Bürgerforum Schweiz – €3,975 Fine (Switzerland, 2024)

Bürgerforum Schweiz, a civil association (the controller) launched a campaign called “Pfarrer-Check” on its website to publicly question church personnel (the data subjects) about their personal faith. A questionnaire was used to assess the theological views of these data subjects and published information about them in an online database. Data subjects received the questionnaire from the controller or third parties. The controller provided an online database contained data on about 6,000 data subjects. The database, accessible to anyone, contained personal details such as names, organizations, functions, postal codes, and response status. Specifically, each listed data subject was assigned a status: “recorded” (publicly known but not yet contacted), “requested” (contacted but no response or consent), or “answered” (responded and explicitly consented to publication). Nevertheless, thousands of names and response statuses without prior consent were included. There was no requirement in the questionnaire or on the website that third parties asked for consent before sharing personal data of the data subjects with the controller. Likewise, data subjects that received the questionnaire were not asked whether they agree to have their data or response status. The controller’s website hosted a general privacy policy that applies to all activities, not just Pfarrer-Check. The policy distinguished between public and non-public personal data, stating that public data could be used freely, while non-public data required explicit authorization. It granted a limited right to object, applying only to data subjects whose data were not publicly visible online. If the data subjects, whose addresses were publicly available, submitted a request to the controller to be deleted from the database, this request would not be granted. Based on inquiries from the controller as well as various reports from data subjects, the EDÖB, the Swiss DPA, was made aware of the launched campaign of the controller. The EDÖB instructed the controller to comply with requests for objection or deletion from affected data subjects whose data is publicly accessible elsewhere and to ensure explicit consent before any publication, but the controller refused deletion requests from data subjects whose publicly available addresses appeared in the Pfarrer-Check database, arguing that publication served an overriding public interest. Then, the DPA opened a formal investigation on December 11, 2023. The DPA held that the controller violated Article 6 of the Swiss data protection act (“DSG”) in several respects. The unsolicited publication of publicly available personal data combined with the status "recorded" in a publicly accessible database violates the principles of purpose limitation and recognizability. According to the principle of purpose limitation enshrined in [https://www.fedlex.admin.ch/eli/cc/2022/491/de Article 6 (3) DSG], personal data may only be processed in a manner that is compatible with the purpose for which the data was collected and which was apparent to the data subject. The DPA mentioned that [https://www.fedlex.admin.ch/eli/cc/2022/491/de Article 30(3) DSG], which presumes that there is no violation of privacy if the data subject has made the personal data generally accessible and has not expressly prohibited its processing, does not apply to this data. The data subjects concerned did not make this data accessible themselves, but merely tolerated its disclosure by third parties, namely the parish for which they work. The processing of this data therefore violates the principle of purpose limitation. Also, according to the principle of transparency enshrined in [https://www.fedlex.admin.ch/eli/cc/2022/491/de Article 6 (3) DSG], personal data may only be collected for a specific purpose that is recognizable to the data subject. The court argued that the controller obtained and published publicly available data before sending the "Pfarrer-Check" questionnaire to the data subjects concerned, violating the principle of recognizability. Moreover, the data processing carried out by the controller must comply with the principle of proportionality under Article 6(2) DSG. It must therefore be suitable and necessary for achieving the purpose of the processing and must be reasonable for the persons concerned. The court claimed that listing data subjects in the database with the status "recorded" or "requested" was not necessary for the processing purpose and was disproportionate. The aforementioned violation of data processing principles constitutes a violation of personal rights under [https://www.fedlex.admin.ch/eli/cc/2022/491/de Article 30(2) DSG] and the DPA held that there was no overriding private or public interest in disclosing the exact status of the request on a personal basis, nor was there any apparent overriding private or public interest that could justify a violation of the principles of purpose limitation or transparency, taking into consideration [https://www.fedlex.admin.ch/eli/cc/2022/491/de Article 19 and 20 DSG]. Accordingly, the controller was, from now then, prohibited from listing data subjects in the "Pfarrer-Check" database in combination with the status "recorded" or "requested" without valid consent and existing entries must be deleted unless legally valid consent obtained from the data subjects concerned. Also requests for deletion submitted by data subjects whose data have already been published elsewhere and who are listed in the "Pfarrer-Check" database with the status "recorded" or "requested" must be implemented. Finally , the controller was ordered to pay a fee of CHF 3,750(€3,900).