Law note · Switzerland
FADP Articles 43, 60-65, FDPIC Supervision and Criminal Sanctions in Switzerland
The FDPIC (Federal Data Protection and Information Commissioner) is the supervisory authority: it investigates on complaint or ex officio and can order a controller to start, change, suspend, or stop processing, or to delete or destroy data, and can compel appointment of a Swiss representative. It does not hold General Data Protection Regulation (GDPR)-style direct administrative fining power.
Criminal sanctions sit in Articles 60 to 65 FADP instead: up to CHF 250,000 against the individual responsible for a willful violation, prosecuted as an offense, with a CHF 50,000 fallback fine on the company itself only when the responsible individual cannot reasonably be identified within the business.
Private civil actions run in parallel and separately, through Article 32 FADP's direct civil-court route and the general Swiss Code of Obligations and Civil Code personality-rights provisions; a claimant must plead and prove quantifiable loss, there is no BIPA-style statutory per-violation damages figure.
What it asks of an app
- Expect the FDPIC to be able to order you to start, change, suspend, or stop processing, or to delete or destroy data, on complaint or its own initiative, rather than to fine you directly.
- Expect the individual responsible for a willful FADP violation to face criminal liability up to CHF 250,000, and expect a Swiss data subject to be able to sue you directly in civil court for a quantifiable loss under FADP Article 32 and the Code of Obligations.
When LexLint raises it
Declared activities: crawls_web, trains_models, generates_content, deploys_chatbot, automated_outreach, high_risk_decisions, processes_voice, processes_biometrics
Primary source: Fedlex, the Swiss Federal Council's official legislation portal