Notes · AI, data and rules
In Switzerland, the data protection fine does not hit the company. It hits a person.
The Swiss Federal Act on Data Protection punishes intentional breaches with fines of up to CHF 250,000, prosecuted by the cantons. Who is targeted, when the company steps in, and what this has to do with your contact form and your team’s tools.
Picture this: someone on your clinic’s team in Zurich finds a handy online tool that summarises and answers enquiries from the contact form. She sets it up in an afternoon without asking anyone. Nobody signs a contract with the provider. For months, patient enquiries have been flowing through a system nobody in management knows about.
Data protection makes most people think of the GDPR and fines in the millions against large groups. Swiss law works differently. It is aimed first at people, and that is exactly why this tool belongs on the management table.
What the law says.
Articles 60 to 63 of the Federal Act on Data Protection set fines of up to CHF 250,000 for “private persons”. Liable is anyone who intentionally gives false or incomplete information, or intentionally fails to inform people when collecting their data. So is anyone who intentionally discloses data abroad without the conditions being met, hands processing to a processor without meeting the conditions of Article 9, or fails to meet the minimum data security requirements. On top of that come the intentional disclosure of secret personal data learned in the course of a profession, and ignoring a ruling of the Federal Data Protection and Information Commissioner.
Most of these offences are prosecuted only on complaint, for example when an affected person files a criminal complaint. Prosecution is a matter for the cantons, not the Commissioner, who can however report offences and act as a private claimant in the proceedings. The limitation period for prosecution is five years.
And the company?
The company pays only by exception. Under Article 64, the authority may convict the business instead of the responsible individuals when the fine in question is no more than CHF 50,000 and identifying those individuals would require disproportionate investigation. Otherwise the rules of administrative criminal law apply, and it is the natural persons who acted who are punished.
The open-access commentary on Article 64 uses the opening scene as its example. An employee who, without authorisation, uses an online provider’s tool that processes personal data, and does not make sure a sufficient processing agreement is in place, may be liable under Article 61. The article also introduces a form of liability for the person in charge: in some cases, a superior who could have prevented the offence may be liable too. How far that reaches for offences that require intent is disputed, according to the commentary.
The blind spot: intent.
Only intent is punishable. That sounds reassuring. But under the general definition in the Swiss Criminal Code, a person already acts with intent if they consider the offence possible and accept that it may happen. I am not a lawyer and I do not assess individual cases. But I would not rely on “we didn’t know” once someone on the team has raised the problem and nothing has happened.
This is exactly where data protection meets digital tools. Every form, chat, automation and AI tool your team sets up on its own is a data processing operation, with a provider, a location and a contract, or none. The question is not whether your team uses such tools. The question is whether anyone knows which ones.
Someone sets the tool up in an afternoon. The responsibility stays with people.
Where I stand.
I do not believe in banning tools. Teams that want to work faster find them anyway. Instead, I would make sure every tool that touches personal data comes in through one checked route, with a contract, a processing location and a named owner. A register of tools protects your team better than any ban.
What I would check.
- The register of tools. Every system that receives data from the website, a form, a chat or email, with provider, location and responsible person.
- The contracts. For every provider, a processing agreement that meets the requirements of Article 9.
- The privacy notice. Who you are, why you process the data and who you pass it to, as Article 19 requires.
- The route for new tools. A simple rule for how staff propose a tool and who approves it.
- Access requests. Who answers a request from an affected person, completely and as a rule within 30 days.
Where to start.
- This week
Ask the team
Which online tools each person uses day to day, without blame, so you get a complete list.
- This month
Clarify contracts and locations
For each tool, check the contract, where processing happens and any disclosure abroad.
- This quarter
Set the approval route
One responsible person, a short checklist and a response time, so nobody looks for shortcuts.
- Every year
Review
Tools, contracts and privacy notice, with your legal adviser.
Write down the name of the person in your business who approved the last tool that processes customer data. Now ask yourself whether that person knows that, in Switzerland, the fine could carry their name rather than the company’s.
And if nobody approved it, because someone simply installed it, the question becomes more interesting: who answers for a decision nobody made?
If you would like me to review where the data from your website and your automations goes today, start with the Strategic Diagnostic. Whether your case carries a criminal risk is for your legal adviser to assess, not a designer.