The limits of art. 8 DPA are confirmed

(Translated by DeepL)

In 2012, art. 8 of the Data Protection Act (DPA), which allows access to personal data, was seen as a potential “new weapon” for customers wishing to obtain information from their bank (Fischer in cdbf.ch/821/). In 2020 and 2021, the Federal Court expressly limited this right of access.

In the decision commented on here, the Geneva Court of Justice confirms the limits of art. 8 of the DPA, as a customer attempted to use it to gain access to various items of information held by her bank (ACJC/562/2022 of April 26, 2022).

A woman, born in 1926 and living in Poland, was a client of a Swiss bank. Her husband and children, now deceased, were also customers of the bank. In 2012, the client and her children had transferred their assets to the account of a foundation, of which the husband was settlor and the client and her children beneficiaries.

The estate of one of the sons, who died in 2018, is the subject of proceedings in Poland, in which the customer is trying to exclude an heiress named in a will.

At the end of 2018, the client asks the bank for comprehensive information concerning her directly and indirectly (in her capacity as beneficiary of the foundation), both from the point of view of inheritance law and contractually. The bank provides her with various items of information, but indicates that it cannot share with her any information concerning the foundation’s account. Even if she were a beneficiary, such information is protected by banking secrecy.

Changing her mind, the client returned to the bank, invoking art. 8 LPD to obtain her personal data and art. 1 al. 7 OLPD to obtain the data of her deceased family members. This provision states that :

“Consultation of a deceased person’s data is granted when the applicant can demonstrate an interest in consultation and no overriding interest on the part of relatives of the deceased or third parties stands in the way. An interest is established in the event of close relationship or marriage to the deceased”.

The bank sends her reports concerning both her data and that of her family members, but objects to communicating information concerning a third party, without first being released from banking secrecy.

Dissatisfied, the client applied to the Geneva Court of First Instance for a right of access based on art. 8 of the DPA. The Court rejected her request as abusive. In fact, the client was not seeking to verify whether the bank’s data processing was lawful within the meaning of the DPA.

On appeal, the Court of Justice examined two questions :

Does the customer’s right of access constitute an abuse of rights ?
Does art. 1 para. 7 OLPD really allow access to the data of deceased persons ?

The Court of Justice begins by recalling the limits of the right of access, as set out by the Federal Court in ATF 138 III 425 (cf. Fischer in cdbf.ch/821/) and ATF 141 III 119 (cf. Richa in cdbf.ch/927). He points out that the scope of the right of access has been circumscribed more recently (ATF 147 III 139, cf. Fischer in cdbf.ch/1200/, and 4A_277/2020). In short, if the request for access does not aim to verify compliance with data protection standards, it may be considered abusive (art. 2 al. 2 CC).

In this case, the customer claims that “her request for access is not exclusively aimed at obtaining information for a purpose other than asserting her rights under the DPA, since it is also intended to check that the processing of her data and that of her family members has (sic) been carried out (sic) in compliance with the law”.

The Court of Justice is not convinced by this argument. It sees it as a pretext to justify the request. In fact, the client had initially invoked inheritance law and contract law. The Court also noted the extent of the documentation required, and the fact that the customer had asked the bank to provide her with a waiver of the statute of limitations. The request is akin to fishing expedition.

Given that its purpose is not to verify compliance with the DPA, but exclusively to gather evidence in order to assess the chances of success of an action against the bank, the Court declares the request for access abusive.

Secondly, the Court examined whether the client could invoke art. 1 para. 7 OLPD to gain access to the data of her deceased family members. A doctrinal controversy exists as to the validity of this provision. While the Swiss Federal Supreme Court has left the question open, a Zurich ruling held that this provision was contrary to the DPA. In fact, the law provides for a right of access only to one’s own personal data, and not that of third parties.

The Court of Justice agrees with the Zurich ruling : art. 1 para. 7 OLPD is contrary to the DPA. In particular, it notes that this right has deliberately not been included in the new DPA adopted in 2020 (but not yet in force), nor will it be included in the new ordinance.

This ruling is convincing, both in its characterization of the request as abusive and in its invalidation of the right of access to the data of deceased persons.

If a litigant still wishes to invoke art. 8 of the DPA, he must now expressly allege a data protection purpose from the outset. If he receives the desired information, it may, in our opinion, be considered unusable in a legal action for damages (cf. art. 152 para. 2 CPC), since it would have been obtained in violation of the principle of good faith.