On complaint, a fine not exceeding 250,000 francs shall be imposed on private persons who wilfully:

• a. disclose personal data abroad in violation of Article 16 paragraphs 1 and 2 without satisfying the requirements of Article 17;
• b. assign the data processing to a processor without satisfying the requirements of Article 9 paragraphs 1 and 2;
• c. fail to comply with the minimum requirements for data security stipulated by the Federal Council in Article 8 paragraph 3.