Can a person facing criminal proceedings obtain from FINMA, under the FADP, the documents relating to an enforcement procedure targeting a bank ? No, where the request is in fact intended to prepare their criminal defence and to intervene in the enforcement proceedings (Federal Administrative Court, A-1251/2024, A-1692/2024 of 16 September 2026).

An Australian lawyer, who manages three offshore companies, holds a bank account with a Swiss bank. On 28 October 2020, the Geneva Public Prosecutor’s Office initiated criminal proceedings against him for money laundering in connection with tax evasion. These proceedings also targeted a US national, suspected of having concealed approximately USD 2 billion, notably at this bank, with the lawyer’s assistance. FINMA initiated enforcement proceedings against the bank and exchanged information with the Public Prosecutor’s Office.

On 16 February 2022, the lawyer and his companies requested access from FINMA to all their data (Art. 8 of the former Data Protection Act). They wished to receive this information prior to a criminal hearing scheduled for 18 March 2022. Between May 2022 and February 2024, FINMA sent them 3,250 redacted documents in eight batches. Citing a risk of collusion, it initially deferred access to the documents relating to the enforcement proceedings, which were concluded on 16 June 2023. In January and February 2024, it provided the investigator’s report, its decision and the bank’s submissions, all redacted.

The applicants lodged an appeal with the Federal Administrative Court (FAC) against these last two consignments. They complained of incomplete access and excessive redactions. Their aim was to verify the bank’s data concerning them and, where necessary, to have it rectified before it was forwarded to the Public Prosecutor’s Office.

The FTA first classified the two letters from FINMA as decisions (Art. 5 PA). It then dismissed the companies’ appeals. This is because the new Data Protection Act (LPD), applicable pursuant to Art. 70 LPD, no longer protects legal persons. The Federal Administrative Court dismissed the contrary opinion of the Federal Office of Justice, which had considered that the old law should continue to apply since the companies’ request for access had been submitted before 1 September 2023.

Article 26(1)(c) of the FDA permits access to be refused, restricted or deferred where ‘the request for access is manifestly unfounded, in particular because it pursues a purpose contrary to data protection or is manifestly vexatious’. Under the former Data Protection Act (aLPD), the Federal Supreme Court held that a request aimed exclusively at obtaining evidence for the purposes of a trial constituted an abuse of process (ATF 138 III 425, discussed in Fischer, cdbf.ch/821/).

In the present case, the Federal Administrative Court held that the appellants ‘were not pursuing any objective related to data protection’. Firstly, they sought to obtain, prior to the criminal hearing, documents to which the lawyer would only have access at a later stage in the criminal proceedings. Their second aim was to intervene in an enforcement procedure to which they were not parties, in order to have the bank’s statements corrected before they were forwarded to the Public Prosecutor’s Office. However, even a party to the enforcement procedure cannot object to such a transfer.

According to the Federal Administrative Court (FAC), three factors support this conclusion : (i) the volume of requests, amounting to a fishing expedition, not motivated by a purpose related to data protection ; (ii) the continuous challenge to the redactions, which reveals an interest in the context rather than in the data itself ; and (iii) the focus on the documents relating to the enforcement proceedings.

Consequently, the requests for access ‘constituted an abuse of rights, as they were based on purposes unrelated to the FADP’. The FAC dismissed the appeals.

This judgment gives rise to three observations.

Firstly, the Federal Administrative Court expressly leaves open the question of the threshold for an abuse of rights as provided for in Article 26(1)(c) of the FADP. According to some scholars, this provision merely reiterates the aforementioned case law applicable under the former FADP, whilst others argue that it lowers the threshold. In our view, this judgment confirms the trend in case law towards an increasingly restrictive approach to requests for access that do not genuinely seek to invoke rights arising from the FADP (see also Fischer, cdbf.ch/1200/ and Hirsch, cdbf.ch/1243/).

Practitioners can no longer necessarily limit themselves to invoking their client’s right to data rectification, as provided for in section 32(1) of the LPD and section 41(2)(a) of the LPD, in order to avoid having their request classified as abusive. They will need to draft their LPD access request carefully and probably avoid any reference to other proceedings, whether pending or future.

Secondly, the Federal Administrative Court’s reasoning is unconvincing where it considers the fact that the appellants ‘were more interested in contextual information’ than in ‘their raw personal data alone’ to be an indication of an abuse of rights. Indeed, the FAD permits access to ‘personal data processed as such ’ (Art. 25(2)(b) of the Data Protection Act). It would have been preferable for the Federal Administrative Court to explain whether the redaction carried out by FINMA complied with this legal limit, rather than relying on the concept of ‘raw personal data’, which is unknown in our legal system (on the redaction carried out by FINMA, see also Jeanneret, cdbf.ch/1345/).

Finally, the Federal Administrative Court (TAF) considers that FINMA breached Article 70 of the FADP by continuing to examine requests for access from companies after the new Act came into force on 1^st September 2023. However, we doubt that the legislature actually intended, in adopting Article 70 of the Data Protection Act, that a request for access submitted by legal persons before 1^st September 2023 should be rejected on the grounds that this Act no longer protects legal persons. In any event, it cannot be ruled out that legal persons may still invoke Article 13(2) of the Constitution against the State or Article 28 of the Civil Code against private individuals in order to obtain access to their data.