The Federal Supreme Court continues to set limits on the right of access

(Translated by DeepL)

Following on from an initial ruling in which it had ruled that an access request whose objective was to obtain information to be used in a lawsuit against the recipient of the request was abusive (4A_277/2020 of 18 November 2020), the Federal Court is continuing its case law aimed at limiting the scope of the right of access under the Data Protection Act (ATF 147 III 139). Although delivered in a very specific context, this ruling nevertheless offers interesting lessons, particularly for banks that have to respond to access requests.

In the case in question, the manager of a service company was dismissed after being accused of complicity in tax offences abroad. The dismissal gave rise to a dispute which ended with a payment of CHF 566,000 to the manager.

Subsequently, the manager’s bank placed him on its list of undesirable clients and terminated the banking relationship. The bank maintains that the termination took place within the framework of its general policy of not maintaining commercial relations with persons accused of tax offences. The manager, for his part, considers that this termination followed a telephone conversation between one of his former colleagues and the bank’s General Counsel. The former colleague in question is said to have advised the bank to close the account on that occasion.

The manager pursued his request for access through the courts, asking the Bezirksgericht of the canton of Zurich to order the bank, on the basis of Art. 8 DPA, to give him access to all personal data concerning him, in particular the information relating to the telephone conversation mentioned above.

Firstly, the Federal Court begins by reiterating that the right of access under Article 8 DPA must not be abused and used for purposes contrary to data protection. A request for information must be deemed abusive, for example, if it is made with the sole aim of investigating a (future) opposing party and obtaining evidence that a party could not obtain otherwise. Indeed, the right of access provided for in art. 8 DPA is not intended to facilitate the obtaining of evidence or to interfere with the right to civil procedure.

Secondly, the Federal Tribunal analyses the material content of the right of access. According to art. 8 DPA, the controller of the file must communicate to the data subject all personal data concerning him/her contained in a file. The terms personal data and data file must be interpreted broadly. An ‘internal’ or ‘unofficial’ file also falls under the access request.

Thirdly, the Federal Supreme Court considers that the right of access does not allow information on the existence and content of an oral conversation to be obtained by questioning the parties or witnesses. The right of access relates to information that exists on a medium, but not to data that exists only in the memory of a natural person (in this context, the Federal Court refers to a ‘physical’ medium, but an ‘electronic’ medium should, in our opinion, be treated in the same legal way).

Finally, the Federal Supreme Court points out that the right of access naturally relates to personal data relating to the data subject, but also to information available on the origin of the data. In this context, the Data Protection Act does not impose an obligation on the data controller to retain information on the origin of the data (such an obligation may, however, arise from sectoral regulations). The Federal Court’s reasoning is based on the text of Article 8(2)(a) of the DPA, which refers to ‘available’ information regarding the origin of the data. On the other hand, if the data controller has information on the origin of the data at the time he receives the access request, he is obliged to transmit it, the destruction of this information after receipt of the request constituting a breach of his obligations.

After having provided these theoretical reminders (very useful for practitioners), the Federal Court ruled, contrary to the opinion of the lower court, that information on the origin of data that is ‘stored’ in a person’s memory is not covered by the right of access. The claimant’s request was therefore dismissed.

On the other hand, a written transcript of the disputed telephone conversation would have been subject to the right of access. However, the Federal Court states that it does not have the information necessary to determine the existence of such a document in this case. It nevertheless specifies that such a document would only be subject to the access request if (i) it was not created for temporary use (‘vorübergehenden Gebrauch’) and (ii) it was saved in such a way that it could be found during a targeted search in response to an access request (‘gezielter Zugriff’).

As indicated, this ruling reflects the Federal Court’s desire to put a stop to the abuses of access requests within the meaning of Art. 8 DPA that some, in the wake of ATF 138 III 425 (commented on cdbf.ch/821/), have tried to use as a substitute for accountability based on Art. 400 CO (and, from now on, on art. 72 LSFin).

The new data protection law, which should in principle come into force on 1 January 2023, does not make any major changes to the regulation of the right of access. However, it should be noted that the Parliament has added, in Article 25(2)(b) NLPD, the clarification that the right of access relates to personal data ‘as such’. In our view, however, this addition relates more to the concrete modalities of responding to an access request, as opposed to the material scope of the right of access.

On the other hand, it is interesting to note, particularly in the context of ‘calibrating’ the steps to be taken in response to an access request, that the Federal Court mentions, in the judgement commented on here, that the request must relate to documents that can be the subject of ‘targeted access’ (‘gezielter Zugriff’ in recital 3.1.1) and that the response must be able to be provided without too much effort (‘in aller Regel ohne grossen Aufwand möglich’ in recital 3.4.3). In our view, the limits set by the Federal Supreme Court in this ruling will continue to apply under the new data protection law.