The SFAO processes personal data within the meaning of the FADP, even if certain reports are made anonymously. The data is stored internally at the SFAO and processed only by the responsible persons. During our investigations, we came to the conclusion that the SFAO operates a data collection. According to the FADP, federal bodies must register all data collections with the FDPIC and, in the case of the processing of personal data requiring special protection, draw up processing regulations. We recommended that the SFAO adapt its data processing in line with our comments. As our recommendations were not accepted, the procedure is still pending.
Source: FDPIC – Clarification of facts in the matter of whistleblowing