Article 20
Exceptions from the duty to provide information and restrictions
- The duty to provide information under Article 19 ceases to apply if one of the following requirements is satisfied:
- a. The data subject already has the information concerned.
- b. The processing is required by law.
- c. The controller is a private person who is required by law to preserve confidentiality.
- d. The requirements of Article 27 are satisfied.
- If the personal data is not collected from the data subject, the duty to provide information also ceases to apply if any one of the following requirements is satisfied:
- a. It is not possible to provide the information.
- b. Providing the information requires disproportionate effort.
- The controller may restrict, delay or dispense with the communication of the information in the following cases:
- a. It is required to do so because of overriding third party interests.
- b. Providing the information defeats the purpose of the processing.
- c. The controller is a private person and the following requirements are satisfied:
- The controller is required to do so because of its own overriding interests.
- The controller does not intend to disclose the personal data to third parties.
- d. The controller is a federal body and any one of the following requirements is satisfied:
- The measure is required to satisfy overriding public interests, in particular to protect Switzerland's internal or external security.
- The communication of the information may compromise an enquiry, an investigation or administrative or judicial proceedings.
- Legal entities that belong to the same group of companies are not third parties within the meaning of paragraph 3 letter c number 2.