Swiss FADP Article 20: Exceptions from the duty to provide information and restrictions

1 The duty to provide information under Article 19 ceases to apply if one of the following requirements is satisfied: (a) The data subject already has the information concerned. (b) The processing is required by law. (c) The controller is a private person who is required by law to preserve confidentiality. (d) The requirements of Article 27 are satisfied.

2 If the personal data is not collected from the data subject, the duty to provide information also ceases to apply if any one of the following requirements is satisfied: (a) It is not possible to provide the information. (b) Providing the information requires disproportionate effort.

3 The controller may restrict, delay or dispense with the provision of the information in the following cases: (a) It is required to do so because of overriding third party interests. (b) Providing the information defeats the purpose of the processing. (c) The controller is a private person and the following requirements are satisfied: 1. The controller is required to do so because of its own overriding interests. (2) The controller does not intend to disclose the personal data to third parties. (d) The controller is a federal body and any one of the following requirements is satisfied: 1. The measure is required to satisfy overriding public interests, in particular to protect Switzerland's internal or external security. (2) The communication of the information may compromise an enquiry, an investigation or administrative or judicial proceedings.

4 Legal entities that belong to the same group of companies are not third parties within the meaning of paragraph 3 letter c number 2.