Swiss FADP Article 34: Legal basis

1 Federal bodies may only process personal data if there is a statutory basis for doing so.

2 A statutory basis in a formal law is required in the following cases: (a) The matter involves the processing of sensitive personal data. (b) The matter involves profiling. (c) The purpose or manner of the data processing may lead to a serious violation of the data subject's fundamental rights.

3 A statutory basis in a substantive law is sufficient as the basis for processing personal data under paragraph 2 letters a and b provided the following requirements are satisfied: (a) Processing is essential for a task required by a formal law. (b) The purpose of processing poses no particular risks to the data subject's fundamental rights.

4 In derogation from the paragraphs 1 - 3, federal bodies may process personal data if any one one of the following requirements is satisfied: (a) The Federal Council has authorised the processing because it considers that the data subject's rights are not at risk. (b) The data subject has consented to the processing in the specific case or has made their personal data generally accessible and has not explicitly prohibited any processing. (c) The processing is necessary in order to protect the life or physical integrity of the data subject or of a third party, and it is not possible to obtain the consent of the data subject within a reasonable time.