing their data, either from a grammatical, systematic, historical, teleological or temporal point of view. Even under the aDSG, the claim relates in principle only to personal data as such. However, since the latter must be communicated in such a way that they are comprehensible […], it may be necessary in individual cases – from a teleological point of view, with a view to the suggestion in the Federal Council Dispatch and analogous to the convincing case law of the ECJ – to provide the person requesting information with a photocopy of the document in order to contextualize the data processing […].
The judgment is correct in its result, i.e. in refusing access to documents, both under the old and the current DPA.
However, there are three points to criticize:
- The FAC initially provides a much more detailed interpretation than is necessary. Since the FADP is generally only applicable to the processing of personal data, the right to information cannot a priori go any further. The current FADP also clarifies that the right to information only applies to “personal data as such”, which the FAC also takes into account in its interpretation.
- The FAC refers to the GDPR without necessity. At least it holds firm:
For the sake of completeness, Art. 15 GDPR and the related case law should be mentioned. Art. 15 GDPR is not relevant for the interpretation of Art. 8 para. 5 aDSG, as the former did not serve as a model for the legislator […]. This was only the case with the current DPA […]. However, since Art. 15 GDPR has a comparable wording and there are already court rulings on its scope, a comparative legal analysis is justified.
It is not true that the GDPR was the model for the right to information. Above all, however, it is to be feared that such a look to the side – or upwards? – will become the rule. However, it is wrong unless it is clear from the materials that the FADP was intended to be aligned with the GDPR not only in terms of terminology but also in terms of content. Even if the FAC describes the reference to the GDPR as “comparative law”: Courts may not creepingly adopt the GDPR, and not even under the title of “plausibilization”. The DPA must be interpreted in accordance with the usual rules of interpretation; the GDPR is generally not relevant, even if the result of the interpretation is “implausible”. In the present ruling, it is also completely unclear to what extent the GDPR was relevant to the result.
- The statement is highly questionable, a entire document should be handed over if this Required to understand the personal data is. There are several reasons against this view, which is discussed in the literature:
- The legislator itself has set out in Art. 25 para. 1 lit. a‑g what is necessary for understanding. It is true that Art. 25 para. 1 contains a general clause, the scope of which is unclear. In any case, however, the legislator has endeavored to specify the generally relevant information about the processing. More may only be necessary in exceptional cases. A lack of understanding of personal data can hardly be sufficient. Anyone who knows their personal data and the purpose and other circumstances of the data processing specified in the law should have the necessary understanding of the processing.
- What would be the object of the “understanding” anyway? Ultimately, aspects of data protection law must be relevant – the understanding that is apparently to be sought must be interpreted with a view to informational self-determination. However, a basic understanding and a right to object are sufficient for this self-determination. A broader understanding of data processing can hardly be a concern under data protection law. Data protection law is not the AT of a general right to self-determination. It would therefore have to be shown to what extent a data subject can only exercise self-determination over their personal data if they are aware of the entire document.
- If a data controller can only mentally establish a connection between a personal data item and the context, i.e. derives or can derive conclusions from the context of a personal data item that cannot be derived from the personal data item itself, the following must be taken into account BGE 147 III 139 The right to information is “about the legislator […] recording data collections that exist in writing or ‘physically’ and can therefore be viewed objectively in the long term, but not just data that can be retrieved from memory”. A context that merely allows mental conclusions is not an objectively visible datum, which is why it is not the subject of the information, which is why no entire document can be requested for “contextualization”.
- The FAC refers here to the Judgment of the ECJ in Case. C‑487/21 in the case of CRIF. This judgment is not transferable:
- The GDPR does not apply here (see above). There is no indication in the materials that the GDPR should have been adopted for the right of access.
- On the contrary: Art. 12 of the GDPR contains a general requirement to simplify the rights of data subjects. The ECJ has relied on this. Swiss data protection law does not contain an analogous provision.
- Art. 16 para. 4 GDPR does provide that the information must be provided “in an intelligible form”. However, it is clear from the explanatory report on the DPA that this requirement only relates to the format of the information (“If personal data is provided in a technical form, for example in a non-standard file format, which is not legible and/or understandable for the data subject, the controller must be able to provide additional explanations, for example orally”). No claim to the “contextualization” of the FADP can be derived from this (and the FADP does not contain any delegation for the introduction of a simplification requirement by the legislator).