Anyone who processes personal data must ensure that they are correct. They must take all reasonable steps to ensure that data which is incorrect or incomplete in relation to the purpose for which it was collected or processed is corrected or destroyed. Any person concerned may request that inaccurate data be corrected. What this means in practice is illustrated by a recent decision of the Swiss Federal Administrative Court (moneyhouse.ch).
The court decision «moneyhouse.ch»
With its now legally binding decision A-4232/2015 of 18 April 2017, the Federal Administrative Court (FAC) is taking a stand on an action brought by the Federal Data Protection and Information Commissioner (FDPIC) against Moneyhouse AG, which belongs to the NZZ Media Group, and its processing of personal data in the context of the digital credit agency (in particular credit checks) moneyhouse.ch. The decision strengthens data protection and the protection of the persons concerned in Switzerland, which corresponds to a trend in the EU.
According to FADP 12, anyone who processes personal data may not unlawfully violate the personality of the persons concerned. According to FADP 13 I, a violation of personality is unlawful if it is not justified by the consent of the person concerned, by an overriding private or public interest or by law. According to FADP 13 II c, an overriding interest of the data processor comes into consideration in particular if, in order to check the creditworthiness of another person, the data processor does not process personal data or personality profiles that are particularly worthy of protection and only discloses to third parties data that they require for the conclusion or processing of a contract with the person concerned. According to the FAC, this includes the surname, first name, date of birth and place of residence of the person to be checked. In this context, however, these data may not be linked to information such as residential and living situations, household members and neighbours, as has been the practice of Moneyhouse to date. The latter would lead to personality profiles whose publication is only permitted with the explicit, purpose-related consent of the persons concerned, which Moneyhouse does not obtain for economic reasons. Moneyhouse must therefore adapt its practice accordingly. In addition, Moneyhouse was obliged by the FAC based on FADP 5 and 7 to regularly check its data stock for accuracy. Finally, Moneyhouse must forward requests for information according to FADP 8, which refer to databases of third parties, without further ado to these for answering.