LiechtensteinDSG Datenschutzstelle Enforcement in Liechtenstein
Datenschutzgesetz (DSG), LGBl. 2018 Nr. 272, Articles 10, 40 to 42 and 44
In force since .
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance
- Audit expectation
- none
What it requires
- Compensate any person who suffers material or immaterial damage through your violation of the General Data Protection Regulation (GDPR) or of Chapter I or II of the DSG, whether you are the controller or the processor.
- Do not obtain, without authority, personal data that is not freely accessible from a data processing system.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
DSG Art. 41 (Unlawful gathering of personal data): a data subject may request the district court (Landgericht) to prosecute the unlawful gathering of personal data that was not freely available, punishable by up to 6 months imprisonment or a fine up to 360 daily rates. Art. 42 (Violation of data secrecy): deliberately giving access to, publishing or processing secret personal data by a person who had professional access to it is punishable, upon the data subject's request, by up to 6 months imprisonment or a fine up to 360 daily rates, rising to up to 1 year imprisonment or a fine up to 360 daily rates where committed for pecuniary advantage or to inflict considerable disadvantage on a person; this remains punishable after the end of the employment or educational relationship that gave access to the data.
Penalty structure
DSG Art. 40 ('Penal provisions', D. Penal provisions, Violations according to Regulation (EU) 2016/679), confirmed against the Datenschutzstelle's own official English translation: two tiers mirroring GDPR Art. 83(4)-(6): up to CHF 11,000,000 or 2% of total worldwide annual turnover (Art. 83(4) cases), and up to CHF 22,000,000 or 4% of total worldwide annual turnover (Art. 83(5)-(6) cases), whichever higher in each tier. Art. 40(7): authorities and other public bodies are not subject to any administrative fines.
- Rule
- Higher of
- As of
- Currency
- CHF
- Fixed cap
- 22,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Datenschutzstelle (Data Protection Authority), Liechtenstein's independent supervisory authority under the DSG.
Enforcement record
Datenschutzstelle's own Tätigkeitsbericht 2024 (Activity Report 2024), section 5.2.1: in 2024 the DSS received 50 complaints in total (48 from private individuals directly, roughly 11% more than the prior year), and imposed fines (Geldbussen) totalling CHF 21,500 for 3 serious violations: two for failing to implement measures the DSS had already ordered by prior decision, and one for inadequate security measures leading to negligent disclosure of health data. The report also notes the DSS's own current staffing is insufficient for comprehensive ex-officio company audits, so investigations proceed mainly on tips or complaints; 8 organizations received cause-based investigations that year. The 3 fine-imposing decisions, not the 50 complaints received, are the public enforcement actions, since fines are the closer match; the complaint count is the broader intake figure.
- As of
- Currency
- CHF
- Source link
- https://www.datenschutzstelle.li/download_file/view/ab510423-ec1a-4c29-8d0d-ed61d80893ec/299
- Fines per year
- 21,500
- Actions per year
- 3
Settledness
- As of
- Open questions
- Which Liechtenstein rules on the extent of financial compensation fix the amount payable for non-material damage under Article 82 of Regulation (EU) 2016/679, given that Article 44 of the Datenschutzgesetz applies the general provisions of the Civil Code to that right and the Court of Justice in Case C-300/21 leaves the extent of compensation to the domestic rules of each Member State?
What it makes you log
Logging duty
Article 10 makes the Datenschutzstelle competent to supervise processing by public and non-public bodies, Articles 40 and 44 set the fines and damages, and Article 41 makes unauthorized access to data an offence. None of the cited articles makes anyone keep or produce a record, and none gives the Datenschutzstelle a power to demand information, so no on-request audit is coded; the information duties of the Chapter III bodies are in sections this row does not cite. The cited articles state no scope clause of their own, so no territorial hook is coded.
- Kind
- None
- As of
What this law does
The Datenschutzstelle is responsible for supervising processing by public and non-public bodies (Article 10 of the DSG).
It fines a violation of the General Data Protection Regulation (GDPR), including a negligent one, at up to 11 million francs or, for a legal person, up to 2 percent of its total worldwide annual turnover of the preceding financial year, whichever is higher, in cases under Article 83(4) of the GDPR, and at up to 22 million francs or up to 4 percent, whichever is higher, in cases under Article 83(5) and (6) of the GDPR (Article 40 of the DSG). No fines are imposed on authorities and other public bodies.
A person who has suffered material or immaterial damage through a violation of the GDPR or of Chapter I or II of the DSG is entitled to damages from the controller or the processor under Article 82 of the GDPR (Article 44 of the DSG).
Obtaining without authority personal data that is not freely accessible from a data processing system is an offense, prosecuted before the Landgericht at the injured party's request and punishable by imprisonment of up to six months or a fine of up to 360 daily rates (Article 41 of the DSG).
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .