1 Personal data may not be disclosed to the competent authority of a State that is not linked with Switzerland through one of the Schengen association agreements (a third country) or to an international body if, as a result, the privacy of the data subject would be seriously jeopardised, in particular because of the lack of adequate protection.
2 Adequate protection is guaranteed by:
- the legislation of the third country, provided the European Union has confirmed this in a decision;
- an international agreement;
- specific guarantees.
3 In derogation from paragraph 1, personal data may be disclosed to the competent authority of a third country or to an international body if disclosure is necessary in the case in question:
- to protect the life or physical integrity of the data subject or a third party;
- to prevent an imminent and serious threat to the public security of a Schengen State or of a third country;
- to prevent, detect or prosecute a criminal offence or to execute a criminal judgment, unless overriding legitimate interests of the data subject preclude disclosure;
- to exercise or enforce legal rights against an authority competent to prevent, detect or prosecute a criminal offence or to execute a criminal judgment, unless overriding legitimate interests of the data subject preclude disclosure.