Newsletter 9/2023: Employees' right to information under the new Data Protection Act

A) Employees' right to information

The purpose of the DPA is to protect the personality and fundamental rights of the persons whose data is processed. In order to enable (former) employees to check the lawfulness of the processing of their data and, if necessary, to demand that the data be corrected or deleted, the DPA gives them a right to information vis-à-vis the employer. The only purpose of the right to information is to provide (former) employees with the information they need to enforce their data protection rights.

The request for information does not have to be substantiated or accompanied by proof of interest. However, the employer may refuse to provide information if the request for information is made in abuse of rights (cf. below).

The information must be provided in writing or in the form in which the data is available. If both the employer and the employee agree, the information may also be provided orally or the (former) employees may inspect their data on site. The employer must provide the information within 30 days. In principle, the information must be provided free of charge. Only if the provision of infor-mation involves disproportionate effort may the person requesting the information be required to make a reasonable contribution to the costs, up to a maximum of CHF 300.

The employer does not have to and should not submit a declaration of completeness (cf. also below).

 

B) Content of the right to information

According to Art. 25 DPA, (former) employees have the right to request information from the em-ployer as to whether personal data about them is being processed and to request the correspond-ing personal data. This right applies in principle to all physical or electronic data relating to the employee and not only to the personnel file kept in the personnel department. If (former) employees request the release of the personal file, it must be assumed that this means everything that has been recorded about them, regardless of where it is stored or kept.

However, personal notes of a superior are excluded from the right to information, as long as they are not shared with others (e.g. memory aids for staff meetings). It has not been conclusively clari-fied whether this also applies to e-mail correspondence about an employee between superiors. In our opinion, this would probably be covered, whereby the employer could possibly invoke overriding self-interest (cf. below).

The right of (former) employees to inspect investigation reports is also limited. The report can be kept under lock until the investigation is completed. After completion, the protection of the personal rights of the other employees requires that - if access is granted at all - only the passages concerning the person making the request are disclosed or the report is handed over with the passages blacked out. Alternatively, only the statements contained in the report may be disclosed to the person making the request in a separate document.

The law only gives employees a right to the edition of the personal data processed about them as such. This clarifies that not all documents (e.g. emails, contracts, [investigation-] reports) can be requested, but only the personal data as such (e.g. the statements about the requesting employee contained in the emails and reports).

 

C) Restriction of the right to information

According to Art. 26 DPA, a restriction of the right to information is basically possible for four reasons: (a) in the case of manifestly unfounded requests, (b) based on a formal law, (c) in the case of overriding third-party interests or (d) in the case of overriding self-interests of the data controller.

If the right to information is restricted, refused or postponed, the employer must disclose this to the person making the request and state the reasons. The employer must choose the least restrictive mean, i.e. the information should only be restricted to the extent that this is indispensable. If the overriding interests of third parties or the employer are at stake, these must be carefully weighed against the interests of the requesting employee.

a) Restriction of the right to information in the case of a manifestly unfounded request

Information may be refused if the request for information is manifestly unfounded, namely if it pursues a purpose contrary to the purpose of data protection, or if it is manifestly querulous. If (former) employees submit a request for information solely for the purpose of obtaining evidence for a possible civil lawsuit, the employer may refuse to provide the information because the purpose of the request is contrary to data protection. However, it is the case that the employer will rarely have certainty about any motives of the (former) employee that are contrary to the purpose of data protection. The Federal Supreme Court is strict on this issue and in its previous case law has set high standards for the qualification of a request for information as an abuse of rights.

If (former) employees make their request for information following an employer's dismissal and possibly in connection with a specific claim (e.g. in the same letter as the claim for a bonus or the claim that the dismissal was unfair), or if the request for information is very extensive (e.g. all doc-uments, notes, e-mails, etc. concerning the employee), there may be a suspicion that the request for information is contrary to the purpose of data protection. In such cases, depending on the cir-cumstances, it may be advisable for the employer to ask the person making the request what data protection interest he or she is asserting or to refuse to provide the information, pointing out that the request for information is not for the purpose of data protection. The specific procedure in each individual case must be carefully examined.

b) Restriction of the right to information based on a law in the formal sense

If a formal law provides that no information is to be provided, the information may also be refused, restricted or postponed. This applies, for example, if the refusal to provide information protects a professional secret. In connection with the employment relationship, this restriction should only apply in special cases; for example, in the case of an employment relationship with a bank, if the personnel file also contains customer information. In such a case, either the removal of the rele-vant documents (with a corresponding notice to the person making the request) or, as a more lenient measure, the redaction of the relevant data could be considered.

c) Restrictions on the right to information in the case of overriding third-party interests

The right of (former) employees to information may also be restricted in the case of overriding third-party interests (e.g. of other employees). This is the case, for example, if the employee requesting the information also receives information on third parties (e.g. witness statements in an investigation report) and their interests may be affected as a result. When deciding on the restriction of the right to information due to overriding third-party interests, the interests of the requesting employee must be weighed against the interests of third parties (e.g. other employees). 

d) Restrictions on the right to information in the case of overriding self-interest

Finally, the right of (former) employees to information may also be restricted if the employer's own interests prevail. Overriding self-interests of the employer include, for example, business secrets, information for the formation of internal opinions, excessive efforts.

The invocation of overriding self-interest is only possible if the data is not shared with third parties. Other group companies are not considered third parties. Based on previous practice, processors that process data on behalf of the controllers or joint data controllers are also not considered third parties. However, if the relevant data is regularly shared with third parties, such as a supervisory authority (e.g. Finma), a licensing authority or other authorities, the employer cannot restrict the right to information by invoking overriding self-interest.

 

D) Penal provisions

If an employer intentionally provides false information to (former) employees, he or she can be punished upon request. Employers are also liable to prosecution if they provide incomplete information and give the impression that the information is complete. For this reason alone, an employer should not provide a declaration of completeness. The fine in both cases is up to CHF 250,000, with the person responsible for the violation being sanctioned. In the case of legal entities, it is the management and not the internal employees who are responsible.

If the employer does not comply with the request for information at all, the employer remains unpunished. In such cases, however, the person making the request can enforce his or her right to information in court.

 

E) Overview of the legal adjustments to the right to information under the new DPA

• Extension of the right to information (Art. 25 DPA). Information must be provided about the following:

  • Identity and contact details of the data controller;
  • Processed personal data as such;
  • Processing purpose;
  • Retention period of the personal data, or if not possible, the criteria for determining this period;
  • Available information on the origin of the personal data, insofar as it was not obtained from the data subject;
  • Possible existence of an automated individual decision and logic on which the decision is based;
  • Recipients or categories of recipients of data when personal data is exported abroad.

• Legal clarification that the right to information only applies to data as such. There is no right to the surrender of entire documents.

• Adaptation of the grounds for refusal, restriction or deferral of information (Art. 26 DPA). Possible reasons:

  • Legal basis, e.g. for the protection of professional secrecy
  • Overriding interests of third parties
  • Obviously unfounded request for information (purpose contrary to data protection or of a querulous nature)
  • Overriding self-interest of the person responsible, insofar as no disclosure to third parties takes place.

• Increased penalty for a deliberate violation of the right to information (in particular false or incomplete information). A fine of up to CHF 250,000 can now be imposed.

 

F) Conclusion and recommendations

Employees also have a comprehensive right to information under the new Data Protection Act. This right is intended to give employees the opportunity to check whether their personal data is being processed in accordance with data protection law. If an employee's request for information is made for purposes that do not comply with data protection law, the information can be refused. The right to information can also be restricted for other reasons. We therefore advise employers to carefully examine the specific procedure for each request for information.