Federal Act
on the Surveillance of Post and Telecommunications
(SPTA)

¹ This Act ap­plies to the sur­veil­lance of post and tele­com­mu­nic­a­tions ordered and car­ried out:

a.

in the course of crim­in­al pro­ceed­ings;

b.

in ex­e­cu­tion of a re­quest for mu­tu­al leg­al as­sist­ance;

c.

in the search for miss­ing per­sons;

d.

in tra­cing per­sons on whom a cus­todi­al sen­tence or cus­todi­al meas­ure has been im­posed;

e.³

with­in the scope of the In­tel­li­gence Ser­vice Act of 25 Septem­ber 2015⁴ (In­telSA);

f.⁵

in the course of mo­bile phone loc­al­isa­tion in ac­cord­ance with the Fed­er­al Act of 21 March 1997⁶ on Meas­ures to Safe­guard In­tern­al Se­cur­ity (ISA).

² For in­form­a­tion on pay­ment trans­ac­tions sub­ject to the Postal Ser­vices Act of 17 Decem­ber 2010⁷ (PostA), the pro­vi­sions on the du­ties to testi­fy and to provide in­form­a­tion to an au­thor­ity ap­ply.

This Act es­tab­lishes du­ties to co­oper­ate for the fol­low­ing per­sons and en­tit­ies (en­tit­ies ob­liged to co­oper­ate):

a.

pro­viders of postal ser­vices un­der the PostA⁸;

b.

pro­viders of tele­com­mu­nic­a­tions ser­vices un­der Art­icle 3 let­ter b of the Tele­com­mu­nic­a­tions Act of 30 April 1997⁹ (TCA);

c.

pro­viders of ser­vices which are based on tele­com­mu­nic­a­tions ser­vices and en­able one-way or mul­tipath com­mu­nic­a­tion (pro­viders of de­rived com­mu­nic­a­tions ser­vices);

d.

op­er­at­ors of in­tern­al tele­com­mu­nic­a­tions net­works;

e.

per­sons who grant third parties ac­cess to a pub­lic tele­com­mu­nic­a­tions;

f.

pro­fes­sion­al re­tail­ers of cards and sim­il­ar means which per­mit ac­cess to a pub­lic tele­com­mu­nic­a­tions net­work.

¹ The Con­fed­er­a­tion shall op­er­ate a ser­vice for the sur­veil­lance of post and tele­com­mu­nic­a­tions un­der Art­icle 269 of the Swiss Crim­in­al Pro­ced­ure Code¹⁰ (Crim­PC) (the Ser­vice).

² The Ser­vice shall per­form its tasks autonom­ously. It is not sub­ject to in­struc­tions and is only ad­min­is­trat­ively as­signed to the Fed­er­al De­part­ment of Justice and Po­lice (FD­JP).

³ The li­cens­ing and su­per­vis­ory au­thor­it­ies re­spons­ible for mat­ters of post and tele­com­mu­nic­a­tions, the pro­sec­u­tion au­thor­it­ies and the Ser­vice work to­geth­er in its area of re­spons­ib­il­ity.

The Ser­vice, the or­der­ing au­thor­it­ies, the ap­prov­ing au­thor­it­ies and the pro­viders of postal and tele­com­mu­nic­a­tions ser­vices may pro­cess the per­son­al data, in­clud­ing sens­it­ive per­son­al data and per­son­al­ity pro­files, that they need to or­der, ap­prove and carry out sur­veil­lance.

¹ The FD­JP may set up an ad­vis­ory body com­pris­ing rep­res­ent­at­ives of the FD­JP, the Ser­vice, the can­tons, the pro­sec­u­tion au­thor­it­ies, the Fed­er­al In­tel­li­gence Ser­vice (FIS) and the pro­viders of postal and tele­com­mu­nic­a­tions ser­vices.¹¹

² The ad­vis­ory body shall fa­cil­it­ate an ex­change of ex­per­i­ences and opin­ions between the rep­res­ent­at­ives re­ferred to in para­graph 1. It shall ex­am­ine re­vi­sions to this Act and the im­ple­ment­ing pro­vi­sions and changes in of­fi­cial prac­tice in or­der to pro­mote the prop­er con­duct of sur­veil­lance and con­tinu­ous fur­ther de­vel­op­ment in this area. It shall ex­press its opin­ion on draft re­vi­sions and may make re­com­mend­a­tions on its own ini­ti­at­ive.

³ The FD­JP shall reg­u­late the com­pos­i­tion and or­gan­isa­tion of the ad­vis­ory body and the pro­ced­ures it has to fol­low.

The Ser­vice shall op­er­ate an in­form­a­tion sys­tem for pro­cessing the data arising from tele­com­mu­nic­a­tions sur­veil­lance un­der Art­icle 1 para­graph 1 (the pro­cessing sys­tem).

The pro­cessing sys­tem serves to:

a.

re­ceive the data col­lec­ted by tele­com­mu­nic­a­tions sur­veil­lance and make it avail­able to the au­thor­ised au­thor­it­ies;

b.

main­tain over an ex­ten­ded peri­od the legib­il­ity and se­cur­ity of the data col­lec­ted by tele­com­mu­nic­a­tions sur­veil­lance;

c.

provide in­form­a­tion on ac­cess to tele­com­mu­nic­a­tions ser­vices;

d.¹²

of­fer pro­cessing func­tions for the data stored in the sys­tem, in­clud­ing ana­lys­is func­tions such as visu­al­isa­tion, alert­ing or speak­er re­cog­ni­tion;

e.

sup­port busi­ness pro­cessing and con­trols.

The pro­cessing sys­tem holds:

a.

the con­tent of com­mu­nic­a­tions to and from the per­son un­der sur­veil­lance;

b.

the data that in­dic­ates with whom, when, for how long, and from where the per­son un­der sur­veil­lance is or has been com­mu­nic­at­ing, as well as the tech­nic­al char­ac­ter­ist­ics of the com­mu­nic­a­tion con­cerned (sec­ond­ary tele­com­mu­nic­a­tions data);

c.

in­form­a­tion on tele­com­mu­nic­a­tions ser­vices;

d.¹³

the data, in par­tic­u­lar the per­son­al data, re­quired by the Ser­vice for busi­ness pro­cessing and con­trol and for pro­cessing func­tions;

e.¹⁴

res­ults from the pro­cessing of data that is col­lec­ted dur­ing tele­com­mu­nic­a­tions sur­veil­lance un­der this Act, in­clud­ing ana­lys­is such as visu­al­isa­tion, alert­ing or speak­er re­cog­ni­tion.

¹ The Ser­vice shall grant on­line ac­cess to the data col­lec­ted in the pro­ceed­ings in ques­tion to the au­thor­ity that ordered sur­veil­lance or which later dir­ects the pro­ceed­ings and to the per­sons des­ig­nated by that au­thor­ity.

² The au­thor­ity re­ferred to in para­graph 1 and the per­sons it des­ig­nates shall have ac­cess to such data for as long as the au­thor­ity is re­spons­ible for the pro­ceed­ings.

³ If the au­thor­ity trans­fers the pro­ceed­ings to a dif­fer­ent au­thor­ity, or if it con­cludes the pro­ceed­ings, it shall no­ti­fy the Ser­vice. It shall no­ti­fy the Ser­vice of the new au­thor­ity that is re­spons­ible for the pro­ceed­ings.

⁴ The data col­lec­ted by sur­veil­lance shall be sent by post to the au­thor­ity at its re­quest, if pos­sible in en­cryp­ted form, by means of data car­ri­ers or doc­u­ments, if:

a.

it is in­ten­ded to trans­mit the data to a for­eign au­thor­ity in an in­ter­na­tion­al mu­tu­al leg­al as­sist­ance pro­ced­ure; or

b.

on­line ac­cess is not pos­sible for tech­nic­al reas­ons.

¹ In the case of data col­lec­ted in the course of crim­in­al pro­ceed­ings or in con­nec­tion with the ex­e­cu­tion of a re­quest for mu­tu­al leg­al as­sist­ance:

a.

the right to in­spect case doc­u­ments and the right to in­form­a­tion in pending pro­ceed­ings is gov­erned by the ap­plic­able pro­ced­ur­al law;

b.

the right to in­form­a­tion after the con­clu­sion of the pro­ceed­ings is gov­erned by the Fed­er­al Act of 19 June 1992¹⁵ on Data Pro­tec­tion (FADP) if a fed­er­al au­thor­ity is deal­ing with the re­quest for mu­tu­al leg­al as­sist­ance, or by can­ton­al law if a can­ton­al au­thor­ity is deal­ing with it.

²The right to in­form­a­tion on the data col­lec­ted in the search for miss­ing per­sons or tra­cing con­victed per­sons is gov­erned by the FADP if a fed­er­al au­thor­ity is re­spons­ible for the search or for tra­cing, or by can­ton­al law if a can­ton­al au­thor­ity is re­spons­ible for it. Art­icle 279 Crim­PC¹⁶ ap­plies mu­tatis mutandis.

^2bis The right to in­form­a­tion on the data col­lec­ted in im­ple­ment­ing the In­telSA¹⁷ is gov­erned by the In­telSA.¹⁸

^2ter The right to in­form­a­tion about data that is col­lec­ted in the course of mo­bile phone loc­al­isa­tion in ac­cord­ance with Art­icle 23q para­graph 3 ISA¹⁹ is gov­erned by the FDAP where a fed­er­al au­thor­ity is deal­ing with the sur­veil­lance, or by can­ton­al law where a can­ton­al au­thor­ity is deal­ing with it.²⁰

³The per­son af­fected by sur­veil­lance may as­sert his or her rights against the au­thor­ity re­spons­ible for the pro­ceed­ings or, if there is no au­thor­ity that is still re­spons­ible for the pro­ceed­ings, against the last au­thor­ity re­spons­ible. The Ser­vice is not re­spons­ible for provid­ing the in­form­a­tion.

⁴ The Fed­er­al Coun­cil shall reg­u­late the man­ner in which these rights are gran­ted. In do­ing so, it shall guar­an­tee the rights of the parties con­cerned, in par­tic­u­lar in cases where mak­ing cop­ies of the case files is im­possible or only pos­sible with dis­pro­por­tion­ate ef­fort.

¹ The length of time that data col­lec­ted in crim­in­al pro­ceed­ings must be re­tained in the pro­cessing sys­tem is gov­erned by the rules on crim­in­al case files un­der the ap­plic­able crim­in­al pro­ced­ur­al law.

² The data col­lec­ted in ex­e­cu­tion of a re­quest for mu­tu­al leg­al as­sist­ance shall be re­tained in the pro­cessing sys­tem for as long as ne­ces­sary for the ob­ject­ive pur­sued, but no longer than 30 years after con­clu­sion of sur­veil­lance.

³ The data col­lec­ted as part of the search for a miss­ing per­son shall be re­tained in the pro­cessing sys­tem for as long as ne­ces­sary for the ob­ject­ive pur­sued, but no longer than 30 years after con­clu­sion of sur­veil­lance.

⁴ The length of time that data col­lec­ted in tra­cing a per­son on whom a cus­todi­al sen­tence has been im­posed must be re­tained in the pro­cessing sys­tem is gov­erned by the ap­plic­able crim­in­al pro­ced­ur­al law. Data col­lec­ted in tra­cing a per­son on whom a cus­todi­al meas­ure has been im­posed must be re­tained in the pro­cessing sys­tem for as long as ne­ces­sary for the ob­ject­ive pur­sued, but no longer than 30 years after con­clu­sion of sur­veil­lance.

^4bisThe data col­lec­ted in im­ple­ment­ing the In­telSA²¹ shall be re­tained in the pro­cessing sys­tem for as long as ne­ces­sary for the ob­ject­ive pur­sued, but no longer than 30 years after con­clu­sion of sur­veil­lance.²²

^4ter The data col­lec­ted in the course of mo­bile phone loc­al­isa­tion in ac­cord­ance with Art­icle 23q para­graph 3 ISA²³ shall be re­tained in the pro­cessing sys­tem after con­clu­sion of sur­veil­lance for a max­im­um of 100 days. If there is a spe­cif­ic reas­on to as­sume that the data will be re­quired in crim­in­al pro­ceed­ings, the re­ten­tion peri­od is gov­erned by the ap­plic­able rules of crim­in­al pro­ced­ure.²⁴

⁵ The au­thor­ity re­spons­ible for the pro­ceed­ings or, if if there is no au­thor­ity that is still re­spons­ible for the pro­ceed­ings any longer, the last au­thor­ity re­spons­ible is re­spons­ible for com­pli­ance with the peri­ods laid down in para­graphs 1–4^ter.²⁵ It shall in­form the Ser­vice be­fore ex­piry of the re­ten­tion peri­od as to what is to be done with the data un­der the ap­plic­able law pri­or to its de­le­tion from the sys­tem. Thirty years after con­clu­sion of sur­veil­lance, the Ser­vice shall re­quest the au­thor­ity to cla­ri­fy what is to be done with the data still avail­able in the sys­tem.

⁶ The Fed­er­al Coun­cil shall spe­cify how com­pli­ance with the re­ten­tion peri­ods is to be guar­an­teed; it shall reg­u­late the de­tails of the in­form­a­tion ac­cord­ing to para­graph 5.

¹ The Ser­vice is re­spons­ible for the se­cur­ity of the pro­cessing sys­tem.

² The Fed­er­al Coun­cil shall is­sue reg­u­la­tions on tech­nic­al and or­gan­isa­tion­al pro­tec­tion meas­ures, in par­tic­u­lar against the un­in­ten­tion­al or un­au­thor­ised ac­cess to data and the un­in­ten­tion­al or un­au­thor­ised modi­fic­a­tion, dis­sem­in­a­tion or de­struc­tion of data.

³ When de­liv­er­ing the data col­lec­ted by sur­veil­lance, the en­tit­ies ob­liged to co­oper­ate are re­spons­ible for data se­cur­ity up to the point at which the Ser­vice re­ceives the data. They shall fol­low the in­struc­tions of the Ser­vice re­gard­ing data se­cur­ity.

The au­thor­it­ies with ac­cess to the pro­cessing sys­tem un­der Art­icle 9 are deemed to be the con­trol­ler of the data file in the case of data from sur­veil­lance meas­ures with­in their area of re­spons­ib­il­ity.

¹ The data con­tained in the pro­cessing sys­tem may be copied to the in­form­a­tion sys­tems re­ferred to in Art­icles 10, 12 and 13 of the Fed­er­al Act of 13 June 2008²⁶ on the Fed­er­al Po­lice In­form­a­tion Sys­tems (FPISA) us­ing the on­line ac­cess, provided:

a.

the ap­plic­able law al­lows data pro­cessing in these sys­tems; and

b.

it is en­sured that only those per­sons re­spons­ible for the rel­ev­ant pro­ceed­ings have ac­cess to the data.

² The data may only be trans­mit­ted by a per­son who has ac­cess rights to the pro­cessing sys­tem pur­su­ant to this Act and to the rel­ev­ant in­form­a­tion sys­tem pur­su­ant to the FPISA.

¹ The data con­tained in the pro­cessing sys­temmay be copied to the in­form­a­tion sys­tem re­ferred to in Art­icle 58 In­telSA²⁸ us­ing the on­line ac­cess, provided:

a.

the ap­plic­able law al­lows data pro­cessing in this sys­tem; and

b.

it is en­sured that only the per­sons re­spons­ible for the rel­ev­ant sur­veil­lance meas­ure have ac­cess to the data.

² The trans­mis­sion may only be ini­ti­ated by a per­son who has ac­cess rights to the pro­cessing sys­tempur­su­ant to this Act and to the rel­ev­ant in­form­a­tion sys­tem pur­su­ant to the In­telSA.

¹The Ser­vice shall provide only the fol­low­ing au­thor­it­ies with in­form­a­tion on the data re­ferred to in Art­icles 21 and 22, on re­quest and only for the fol­low­ing pur­poses:

a.

the fed­er­al and can­ton­al au­thor­it­ies that have the right to or­der or ap­prove tele­com­mu­nic­a­tions sur­veil­lance, or the au­thor­it­ies des­ig­nated by them: for the pur­pose of de­term­in­ing the ser­vices and per­sons to be placed un­der sur­veil­lance and the per­sons com­mu­nic­at­ing with them;

b.

the Fed­er­al Of­fice of Po­lice and the can­ton­al and com­mun­al po­lice au­thor­it­ies: for the pur­pose of car­ry­ing out po­lice du­ties;

c.

the com­pet­ent fed­er­al and can­ton­al au­thor­it­ies: for the pur­pose of pro­cessing cases un­der ad­min­is­trat­ive crim­in­al law;

d.²⁹

the FIS: for the pur­pose of ful­filling tasks un­der the In­telSA³⁰.

² Fur­ther­more, pur­su­ant to Art­icles 10 para­graph 3 and 23 of the Fed­er­al Act of 19 Decem­ber 1986³¹ on Un­fair Com­pet­i­tion (UCA), the Ser­vice shall also provide the com­pet­ent fed­er­al au­thor­ity on re­quest with in­form­a­tion on the data re­ferred to in Art­icle 21 in or­der that the au­thor­ity may file a crim­in­al com­plaint of un­fair com­pet­i­tion pur­su­ant to Art­icle 3 para­graph 1 let­ter u UCA.³²

In re­la­tion to sur­veil­lance of post and tele­com­mu­nic­a­tions, the Ser­vice has the fol­low­ing gen­er­al tasks:

a.

It shall con­tact the or­der­ing au­thor­ity and the ap­prov­ing au­thor­ity im­me­di­ately be­fore post or in­form­a­tion is passed on to the or­der­ing au­thor­ity if, in its opin­ion, the sur­veil­lance or­der:

1.

in the case of sur­veil­lance in the course of crim­in­al pro­ceed­ings, does not con­cern a crim­in­al of­fence for which sur­veil­lance is per­mit­ted un­der the ap­plic­able law;

2.³³

has not been is­sued by the com­pet­ent au­thor­ity or, pur­su­ant to Art­icles 29–31 In­telSA³⁴, has not been ap­proved and gran­ted per­mis­sion to pro­ceed; or

3.

is in­com­plete or un­clear.

b.

It shall con­tact the or­der­ing au­thor­ity and the ap­prov­ing au­thor­ity im­me­di­ately if, in its opin­ion, the sur­veil­lance is tech­nic­ally in­ap­pro­pri­ate, does not cor­res­pond to the sur­veil­lance types provided for by law or in the im­ple­ment­ing pro­vi­sions or is not tech­nic­ally feas­ible.

c.

It shall provide the com­pet­ent au­thor­ity with the in­form­a­tion re­quired to or­der sur­veil­lance; if ne­ces­sary, it shall re­quest the en­tit­ies ob­liged to co­oper­ate to provide it with this in­form­a­tion.

d.

It shall in­struct the en­tit­ies ob­liged to co­oper­ate on how to carry out the sur­veil­lance, re­quest them to take the ne­ces­sary meas­ures for the sur­veil­lance and su­per­vise the im­ple­ment­a­tion of the sur­veil­lance.

e.

It shall im­ple­ment the meas­ures ordered by the ap­prov­ing au­thor­ity to pro­tect pro­fes­sion­al secrecy.

f.

It shall check wheth­er sur­veil­lance ex­tends bey­ond the ap­proved peri­od and ter­min­ate it at the end of the peri­od if it has not been sent a copy of the re­new­al ap­plic­a­tion.

g.

It shall no­ti­fy the ap­prov­ing au­thor­ity im­me­di­ately of the ter­min­a­tion of sur­veil­lance.

h.

It shall fol­low the tech­nic­al de­vel­op­ments in re­la­tion to postal and tele­com­mu­nic­a­tions ser­vices.

i.

It shall or­gan­ise and carry out train­ing for per­sons who are al­lowed to ac­cess the pro­cessing sys­tem.

j.

It may, on re­quest, ad­vise au­thor­it­ies and en­tit­ies ob­liged to co­oper­ate on tech­nic­al, leg­al and op­er­a­tion­al as­pects of sur­veil­lance of post and tele­com­mu­nic­a­tions.

k.

It shall pro­duce stat­ist­ics on sur­veil­lance.

In re­la­tion to tele­com­mu­nic­a­tions sur­veil­lance, the Ser­vice has the fol­low­ing ad­di­tion­al tasks:

a.

If sev­er­al pro­viders of tele­com­mu­nic­a­tions ser­vices are in­volved in provid­ing the tele­com­mu­nic­a­tions ser­vice to be placed un­der sur­veil­lance, the Ser­vice shall in­struct the pro­vider re­spons­ible for the ad­min­is­tra­tion of the tele­com­mu­nic­a­tions ser­vice or the pro­vider that can con­duct the sur­veil­lance with the least tech­nic­al ef­fort to carry out the sur­veil­lance. The Ser­vice shall base its in­struc­tions on the in­form­a­tion provided by the au­thor­ity that ordered the sur­veil­lance.

b.

It shall re­ceive the trans­mit­ted tele­com­mu­nic­a­tions of the per­son un­der sur­veil­lance from the pro­viders of tele­com­mu­nic­a­tions ser­vices, store them and al­low the or­der­ing au­thor­ity or the au­thor­ity des­ig­nated by the or­der­ing au­thor­ity to have ac­cess thereto.

c.

It shall in­struct the pro­viders of tele­com­mu­nic­a­tions ser­vices to trans­mit data col­lec­ted in the course of sur­veil­lance dir­ectly to the or­der­ing au­thor­ity (dir­ect trans­mis­sion) or the au­thor­ity des­ig­nated by the or­der­ing au­thor­ity if, for tech­nic­al reas­ons, it is not able to re­ceive the tele­com­mu­nic­a­tions, to store them or to give ac­cess to these au­thor­it­ies; in such an event, these au­thor­it­ies shall store the data them­selves.

d.

It shall re­ceive the sec­ond­ary tele­com­mu­nic­a­tions data of tele­com­mu­nic­a­tions from pro­viders of tele­com­mu­nic­a­tions ser­vices, store it, and give ac­cess to the or­der­ing au­thor­ity or the au­thor­ity des­ig­nated by the or­der­ing au­thor­ity.

e.

In cases where the en­tit­ies ob­liged to co­oper­ate are merely sub­ject to an ob­lig­a­tion of tol­er­a­tion and co­oper­a­tion (Arts. 26 para. 6, 27 paras. 1 and 2, 28 and 29) or where non-stand­ard­ised sur­veil­lance is to be car­ried out (Art. 32 para. 2), it shall take the steps re­quired to en­sure that sur­veil­lance can still be car­ried out.

f.

It shall veri­fy the abil­ity of pro­viders of tele­com­mu­nic­a­tions ser­vices to provide in­form­a­tion and con­duct sur­veil­lance (Arts. 32–34).

g.

At the re­quest of the or­der­ing au­thor­ity, it shall fil­ter cer­tain data types out of the data flow.

¹The Ser­vice shall take pre­vent­ive and ret­ro­spect­ive meas­ures for qual­ity con­trol of the data de­livered by the pro­viders of tele­com­mu­nic­a­tions ser­vices.

²It may only view the con­tent of the data with the pri­or con­sent of the au­thor­ity re­spons­ible for the pro­ceed­ings.

¹ At the re­quest of the Ser­vice, pro­viders of postal ser­vices must de­liv­er to the or­der­ing au­thor­ity or to the au­thor­ity des­ig­nated by the or­der­ing au­thor­ity:

a.

the post ad­dressed to or mailed by the per­son un­der sur­veil­lance;

b.

the data that in­dic­ates with whom, when and from where the per­son un­der sur­veil­lance is or was com­mu­nic­at­ing, as well as the tech­nic­al char­ac­ter­ist­ics of the post con­cerned (sec­ond­ary data of postal ser­vices).

² The or­der may re­quire real-time sur­veil­lance to be car­ried out and the han­dover of the re­tained sec­ond­ary data of postal ser­vices from past com­mu­nic­a­tions (ret­ro­act­ive sur­veil­lance).

³The Fed­er­al Coun­cil shall spe­cify the per­miss­ible types of sur­veil­lance and shall reg­u­late for each type of sur­veil­lance the data to be sup­plied by the vari­ous pro­viders.

⁴ Pro­viders must re­tain the sec­ond­ary data of postal ser­vices spe­cified by the Fed­er­al Coun­cil on the basis of para­graph 3 for 6 months.

⁵ Sub­ject to the pri­or con­sent of the au­thor­ity re­spons­ible for the pro­ceed­ings, the post con­cerned shall be re­turned to the pro­vider, which shall de­liv­er it to the per­son un­der sur­veil­lance.

Pro­viders of postal ser­vices must provide the Ser­vice, at its re­quest, with the in­form­a­tion re­quired for or­der­ing sur­veil­lance.

¹ Pro­viders of tele­com­mu­nic­a­tions ser­vices shall sup­ply the Ser­vice with the fol­low­ing in­form­a­tion on spe­cified tele­com­mu­nic­a­tions ser­vices:

a.

the sur­name, first name, date of birth, ad­dress and, if known, the oc­cu­pa­tion of the sub­scriber;

b.³⁵

the ad­dress­ing re­sources un­der Art­icle 3 let­ter f of the Tele­com­mu­nic­a­tions Act of 30 April 1997³⁶ (TCA);

c.

the types of ser­vices;

d.

oth­er data on tele­com­mu­nic­a­tions ser­vices spe­cified by the Fed­er­al Coun­cil; such data may be ad­min­is­trat­ive or tech­nic­al in nature or per­mit the iden­ti­fic­a­tion of per­sons;

e.

in ad­di­tion in the case of cus­tom­er re­la­tion­ships for pre-paid or free ser­vices: the place of sup­ply and the sur­name and first name of the per­son who sup­plied the means of ac­cess to the tele­com­mu­nic­a­tions ser­vice.

² They must en­sure that this in­form­a­tion is re­cor­ded when the cus­tom­er re­la­tion­ship is es­tab­lished and can be sup­plied dur­ing the cus­tom­er re­la­tion­ship and for 6 months after its ter­min­a­tion. The Fed­er­al Coun­cil shall spe­cify that the pro­viders of tele­com­mu­nic­a­tions ser­vices must re­tain and be able to sup­ply cer­tain of these data for the pur­pose of iden­ti­fic­a­tion for only 6 months.

¹ If it is sus­pec­ted that a crim­in­al of­fence has been com­mit­ted via the in­ter­net, pro­viders of tele­com­mu­nic­a­tions ser­vices are re­quired to provide the Ser­vice with all the in­form­a­tion ne­ces­sary to identi­fy the per­pet­rat­or.

^1bis If suf­fi­cient evid­ence ex­ists that a threat to in­tern­al or ex­tern­al se­cur­ity is be­ing or has been made via the in­ter­net, pro­viders of tele­com­mu­nic­a­tions ser­vices are re­quired to provide the Ser­vice with all the in­form­a­tion re­quired to identi­fy the au­thor of the threat or the ori­gin of the threat.³⁸

² The Fed­er­al Coun­cil shall de­term­ine which in­form­a­tion the pro­viders of tele­com­mu­nic­a­tions ser­vices must re­tain and be able to sup­ply for the pur­pose of iden­ti­fic­a­tion dur­ing the cus­tom­er re­la­tion­ship and for 6 months after its ter­min­a­tion. It shall spe­cify cer­tain of these data that pro­viders of tele­com­mu­nic­a­tions ser­vices must re­tain and be able to sup­ply for the pur­pose of iden­ti­fic­a­tion for only 6 months. Pro­viders of tele­com­mu­nic­a­tions ser­vices must provide the Ser­vice with fur­ther in­form­a­tion avail­able to them.

³ Pro­viders of de­rived com­mu­nic­a­tions ser­vices and op­er­at­ors of in­tern­al tele­com­mu­nic­a­tions net­works must provide the Ser­vice with the in­form­a­tion avail­able to them.

⁴ The Fed­er­al Coun­cil may re­quire pro­viders of de­rived com­mu­nic­a­tions ser­vices that of­fer ser­vices of ma­jor eco­nom­ic im­port­ance or to a large num­ber of users to re­tain and sup­ply all or some of the in­form­a­tion that the pro­viders of tele­com­mu­nic­a­tions ser­vices must provide un­der para­graph 2.

¹ The Fed­er­al Coun­cil shall reg­u­late how pro­viders of tele­com­mu­nic­a­tions ser­vices must re­cord the data pur­su­ant to Art­icle 21 para­graph 1 let­ter a and Art­icle 22 para­graph 2 first sen­tence.

² It shall reg­u­late the form and re­ten­tion of in­form­a­tion re­quests.

³ It may provide that the data re­ferred to in Art­icles 21 and 22 be made ac­cess­ible on­line at all times to the au­thor­it­ies re­ferred to in Art­icle 15.³⁹

Pro­viders of tele­com­mu­nic­a­tions ser­vices must provide the Ser­vice on its re­quest with the tech­nic­al in­form­a­tion re­quired for or­der­ing sur­veil­lance.

Pro­viders of tele­com­mu­nic­a­tions ser­vices shall in­form the Ser­vice on its re­quest at any time in de­tail of the type and char­ac­ter­ist­ics of the ser­vices they have placed on the mar­ket or wish to bring to the mar­ket with­in 6 months.

¹ Pro­viders of tele­com­mu­nic­a­tions ser­vices shall on re­quest sup­ply the fol­low­ing in­form­a­tion to the Ser­vice or, in ac­cord­ance with Art­icle 17 para­graph c, to the or­der­ing au­thor­ity or the au­thor­ity des­ig­nated by the or­der­ing au­thor­ity:

a.

the con­tent of the tele­com­mu­nic­a­tions to and from the per­son un­der sur­veil­lance;

b.

the sec­ond­ary tele­com­mu­nic­a­tions data of the tele­com­mu­nic­a­tions to and from the per­son un­der sur­veil­lance.

² They must also:

a.

provide the in­form­a­tion re­quired to carry out the sur­veil­lance;

b.

tol­er­ate sur­veil­lance car­ried out by the Ser­vice or by per­sons it des­ig­nates; for this pur­pose they shall grant im­me­di­ate ac­cess to their fa­cil­it­ies;

c.

re­move any en­cryp­tion they have ap­plied.

³ Pro­viders of tele­com­mu­nic­a­tions ser­vices who are in­volved in provid­ing the tele­com­mu­nic­a­tions ser­vice un­der sur­veil­lance must sup­ply their data to the Ser­vice or to the pro­vider in­struc­ted to carry out the sur­veil­lance.

⁴ The or­der may re­quire real-time sur­veil­lance to be car­ried out and the han­dover of the re­tained sec­ond­ary tele­com­mu­nic­a­tions data of tele­com­mu­nic­a­tions from past com­mu­nic­a­tions (ret­ro­act­ive sur­veil­lance).

⁵ Pro­viders of tele­com­mu­nic­a­tions ser­vices must re­tain the sec­ond­ary tele­com­mu­nic­a­tions data of tele­com­mu­nic­a­tions for 6 months.

⁶ The Fed­er­al Coun­cil may ex­empt pro­viders of tele­com­mu­nic­a­tions ser­vices from cer­tain stat­utory ob­lig­a­tions, in par­tic­u­lar if they of­fer ser­vices of minor eco­nom­ic im­port­ance or in the field of edu­ca­tion. It shall not ex­empt them from the ob­lig­a­tion to sup­ply on re­quest the sec­ond­ary tele­com­mu­nic­a­tions data of tele­com­mu­nic­a­tions avail­able to them re­lat­ing to the per­son un­der sur­veil­lance and the ob­lig­a­tions re­ferred to in para­graph 2.

¹ Pro­viders of de­rived com­mu­nic­a­tions ser­vices must tol­er­ate sur­veil­lance car­ried out by the Ser­vice or by per­sons it des­ig­nates of the data that the per­son un­der sur­veil­lance trans­mits or stores us­ing de­rived com­mu­nic­a­tions ser­vices. For this pur­pose, they must without delay:

a.

grant ac­cess to their fa­cil­it­ies;

b.

provide the in­form­a­tion re­quired for the sur­veil­lance.

² On re­quest, they must sup­ply the sec­ond­ary tele­com­mu­nic­a­tions data of tele­com­mu­nic­a­tions avail­able to them re­lat­ing to the per­son un­der sur­veil­lance.

³ In so far as is ne­ces­sary for tele­com­mu­nic­a­tions sur­veil­lance, the Fed­er­al Coun­cil shall make pro­viders of de­rived com­mu­nic­a­tions ser­vices that provide ser­vices of ma­jor eco­nom­ic im­port­ance or to a large num­ber of users sub­ject to all or some of the ob­lig­a­tions re­ferred to in Art­icle 26. In such an event, the pro­vi­sions of this Act that ap­ply to pro­viders of tele­com­mu­nic­a­tions ser­vices ap­ply mu­tatis mutandis.

¹ Op­er­at­ors of in­tern­al tele­com­mu­nic­a­tions net­works must tol­er­ate sur­veil­lance car­ried out by the Ser­vice or by per­sons it des­ig­nates. For this pur­pose, they must without delay:

a.

grant ac­cess to their fa­cil­it­ies;

b.

provide the in­form­a­tion re­quired for the sur­veil­lance.

² On re­quest, they must sup­ply the sec­ond­ary tele­com­mu­nic­a­tions data of tele­com­mu­nic­a­tions avail­able to them re­lat­ing to the per­son un­der sur­veil­lance.

¹ Per­sons who make their ac­cess to a pub­lic tele­com­mu­nic­a­tions net­work avail­able to third parties must tol­er­ate sur­veil­lance car­ried out by the Ser­vice or by per­sons it des­ig­nates. For this pur­pose, they must without delay:

a.

grant ac­cess to their fa­cil­it­ies;

b.

provide the in­form­a­tion re­quired for the sur­veil­lance.

² On re­quest, they must sup­ply the sec­ond­ary tele­com­mu­nic­a­tions data of tele­com­mu­nic­a­tions avail­able to them re­lat­ing to the per­son un­der sur­veil­lance.

Pro­fes­sion­al re­tail­ers of cards and sim­il­ar means which per­mit ac­cess to a pub­lic tele­com­mu­nic­a­tions net­work must re­cord the in­form­a­tion re­ferred to in Art­icle 21 para­graph 1 and for­ward it to the pro­vider of tele­com­mu­nic­a­tions ser­vices whose net­work can be ac­cessed us­ing the card or sim­il­ar means.

¹ The Fed­er­al Coun­cil shall spe­cify the in­form­a­tion to be provided by pro­viders of tele­com­mu­nic­a­tions ser­vices and the types of sur­veil­lance they must con­duct. It shall spe­cify for each type of in­form­a­tion re­quest and sur­veil­lance which data must be sup­plied.

² It shall set time lim­its for sup­ply­ing the data.

³ The FD­JP shall is­sue the tech­nic­al and ad­min­is­trat­ive pro­vi­sions re­quired for the stand­ard­ised pro­vi­sion of in­form­a­tion and the stand­ard­ised con­duct of the com­mon types of sur­veil­lance. It shall spe­cify, in par­tic­u­lar, the in­ter­faces and data formats to be used for de­liv­er­ing the data to the Ser­vice. It shall take ac­count of the cor­res­pond­ing in­ter­na­tion­al stand­ards.

¹ Pro­viders of tele­com­mu­nic­a­tions ser­vices must at all times be able, in ac­cord­ance with the ap­plic­able law, to sup­ply the in­form­a­tion re­ferred to in Art­icles 21 and 22 and the in­form­a­tion re­ferred to in Art­icles 24 and 26 para­graph 2 let­ter a and to carry out sur­veil­lance of the tele­com­mu­nic­a­tions ser­vices they of­fer, provided the pro­vi­sion of in­form­a­tion and the sur­veil­lance are stand­ard­ised.

² Where in­form­a­tion is re­ques­ted or sur­veil­lance types are ordered that are not stand­ard­ised, pro­viders of tele­com­mu­nic­a­tions ser­vices must work with the Ser­vice in ac­cord­ance with its in­struc­tions and take all ap­pro­pri­ate meas­ures to en­sure trouble-free im­ple­ment­a­tion.

³ Pro­viders of tele­com­mu­nic­a­tions ser­vices may, at their own ex­pense, en­trust third parties to ful­fil these ob­lig­a­tions. They must en­sure that the third parties can guar­an­tee the se­cur­ity and con­fid­en­ti­al­ity of the data. Third parties en­trus­ted with the ful­fil­ment of these ob­lig­a­tions shall be sub­ject to the su­per­vi­sion of the Ser­vice.

¹ At the re­quest of the Ser­vice, pro­viders of tele­com­mu­nic­a­tions ser­vices must prove at their own ex­pense that they are able, in ac­cord­ance with the ap­plic­able law, to re­spond to the stand­ard­ised in­form­a­tion re­quests and to carry out the stand­ard­ised sur­veil­lance types.

² The Ser­vice may en­gage third parties to veri­fy abil­ity to provide in­form­a­tion and carry out sur­veil­lance.

³ It shall define the tech­nic­al and or­gan­isa­tion­al de­tails for provid­ing proof in in­di­vidu­al cases.

⁴ It shall charge the pro­vider of tele­com­mu­nic­a­tions ser­vices a fee to cov­er the cost of veri­fic­a­tion. The Fed­er­al Coun­cil shall set the fees.

⁵ It may in­struct pro­viders to take tech­nic­al and or­gan­isa­tion­al meas­ures to rem­edy de­fi­cien­cies re­lated to their abil­ity to provide in­form­a­tion and carry out sur­veil­lance.

⁶ It shall is­sue con­firm­a­tion to the pro­viders as soon as proof has been provided. The Fed­er­al Coun­cil shall reg­u­late the con­tent and term of valid­ity of this con­firm­a­tion, in par­tic­u­lar in the case of tech­nic­al ad­vances.

¹ Pro­viders of tele­com­mu­nic­a­tions ser­vices must bear the costs in­curred if they are un­able or un­will­ing to ful­fil their ob­lig­a­tions un­der Art­icle 32 and these ob­lig­a­tions must as a res­ult be as­signed to the Ser­vice or to a third party.

² They are not re­quired to bear the costs if they are un­able to ful­fil their ob­lig­a­tions and one of the fol­low­ing is true:

a.

They have val­id con­firm­a­tion of their abil­ity to carry out the type of sur­veil­lance con­cerned.

b.

They have sub­mit­ted proof of their abil­ity to carry out sur­veil­lance, but this has not been veri­fied with­in a reas­on­able peri­od for reas­ons bey­ond their con­trol.

¹ Out­side crim­in­al pro­ceed­ings, the com­pet­ent au­thor­ity may or­der sur­veil­lance of post and tele­com­mu­nic­a­tions in or­der to find a miss­ing per­son.

² A per­son is con­sidered miss­ing if the fol­low­ing con­di­tions are met:

a.

his or her where­abouts are un­known or dis­pro­por­tion­ately dif­fi­cult to de­term­ine; and

b.

there are ser­i­ous in­dic­a­tions that his or her health or life are in grave danger.

³ The com­pet­ent au­thor­ity may em­ploy tech­nic­al equip­ment in ac­cord­ance with Art­icle 269^bis Crim­PC⁴⁰, provided the pre­vi­ous meas­ures for tele­com­mu­nic­a­tions sur­veil­lance pur­su­ant to Art. 269 Crim­PC have been un­suc­cess­ful, or a search us­ing these meas­ures would be fu­tile or dis­pro­por­tion­ately dif­fi­cult. It shall pro­duce stat­ist­ics on sur­veil­lance in ac­cord­ance with Art. 269^bis Crim­PC.

⁴ The com­pet­ent au­thor­ity may also in­spect data on third parties where this ap­pears ne­ces­sary in the cir­cum­stances in or­der to find the miss­ing per­son.

¹ Out­side crim­in­al pro­ceed­ings, the com­pet­ent au­thor­ity may or­der sur­veil­lance of post and tele­com­mu­nic­a­tions in or­der to find a per­son on whom a leg­ally bind­ing and en­force­able cus­todi­al sen­tence or cus­todi­al meas­ure has been im­posed, provided the pre­vi­ous search meas­ures have been un­suc­cess­ful or if a search would be fu­tile or would be dis­pro­por­tion­ately dif­fi­cult in the ab­sence of sur­veil­lance.

² The com­pet­ent au­thor­ity may em­ploy tech­nic­al equip­ment in ac­cord­ance with Art­icle 269^bis Crim­PC⁴¹ and com­puter pro­grams pur­su­ant to Art­icle 269^terCrim­PC, provided the pre­vi­ous meas­ures for tele­com­mu­nic­a­tions sur­veil­lance pur­su­ant to Art­icle 269 Crim­PC have been un­suc­cess­ful, or the search us­ing these meas­ures would be fu­tile or dis­pro­por­tion­ately dif­fi­cult. It shall pro­duce stat­ist­ics on sur­veil­lance in ac­cord­ance with Art­icle 269^bis and 269^ter Crim­PC.

³ It may also in­spect data on third parties, provided the re­quire­ments of Art­icle 270 Crim­PC are met mu­tatis mutandis.

¹ Art­icles 271, 272 and 274–279 Crim­PC⁴² ap­ply mu­tatis mutandis to the pro­ced­ure.

² In the case of an emer­gency search, the per­sons un­der sur­veil­lance shall be in­formed as soon as pos­sible in derog­a­tion from Art­icle 279 Crim­PC.

³ The Con­fed­er­a­tion and the can­tons shall des­ig­nate the or­der­ing au­thor­ity, the ap­prov­ing au­thor­ity and the ap­peal body. A sur­veil­lance or­der re­quires ap­prov­al by a ju­di­cial au­thor­ity.

¹ The en­tit­ies ob­liged to co­oper­ate shall bear the costs of the fa­cil­it­ies re­quired to ful­fil their ob­lig­a­tions un­der this Act.

² They shall re­ceive ad­equate com­pens­a­tion from the Ser­vice for the costs that they in­cur in con­duct­ing sur­veil­lance and provid­ing in­form­a­tion pur­su­ant to Art­icles 21 and 22.

³ The can­tons shall con­trib­ute the costs in­curred by the Ser­vice in provid­ing its ser­vices and pay­ing com­pens­a­tion to the en­tit­ies ob­liged to co­oper­ate.

⁴ The Fed­er­al Coun­cil may provide that:

a.

the en­tit­ies ob­liged to co­oper­ate re­ceive no com­pens­a­tion for provid­ing any in­form­a­tion or for provid­ing cer­tain in­form­a­tion;

b.

ser­vices provided by the Ser­vice in con­nec­tion with the pro­vi­sion of any in­form­a­tion or cer­tain in­form­a­tion are not taken in­to ac­count in cal­cu­lat­ing the can­tons' con­tri­bu­tion to the costs.

¹ The Fed­er­al Coun­cil shall reg­u­late the cal­cu­la­tion and dis­burse­ment of com­pens­a­tion and the cal­cu­la­tion and col­lec­tion of con­tri­bu­tions to costs.

² It may provide that the com­pens­a­tion and con­tri­bu­tions to costs are cal­cu­lated on an in­di­vidu­al basis or at a flat rate.

³ It shall spe­cify the tar­iffs for cal­cu­la­tions made on an in­di­vidu­al basis.

⁴ For cal­cu­la­tions made on a flat-rate basis, it shall take ac­count of the ex­tent to which the costs may be at­trib­uted to the Con­fed­er­a­tion or to in­di­vidu­al can­tons ac­cord­ing to the be­ne­fit of the in­form­a­tion and the sur­veil­lance. If the can­tons have agreed on the shares of the over­all costs that they are each to bear, the al­loc­a­tion of costs shall be based on this agree­ment.

⁵ In the case of flat-rate com­pens­a­tion and con­tri­bu­tions to costs, the Ser­vice shall provide state­ments on its ser­vices and those of the en­tit­ies ob­liged to co­oper­ate show­ing the amounts that would be in­curred in the case of an in­di­vidu­al as­sess­ment.

¹ Un­less they have com­mit­ted a more ser­i­ous of­fence un­der an­oth­er law, any per­son who wil­fully:

a.

fails to com­ply with a de­cision ad­dressed to them by the Ser­vice that men­tions the pen­al­ties un­der this Art­icle in the time provided;

b.

fails to com­ply with the ob­lig­a­tion to re­tain data un­der Art­icles 19 para­graph 4 and 26 para­graph 5;

c.

fails to com­ply with the ob­lig­a­tion to re­cord and, if ne­ces­sary, pass on the re­quired cus­tom­er data (Art. 21 para. 2 and Art. 30) when es­tab­lish­ing a cus­tom­er re­la­tion­ship;

d.

fails to pre­serve secrecy vis-à-vis third parties with re­gard to sur­veil­lance;

shall be li­able to a fine not ex­ceed­ing 100,000 francs.

² An at­tempt is also an of­fence.

³ If the of­fend­er acts through neg­li­gence, the pen­alty is a fine not ex­ceed­ing 40,000 francs.

¹ Of­fences un­der Art­icle 39 shall be pro­sec­uted and ad­ju­dic­ated in ac­cord­ance with the Fed­er­al Act of 22 March 1974⁴⁴ on Ad­min­is­trat­ive Crim­in­al Law.

² The Ser­vice is re­spons­ible for the pro­sec­u­tion and ad­ju­dic­a­tion.

¹ The Ser­vice shall over­see com­pli­ance with the le­gis­la­tion on sur­veil­lance of post and tele­com­mu­nic­a­tions.

² If it iden­ti­fies an in­fringe­ment of the law, it may take the meas­ures re­ferred to in Art­icle 58 para­graph 2 let­ter a TCA⁴⁵ mu­tatis mutandis against pro­viders of tele­com­mu­nic­a­tions ser­vices. It may or­der pre­cau­tion­ary meas­ures.

¹ De­cisions by the Ser­vice are sub­ject to ap­peal in ac­cord­ance with the gen­er­al pro­vi­sions on fed­er­al ad­min­is­trat­ive justice.

² The plea that the re­quire­ments for or­der­ing the sur­veil­lance have not been met is not an ad­miss­ible ground for an ap­peal against a de­cision by the Ser­vice.

³ An ap­peal does not have sus­pens­ive ef­fect ex­cept where the de­cision relates to a cash con­sid­er­a­tion. The ap­peal body may ac­cord sus­pens­ory ef­fect to the ap­peal.

The Fed­er­al Coun­cil and, to the ex­tent that they are re­spons­ible, the can­tons shall is­sue the pro­vi­sions re­quired to im­ple­ment this Act.

The re­peal and amend­ment of oth­er le­gis­la­tion are reg­u­lated in the An­nex.

¹ Sur­veil­lance that is in pro­gress at the time that this Act comes in­to force shall con­tin­ue in ac­cord­ance with the new law.

² Ap­peals against the Ser­vice’s de­cisions shall be dealt with in ac­cord­ance with the law ap­plic­able in the pro­ceed­ings at the first in­stance.

³ The ob­lig­a­tion laid down in Art­icle 21 para­graph 2 ap­plies to in­form­a­tion about pre­paid SIM cards and sim­il­ar means that must still be avail­able un­der the pre­vi­ous law at the time that this Act comes in­to force.

⁴ The com­pens­a­tion and fees for sur­veil­lance pur­su­ant to this Act are gov­erned by the law that was in force at the time sur­veil­lance was ordered.

Re­gard­less of wheth­er this Act or the In­tel­li­gence Ser­vice Act of 25 Septem­ber 2015⁴⁶comes in­to ef­fect first, the pro­vi­sions be­low shall on the com­mence­ment of the Act that comes in­to force later or on com­mence­ment of both Acts at the same time be worded as fol­lows:

…⁴⁷

¹ This Act is sub­ject to an op­tion­al ref­er­en­dum.

² The Fed­er­al Coun­cil shall de­term­ine the com­mence­ment date.

Com­mence­ment date: 1 March 2018⁴⁸