IT Security

The "Schabowski" case of the OVG Münster is going to the Federal Administrative Court! The proceedings revolve around Günther Schabowski's famous speech at the press conference on 9 November 1989. Who did the Haus der Geschichte buy this note from? A journalist from the BILD newspaper sued the museum on the basis of the right to information under Article 5 of the German Constitution. The OVG Münster accepted such a claim, rejecting it and basing its decision on the grounds for refusal of the IFG and Art. 86 GDPR. The Haus der Geschichte is now appealing. From minute (20:39), Dr Stefan Brink and Prof Niko Härting talk about the resolution paper of the Data Protection Conference on the P20 Data House, a federal-state project on the IT infrastructure of the police. The paper criticises in particular the lack of a legal basis for the planned IT architecture. Finally, from minute 30:13 onwards, the AI tool Microsoft Copilot is discussed. Copilot is not actually allowed to access files labelled as confidential; however, such access did take place. Stefan and Niko shed light on the consequences under data protection law and finally land on the keyword of digital sovereignty.

On 23 February 2026, the Federal Data Protection and Information Commissioner (FDPIC), together with 60 other national data protection authorities, published a joint statement on AI-generated images and the protection of privacy. In it, the data protection authorities formulate their most important expectations and principles for all organisations that develop and use AI systems to generate content. These include, in particular, robust safeguards against misuse, transparency requirements, effective and accessible erasure mechanisms and specific child protection.

When companies fall victim to a ransomware attack, they face a difficult question: Should they pay the ransom demanded to recover encrypted data, or should they refuse, as recommended by Swiss authorities? Our analysis shows how to make legally responsible decisions, what risks exist, and how companies can weigh up the risks and legal certainty.

How can incorrect personal data in the Central Migration Information Systembe corrected? Three recent rulings by the Federal Administrative Court and the Federal Supreme Court provide answers and show how the Data Protection Act (DPA) is applied in practice.

The use of artificial intelligence (AI) is revolutionising e-commerce in Switzerland. However, without careful consideration of data protection, significant risks can arise. Find out why transparent information about the use of AI in general terms and conditions (GTC) and privacy policies is essential to avoid legal pitfalls.

General crime in Switzerland has risen again - but particularly dramatically in the digital space. Cybercrime has more than doubled in just a few years and is becoming a key challenge for private individuals and companies. In view of this dynamic, preventive measures are essential. The following article analyses the current figures and shows how companies can protect themselves effectively.

The responsible use of AI is essential, especially for the public sector. Here, decisions have far-reaching consequences for citizens. To meet these requirements, the European Commission has published updated model contract clauses for the procurement of high-risk AI systems. These contract clauses, which are aligned with the EU AI Act, are intended to help public procurers comply with legal and ethical standards when purchasing such technologies. They ensure that AI systems are developed, delivered and operated in a transparent, secure and legally compliant manner.

In a presentation at the University of Bern on 22 August 2023, I explained the modalities regarding data security and reporting obligations under the DPA and the ISG in procurement. Now there is something to report again in this area: From 1 April 2025, operators of critical infrastructure in Switzerland will be obliged to report cyberattacks suffered to the Federal Office for Cybersecurity (BACS) within 24 hours of their discovery. This measure is intended to strengthen cyber security and increase the resilience of essential services. We showed that this is necessary in the Insight of 31 December 2024, in which we reported on the high number of cyber incidents in Switzerland (every 8.5 minutes!). The current article explains the background to the new reporting obligation, the legal basis, the sectors affected and the practical implications, and provides recommendations for action for companies and authorities.