A landmark ruling in data protection law: On October 6, 2025, the Federal Administrative Court clearly rejected the appeal filed by the Swiss Citizens’ Forum Association against a processing ban imposed by the Federal Data Protection and Information Commissioner (FDPIC). The court thus confirmed the strict interpretation of the principle of proportionality in Swiss data protection law – with far-reaching consequences for organizations that publish personal data on the internet. This insight analyzes the ruling and its practical implications for organizations, campaigns, and data protection officers.
Background and initial situation
The proceedings centered on the online campaign “Pfarrer-Check” (Pastor Check) launched by the association Bürgerforum Schweiz. The association created a publicly accessible database containing contact details and information about pastors and other church officials. This database noted whether or not the individuals concerned had responded to a questionnaire sent to them, including status information such as “recorded,” “requested,” or “responded.” In addition, some of the responses received were published publicly.
Several individuals reported their concerns about this data processing to the FDPIC. In its investigation, the FDPIC concluded that the publication of this data was disproportionate. The information collected was neither suitable for making reliable statements about the religious beliefs of the individuals concerned, nor was it necessary to prove the representativeness of the campaign.
On April 9, 2024, the FDPIC therefore issued a ruling with the following key content:
- The association was not allowed to further process or publish personal data of persons with the status “registered” or “requested” unless legally valid consent had been obtained.
- Data that had already been published had to be deleted within a specified period.
- Failure to comply would result not only in coercive measures but also in administrative fines.
The association lodged an appeal against this decision with the Federal Administrative Court (FAC). The FAC rejected the appeal in its ruling of October 6, 2025.
Legal basis
The Swiss Data Protection Act (DSG) requires a solution that is appropriate, necessary, and proportionate when handling personal data. This means:
- Appropriateness: Data processing must contribute to achieving the intended purpose.
- Necessity: There must be no less intrusive means that are equally effective.
- Proportionality: The interests of the data subjects must be weighed against the interests of the controller.
In its ruling, the Federal Administrative Court confirmed the FDPIC’s interpretation that the collection and publication of status information and responses was not suitable for providing a reliable statement on religious beliefs. Nor could this data be used to substantiate the representativeness of the survey. Therefore, the data processing violated the principle of proportionality under the DSG.
Analysis: Key points of the ruling
1. Insufficient legal basis for data publication
The court clarified that the public interest in a discourse on religious issues alone does not automatically justify the collection or publication of personal data. Even if the association based its actions on “freedom of opinion and information,” this does not replace a legal basis or the effective consent of the persons concerned.
2. Proportionality assessment
The court confirmed that the FDPIC had acted correctly in its assessment: the interests of the data subjects in the protection of their personality and privacy clearly outweigh the benefits of a publicly accessible database based on implicit or missing consent.
3. Legal consequence: dismissal of the complaint
With the dismissal of the complaint on October 6, 2025, the judicial authority confirmed that the FDPIC had correctly exercised its discretion within the framework of the legal requirements. The FDPIC’s decision is therefore legally binding.
Practical implications and recommendations
For campaign operators and NGOs
Organizations that publish online databases containing personal data must ensure that:
- Legally valid consent has been obtained for each intended data processing operation.
- Transparency is guaranteed for data subjects regarding the purpose, scope, and duration of the processing.
- The balancing of interests is carefully documented, especially if data is to be made publicly available.
For data protection officers in companies
This ruling serves as a precedent-setting indication that even in cases of supposedly legitimate interest in information, strict application of the DSG is required. Data protection officers should systematically review existing processing activities for proportionality and legal basis.
Consequences for authorities and data subjects
The ruling confirms that data subjects’ personal rights are protected in the digital space, especially if they have not expressly consented to data processing. For authorities, the ruling confirms the actions of the FDPIC and strengthens data protection practices.
Conclusion and outlook
The ruling of the Federal Administrative Court of October 6, 2025 clarifies that the protection of personal data must not take a back seat to the interests of public opinion formation, even if the latter appears to be politically motivated or socially relevant. Online databases containing personal information in particular require a careful legal basis and must comply with the principle of proportionality.
In the future, this ruling is likely to serve as a reference case—for example, for political campaigns, associations, or media projects that want to make personal data publicly available. It emphasizes the importance of data protection-compliant planning in the early stages of digital projects.
Sources
- EDÖB – Bundesverwaltungsgericht bestätigt Praxis des EDÖB (EDÖB‑Mitteilung vom 20.10.2025)
- Urteil BVGer A‑2941/2024 vom 6. Oktober 2025
Note: revised with AI