The role of whistleblowers and stolen data

Read the PDF edition (2 pages)

The crisis of banking secrecy was fuelled by individuals who passed internal bank information to foreign authorities. Bradley Birkenfeld, a former UBS relationship manager, supplied the American authorities with the material that set the affair in motion, before receiving a reward of USD 104 million.¹ Hervé Falciani, an IT specialist at the Geneva subsidiary of a British bank, stole client data which were passed on to several European tax administrations.²

These affairs raised a difficult legal and moral question: the use by states of data obtained through an offence committed in Switzerland. Switzerland long refused to grant administrative assistance on the basis of stolen data, before relaxing its position where the data had been obtained by the requesting state without any active step on its part.³ It also strengthened the criminal sanctions for the disclosure and exploitation of unlawfully obtained banking data.

For the institutions, these affairs exposed the vulnerability of their systems and the importance of the loyalty of their staff. They also showed that the criminal protection of secrecy does not deter those who are prepared to bear the consequences, particularly where substantial foreign rewards are at stake. Genuine tax compliance on the part of the clientele, which deprives stolen data of their value, is the only lasting protection.

Notes

1. “Dix ans sans secret bancaire” (Ten years without banking secrecy), Le Temps, long-form feature, 2019. ↩
2. Wikipédia (fr), article “SwissLeaks”: the data stolen by Hervé Falciani at HSBC Private Bank (Suisse) were handed to the newspaper Le Monde in 2010 and then published by the ICIJ consortium in February 2015; Falciani was sentenced in absentia on 27 November 2015 to five years’ imprisonment for economic espionage. On the use of these data by the French authorities, see ATF 143 II 224. ↩
3. ATF 143 II 224 (judgment of 17 March 2017, commented on by trex.ch): assistance refused to France, whose request rested on the Falciani data even though it had undertaken not to use them (Art. 7 let. c of the Tax Administrative Assistance Act (LAAF), principle of good faith); Centre de droit bancaire et financier (Hirsch, 2 January 2019, cdbf.ch): in mutual assistance in criminal matters, the Federal Criminal Court requires the requesting authority to dispel the suspicion where serious indications suggest that the request rests on stolen banking data. ↩

For general information only. This article does not constitute legal or tax advice, does not replace advice on an individual case and creates no lawyer-client relationship. It reflects the legal position as of September 2025.