SwitzerlandFADP Article 5 lit. c, Sensitive Personal Data Including Biometric Data
In force since .
A sensitive categories rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- Audit expectation
- none
What it requires
- Obtain express, affirmative consent, opt-in rather than opt-out, before creating a voiceprint or other biometric identifier from a person in Switzerland, or establish another Article 6 basis for the processing.NIST Privacy FrameworkCT.PO-P1
- Perform a Data Protection Impact Assessment before large-scale processing of biometric or other sensitive personal data, or before systematic large-scale public-space monitoring, under FADP Article 22.NIST Privacy FrameworkID.RA-P4
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does a voiceprint or faceprint created to authenticate or recognize a person count as "biometric data that uniquely identifies a natural person" under Article 5 letter c number 4 of the Federal Act on Data Protection?
What it makes you log
Logging duty
Articles 5 lit. c, 6 paragraph 7 and 22 define sensitive personal data, set explicit consent for processing it, and require a data protection impact assessment before high-risk processing. The assessment is a one-time document the controller prepares before processing; the Act sets no duty to keep, log or produce it. The two-year retention of the assessment is Article 14 of the Ordinance on Data Protection (SR 235.11), which this row does not cite.
- Kind
- None
- As of
What this law does
Article 5 lit. c FADP defines sensitive personal data as a closed list: data on religious, philosophical, political or trade union views and activities; health data; data on the intimate sphere or racial or ethnic origin; genetic data; biometric data that uniquely identifies a natural person; data on administrative or criminal proceedings and sanctions; and data on social assistance measures. Genetic and biometric data are the two categories the 2023 revision added.
A controller relying on consent for sensitive personal data needs express consent under Article 6 para. 7, and large-scale processing of sensitive personal data or systematic large-scale public-space monitoring triggers a mandatory Data Protection Impact Assessment under Article 22.
There is no dedicated Swiss biometric statute and no statutory biometric-specific retention or destruction schedule; retention is governed by the FADP's general proportionality and storage-limitation principle, Article 6 para. 3-4: keep only as long as the purpose requires, then delete or anonymize.
The controlling recent authority is a live FDPIC enforcement action rather than a statute amendment: on the FDPIC concluded its investigation into PostFinance's voice-recognition system and found the processing violated the proportionality principle because voiceprints were being created on an opt-out basis rather than opt-in.
The FDPIC ordered PostFinance to obtain explicit, affirmative consent before creating a voiceprint and to delete every voiceprint created without it, with a compliance deadline of . PostFinance has appealed to the Federal Administrative Court, and the outcome of that appeal is not established; the FDPIC's order is treated as its currently stated position, not as final.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .