Does the Federal Tax Administration (FTA) have a duty to inform persons who are involved, but not directly targeted, in a request for international administrative assistance (“third parties”) ?

Reading this question may give you a feeling of “déjà vu”. And rightly so. The FTA’s duty to inform third parties has already been the subject of several decisions, commented on on this site (cf. in particular. ATF 143 II 506 commented in cdbf.ch/982/ and 2C_310/2020 commented in cdbf.ch/1169/).

With ruling 2C_825/2019, which is intended for publication (ATF 148 II 349), the Federal Supreme Court resolves the introductory question and closes proceedings initiated in 2017 by the Federal Data Protection and Information Commissioner (FDPIC) against the Federal Tax Administration (FTA).

The proceedings originated when the FDPIC learned that the FTA had passed on the names of hundreds of people (considered third parties) to the US Internal Revenue Service (IRS), without informing them in advance. The Federal Department of Finance (FDF) confirmed the FTA’s practice of not systematically informing third parties. On appeal, the Federal Administrative Court ruled that third parties must be informed, in accordance with the Federal Law on Administrative Assistance in Tax Matters (LAAF).

While the appeal procedure was suspended before the Federal Supreme Court, the latter handed down ATF 146 I 172 (commented in LawInside.ch/949/), in which it limited the FTA’s duty to inform third parties (art. 14 para. 2 LAAF) when their right to appeal is “obvious”.

After reiterating the FTA’s duty to inform third parties under the FTAA, in particular in ATF 146 I 172, the Federal Court in its ruling 2C_825/2019 focuses solely on the duty to inform third parties under the Data Protection Act (DPA). It examines whether third parties whose personal data is to be transferred to a foreign authority must be informed of this transfer in accordance with the DPA.

Art. 4 para. 4 DPA stipulates that “the collection of personal data, and in particular the purposes of processing, must be recognizable to the data subject”. Art. 18a para. 1 DPA gives concrete expression to this principle of recognizability by imposing a duty on federal bodies to inform “the data subject of any collection of data concerning him”. However, art. 18a para. 4 of the DPA limits this duty to cases where the communication of data is expressly provided for by law.

However, the LAAF provides for the communication of third-party data to the foreign authority (art. 4 para. 3 LAAF) and the conditions under which they must be informed (art. 14 para. 2 LAAF). Given that the communication of data in the context of international administrative assistance infringes privacy and the right to informational self-determination (art. 13 para. 2 Cst.), the Federal Court is still examining whether the infringement of this fundamental right is sufficiently precise.

Whether a norm limiting the fundamental right to informational self-determination is sufficiently precise depends on the seriousness of the infringement, and in particular on the nature of the data. However, data relating to a banking relationship are not in principle sensitive data within the meaning of the DPA (art. 3 let. c DPA), as the ECtHR has already found (G.S.B. v. Switzerland, summary in LawInside.ch/144).

Since the disclosure of third-party data abroad is (i) expressly provided for by the Federal Data Protection Act and (ii) sufficiently precise, the duty to inform data subjects under art. 18a para. 1 of the DPA is extinguished in accordance with art. 18a para. 4 of the DPA.

Consequently, the FTA is not required to inform third parties under the DPA. The Federal Court therefore upheld the appeal and confirmed the above-mentioned decision of the FDF.

The new DPA, which comes into force on September 1, 2023, is unlikely to change this practice, as the duty to inform of a federal body (and the exceptions deriving therefrom) remains largely unchanged (art. 19-20 nLPD).

The absence of a duty to inform third parties now seems to be the rule, both under the LAAF and the LPD. However, the Federal Court’s reasoning is based on the fact that the data transmitted is not very sensitive. It can therefore still be argued that, depending on the sensitivity of the data concerned, the exception provided for in art. 18a para. 4 let. a DPA does not apply. However, the exception provided for in art. 18a para. 4 let. b DPA, expressly left open by the Federal Court in this judgment, could still apply, regardless of the sensitivity of the data.

In our opinion, third parties fearing that their data may be transmitted by the FTA to a foreign authority should institute civil proceedings to prohibit the data holder (in particular the banks) from transmitting their data abroad. They would then be able to communicate the judgment to the FTA in order to be considered as a “pre-constituted party” on the basis of their “obvious” standing, and would therefore have to be informed prior to any transfer (cf. 2C_310/2020 commented in cdbf.ch/1169/). However, this process leaves us sceptical when it comes to the principle of procedural economy.