Liechtenstein

Commentary and the Datenschutzstelle's own materials describe the DSG as carrying breach-notification duties mirroring the General Data Protection Regulation (GDPR) structure, notifying the Datenschutzstelle without undue delay on a qualifying breach and notifying the individual where the breach presents a high risk. The specific timeline, whether it is GDPR's 72-hour figure or a different DSG-specific figure, was not independently confirmed against the DSG's own text.

Liechtenstein is not an EU member; it is an EEA/EFTA state, so the General Data Protection Regulation (GDPR) does not apply directly. GDPR was incorporated into the EEA Agreement by EEA Joint Committee Decision No. 154/2018, and Liechtenstein gave that incorporation domestic legal effect through its own Datenschutzgesetz (DSG), LGBl. 2018 Nr. 272, in effect 1 January 2019 together with the implementing Datenschutzverordnung (DSV) of 11 December 2018. The DSG, not the EU Regulation, is recorded here as the controlling instrument.

The Datenschutzstelle is Liechtenstein's national data protection authority. The DSG's own statutory text is not extractable from either channel located, gesetze.li serving a navigation-only page and the Datenschutzstelle's official English translation PDF an unparseable compressed structure, so article-level detail below rests on the Datenschutzstelle's own first-party glossary of GDPR-equivalent concepts, or is described only in general, structural terms.

The DSG carries its own transfer chapter, modeled on General Data Protection Regulation (GDPR) Chapter V, rather than being bound by the EU Regulation's Chapter V directly, since Liechtenstein is outside the EU.

Because Liechtenstein is inside the EEA and GDPR is incorporated EEA-wide, a transfer from Liechtenstein to an EU or EEA state is not a restricted cross-border transfer under this framework, by the same logic that intra-EU transfers are unrestricted under GDPR Chapter V itself; a transfer to a country outside the EEA is where the DSG's own adequacy, safeguards, or derogation mechanism engages. The DSG's own transfer-chapter article number and text were not independently confirmed against primary text.

Secondary commentary describes the DSG as giving individuals rights against a decision based solely on automated processing, including profiling, that produces a significant legal or similarly significant effect, mirroring General Data Protection Regulation (GDPR) Article 22, with certain exceptions for contractual or insurance purposes. This was not independently confirmed against the DSG's own text, since both attempts to access the DSG's own document failed to extract readable content.

The Datenschutzstelle enforces the DSG. One commentary source states violations may attract fines of up to 22 million Swiss francs or 4 percent of global annual turnover, a CHF-denominated figure tracking the General Data Protection Regulation (GDPR) EUR 20 million or 4 percent structure, since Liechtenstein uses the Swiss franc under its currency union with Switzerland rather than the euro; not independently confirmed against the DSG's own text.

By analogy to the GDPR Article 82 structure the DSG is modeled on, the DSG is expected to carry its own compensation provision for a data subject who suffers damage from a DSG infringement; the specific article number was not confirmed and this is recorded at medium confidence, by structural inference rather than a read of the provision itself. No Liechtenstein-specific collective-redress mechanism was identified.

Biometric identifiers are governed by the DSG's own special-category-data provisions, modeled on General Data Protection Regulation (GDPR) Article 9. The Datenschutzstelle's own published glossary of GDPR-equivalent concepts names both voice and images within the biometric-data concept it applies, and separately notes that voice is treated as a behavioral characteristic, with the specific technical processing method determining whether a given voice capture rises to the level of unique-identification biometric data.

This is the regulator's own restatement of the concept, not a quote from the DSG's own statutory Article 4 text, which could not be accessed directly; it is recorded at medium confidence for that reason. No Liechtenstein-specific voiceprint or faceprint case or regulatory guidance beyond this glossary entry was located.

Any person who gains access to a computer system, or part of one, that they may not use or may not use alone, by overcoming specific security precautions, is punished with up to six months' imprisonment or a fine of up to 360 daily rates, if the purpose is to obtain personal data protected by a confidentiality interest or to inflict a disadvantage on another person by using data or the system.

The penalty rises to up to two years for an act against a computer system that is part of critical infrastructure, and up to two or three years respectively where committed as part of a criminal group. Prosecution requires the authorization of the aggrieved party. The provision reaches unauthorized access achieved by circumventing a technical access control; it does not by its terms reach the collection of data made available without any security precaution to overcome.

Section 126a punishes a person who damages another by changing, deleting, or otherwise making unusable or suppressing data not at that person's sole disposal, with up to six months' imprisonment or a fine of up to 360 daily rates, rising to up to two years where the damage exceeds CHF 7,500, up to three years for compromising a large number of systems with a purpose-built tool, and six months to five years for damage exceeding CHF 300,000 or an act against critical infrastructure or by a criminal group.

Section 126b punishes serious interference with a computer system's functioning on the same escalating structure. Section 126c punishes developing, distributing, or possessing a computer program or password evidently created to commit any of these offenses, or the offense at § 118a, with up to six months' imprisonment or a fine of up to 360 daily rates, with a defense for a person who voluntarily prevents the tool's use.

An aggressive scraping or crawling operation that changes, deletes, or degrades data or a system it does not control, or that uses a purpose-built tool to compromise a large number of systems, is reached by this chapter.

Published works may be used without the rightsholder's authorization only for a closed list of privileged purposes: use within a personal or closely connected circle, illustration in teaching or non-commercial scientific research, photomechanical reproduction for teaching, research, or internal documentation in an institution, and non-commercial digital reproduction for teaching or research.

The article does not apply to computer programs, and it does not create a text-and-data-mining exception or a machine-readable opt-out mechanism of the kind EU Directive 2019/790 introduced; a use falling outside this closed list, including bulk reproduction of copyrighted text for commercial AI training or aggregation, requires the rightsholder's authorization under the general reproduction right (Art. 10).

The producer of a database that required a qualitatively or quantitatively substantial investment in obtaining, verifying, or presenting its contents has the right to prohibit the extraction or re-utilization of the whole, or a substantial part, of that database's contents (Art. 45), independent of any copyright in the database or its contents.

The right runs for 15 years from completion of the database (Art. 49), and belongs to a producer who is a national of, or habitually resident in, an EEA member state, or a company with a genuine link to one (Art. 46), reflecting the sui generis right's EEA-wide incorporation of EU Directive 96/9/EC.

A lawful user of a publicly available database may extract or re-utilize a non-substantial part without authorization for private use of a non-electronic database, for teaching or scientific research with attribution, or for public security or administrative or judicial proceedings (Art. 48).

Unauthorized extraction or re-utilization is a criminal offense on the aggrieved party's complaint, with up to one year's imprisonment or a fine of up to 360 daily rates, rising to up to three years for a commercial infringement (Art. 64).

Article 1 binds a public or private entity listed in Annex 1 or Annex 2 that qualifies as a medium or large company under Article 1064(2) or (3) of the Personen- und Gesellschaftsrecht (Persons and Companies Act) and provides its services or carries out its activities in Liechtenstein.

Article 4 requires such an essential or important entity to take appropriate and proportionate technical, operational and organisational measures to manage the risks to the security of the network and information systems it uses for its operations or to provide its services, and to prevent or minimise the impact of a security incident on the recipients of its services and on other services.

These measures must cover at least ten baseline categories mirroring NIS2 Article 21: risk analysis and information-system-security policy, incident handling, business continuity (including backup management and disaster recovery) and crisis management, supply-chain security, security in the acquisition, development and maintenance of systems including vulnerability management and disclosure, evaluating the measures' effectiveness, basic cyber-hygiene procedures and training, cryptography and encryption, personnel security and access control, and multi-factor or continuous authentication.

Article 5 requires the entity's leadership body (Leitungsorgan) to approve and oversee those measures and to attend, and offer its staff, regular training on recognising and assessing cybersecurity risk. Annex 2 Item 6 names an online-marketplace provider, an online-search-engine provider and a social-networking-platform provider among the digital-service providers this duty reaches expressly.

Article 6 requires an essential or important entity to notify the Stabsstelle Cyber-Sicherheit (Cyber Security Office) of a significant security incident without delay.

It requires an early warning within 24 hours of becoming aware of the incident, stating where relevant whether it is suspected to result from unlawful or malicious acts or to have cross-border effect, followed by a full notification within 72 hours that updates that assessment with the incident's severity, impact and any indicators of compromise.

An intermediate report is due on the Office's request, and a final report is due within one month of the 72-hour notification, describing the incident, its cause and its mitigation in detail. Annex 2 Item 6 names an online-marketplace provider, an online-search-engine provider and a social-networking-platform provider among the digital-service providers this duty reaches expressly.

A person who offers or presents a product or service, including a media product or service, that could endanger a minor's development or safety, and an entrepreneur who enables access to such a product or service, must take suitable and reasonable measures ensuring that minors of the relevant age group do not obtain access.

Audio-visual media products and services, in particular films and entertainment software, may only be offered to, or possessed and consumed by, a minor consistent with a minimum-age classification that a commercial provider must apply and clearly display, following reference-body recommendations designated by the Office for Social Services.

The Act's own general child-protection framework is expressly subordinate, for media specifically, to the media legislation's own child-protection provisions (the Mediengesetz above); it operates as the residual, non-media-specific duty for a product or service more broadly.

A video-sharing-platform provider, defined as a person who operates a video-sharing platform service, must take appropriate measures to protect minors from broadcasts, user-generated videos, and audiovisual commercial communication that could impair their physical, mental, or moral development.

It must also take appropriate measures to protect the general public from content whose dissemination is itself a criminal offense, including incitement to a terrorist act and child-pornography offenses under the Strafgesetzbuch. Disputes between users and a video-sharing-platform provider over compliance are mediated by Liechtenstein's regulatory authority (Art. 82d).

The Act's own enumerated list of administrative fines (Art. 93) does not separately name a breach of Art. 82c's protection duties themselves. The Act entered into force together with EEA Joint Committee Decision No. 337/2022 of 9 December 2022, without a further fixed commencement day stated in the consolidated text; it transposes Article 28b of Directive 2010/13/EU.

Article 27 permits quoting a published work where the quotation serves explanation, reference, or illustration and its length is justified by that purpose, with the quotation and its source named. Article 31(2) separately permits reproducing, distributing, broadcasting, or retransmitting a short excerpt from a press article or a radio or television report for the purpose of informing about current issues, with the excerpt and its source named.

Together these are the exceptions an aggregator's reproduction of a headline or short excerpt of third-party journalism would rely on; both are scoped to a defined purpose (illustration or explanation; informing about current issues) and a source-attribution duty, not a general license to republish.