Federal Act on Data Protection

¹Per­son­al data may only be pro­cessed law­fully.¹

²Its pro­cessing must be car­ried out in good faith and must be pro­por­tion­ate.

³Per­son­al data may only be pro­cessed for the pur­pose in­dic­ated at the time of col­lec­tion, that is evid­ent from the cir­cum­stances, or that is provided for by law.

⁴The col­lec­tion of per­son­al data and in par­tic­u­lar the pur­pose of its pro­cessing must be evid­ent to the data sub­ject.²

⁵If the con­sent of the data sub­ject is re­quired for the pro­cessing of per­son­al data, such con­sent is val­id only if giv­en vol­un­tar­ily on the pro­vi­sion of ad­equate in­form­a­tion. Ad­di­tion­ally, con­sent must be giv­en ex­pressly in the case of pro­cessing of sens­it­ive per­son­al data or per­son­al­ity pro­files.³