As our colleague Martin Steiger (Steiger Legal), the Zurich municipal court issued a penalty order for violations of the DPA on June 10, 2024 (here you can find the original contribution by Martin Steiger and here the anonymized penalty order that Martin Steiger was able to obtain, with comments by him):
The municipal court judge had a willful violation of the duty to provide information recognized, but then refers to Art. 19 f. DSG, i.e. the provisions on the duty to provide information. Apparently, the information provided contained incorrect information about the origin of the personal data at the controller.
The buses were CHF 200 (plus costs of CHF 250), is therefore in the low range and far from the limit of CHF 5,000 for an entry in the criminal record (Art. 18 para. 1 lit. c StReG).
The penalty order makes it clear,
- that fines may indeed be imposed – as far as is known, this is the first fine under the revised DPA;
- that criminal law can be a weapon in the hands of the rightly or wrongly dissatisfied. Since the real consequences – costs, effort, burden – for the accused person and possibly their employer are considerably higher than the amount of the fine, it is worth being careful, especially when it comes to the interfaces with the persons concerned (especially information and disclosure);
- that even apparent ignorance of the DPA does not necessarily prevent the criminal authorities from imposing fines.