Inkasso-Team AG – €3,392 Fine (Switzerland, 2025)

In 2021, the DPA was first alerted to Inkasso-Team AG’s (the controller) activities after receiving a complaint from a person in Germany. This complaint, forwarded by the Bavarian DPA, indicated that the controller was publishing information on suspected debtors and persons associated with them on its website and was soliciting information on their whereabouts. On 9 September 2021, the Swiss DPA sent an initial notice to the controller, highlighting that such publication of personal data violates data protection regulations. The controller did not respond, later citing postal and email delivery issues during the company’s early operational months. Two years later, on 23 October 2023, and following the entry into force of the revised Swiss Federal Data Protection Act (FDPA), the Swiss DPA received another complaint via the Bavarian DPA, again raising concerns that the controller continued publishing personal data on its website. The investigation confirmed that the controller operated the website, which featured personal information including names, addresses, and other details of suspected debtors and associated persons, such as place of residence and alleged outstanding debts. In some cases, photos and videos of family members, including children, were also published. Based on these findings, the Swiss DPA formally opened an ex officio investigation on 3 September 2024. In its defence, the controller argued that it represented an overriding private interest for creditors or a public interest in combatting fraud. It claimed that all listed debtors were “confirmed” through legal titles or available documentation. The controller also offered to notify debtors in future or restrict website access through some form of user verification. The Swiss DPA found that the controller violated the principles of transparency by failing to inform the data subjects that it published their data on its website. The Swiss DPA further held that the controller violated the principle of proportionalityProportionality is a general principle of the Federal Data Protection Law (see Article 6(2)). because no overriding private or public interest justified the publication of such data. In particular, the DPA clarified that there is no private or public interest in publishing the personal data of debtors to determine their whereabouts or to warn the public about these persons. On these grounds, the Swiss DPA prohibited the publication of personal data of suspected debtors and associated individuals and ordered the erasure of all already published information. The Swiss DPA also fined the controller CHF 3,200 (€3,422). The controller appealed the decision to the Swiss Federal Administrative Court.