Criminal liability for data protection breaches in Switzerland in cases of organisational failings and the provision of incorrect information in response to requests for information from data subjects
Two recent criminal cases from Geneva and Zurich show that enforcement of the new Data Protection Act in Switzerland is becoming stricter, and that breaches of the Act’s data protection requirements may also result in criminal sanctions. Whilst the Geneva High Court clarified the limits of criminal liability for data security breaches in its judgement ACPR/239/2025 of 26 March, the Zurich City Magistrates’ Court, in penalty order No. 2023-066-252 of 10 June 2024 – as far as can be ascertained, for the first time – a fine for failing to provide sufficient information. The decisions demonstrate that the criminal law provisions of the DSG can indeed be highly relevant in practice.