Data protection and banking secrecy in the age of artificial intelligence

The revised Federal Act on Data Protection

The Federal Act on Data Protection of 25 September 2020 (FADP) entered into force on 1 September 2023 and replaced the act of 1992.¹ The revision aligned Swiss law with the European Union's General Data Protection Regulation (GDPR) and with the modernized Council of Europe Convention 108. It kept a number of Swiss particularities: the act protects only natural persons, it relies more on criminal sanctions against individuals than on administrative fines against companies, and it formulates many duties in more general terms than the GDPR.² The FADP is technology-neutral. It contains no special chapter on artificial intelligence, but several of its provisions apply directly to automated processing and were drafted with such processing in mind.

The Federal Data Protection and Information Commissioner (FDPIC) clarified the point in a statement of 9 November 2023. The FADP, in force since 1 September 2023, "is directly applicable to AI-supported data processing", and "the data protection provisions already in force must be complied with". Manufacturers, providers and users of artificial intelligence systems must make transparent the purpose, functioning and data sources of the processing. Data subjects have a right to know whether they are speaking or corresponding with a machine and how their data are used. They may object to automated processing and may request that an automated individual decision be reviewed by a natural person. High-risk processing requires a data protection impact assessment, and the Commissioner considered applications such as real-time facial recognition in public spaces and comprehensive "social scoring" to be incompatible with the act.³

The provisions that matter for financial institutions

For a Lugano bank or asset manager the following provisions of the FADP are the most relevant when artificial intelligence is used:

● Privacy by design and by default (Art. 7 FADP): the controller must design processing so that the data protection principles are respected from the planning stage.

● Processing by processors (Art. 9 FADP): processing may be delegated by contract only if the processor processes the data as the controller itself would be entitled to, and no statutory or contractual duty of confidentiality prohibits the delegation.

● Disclosure abroad (Art. 16 and 17 FADP): personal data may be disclosed abroad if the Federal Council has determined that the State concerned provides adequate protection, or if appropriate safeguards such as standard contractual clauses exist.

● Duty to inform (Art. 19 FADP) and the duty to inform about automated individual decisions (Art. 21 FADP): when a decision based exclusively on automated processing produces legal effects or significantly affects the data subject, the data subject must be informed and may request a review by a natural person.

● Data protection impact assessment (Art. 22 FADP) for processing likely to result in a high risk to the personality or fundamental rights of the data subject. ● Notification of data security breaches to the FDPIC (Art. 24 FADP).⁴ Article 21 deserves particular attention. A decision on whether to accept a client, to grant a loan or to block a payment can be an automated individual decision if no human makes a substantive assessment. Most Swiss institutions avoid the issue by ensuring that a person reviews and takes the final decision, which is also what FINMA expects for compliance decisions. Where an institution uses fully automated credit decisions, for example in consumer lending or in card limits, it must inform the client and offer human review.⁵

The sanctions of the FADP are directed at individuals. A private person who intentionally violates certain duties of information, cooperation or diligence, including the rules on disclosure abroad and on processors, can be fined up to CHF 250,000 on complaint (Art. 60 to 61 FADP). Under Art. 64 FADP the enterprise can be fined in place of the individual, up to CHF 50,000, where identifying the responsible person would require disproportionate investigative effort.⁶ The personal exposure of compliance officers, IT managers and members of management is one reason why Swiss institutions approach data protection in artificial intelligence projects with caution.

Notes

1. Federal Act on Data Protection of 25 September 2020 (Data Protection Act, FADP), SR 235.1, in force since 1 September 2023, English text at https://www.fedlex.admin.ch/filestore/fedlex.data.admin.ch/eli/cc/2022/491/20230901/en/html/ fedlex-data-admin-ch-eli-cc-2022-491-20230901-en-html-1.html. Entry into force also confirmed by the FDPIC statement cited below. ↩
2. FADP (above), Art. 2 para. 1 (the act applies to "the processing of personal data of natural persons") and Art. 60–66 (criminal provisions, with fines on private persons and, under Art. 64, only subsidiarily on the undertaking). ↩
3. Federal Data Protection and Information Commissioner (FDPIC), "Current data protection legislation is directly applicable to AI" (9 November 2023), https://www.edoeb.admin.ch/edoeb/en/home/kurzmeldungen/2023/20231109_ki_dsg.html. ↩
4. FADP (above), Art. 7 (data protection by design and by default), 9 (processing by processors), 16 (principles for disclosure abroad), 17 (exceptions), 19 (duty to provide information), 21 (automated individual decisions), 22 (data protection impact assessment) and 24 (notification of data security breaches). ↩
5. FADP, Art. 21 para. 1 (duty to inform about a decision "based exclusively on automated processing" with "a legal consequence for or a considerable adverse effect on the data subject") and para. 2 (the data subject may "request that the automated individual decision be reviewed by a natural person"); on FINMA's expectations see Guidance 08/2024 (above). ↩
6. FADP, Art. 60 and 61 (fines of up to CHF 250,000 on private persons) and Art. 64 (the undertaking may be ordered to pay a fine of up to CHF 50,000 where identifying the responsible person would require disproportionate measures); prosecution by the cantons, with the FDPIC entitled to file a complaint (Art. 65). ↩

For general information only. This article does not constitute legal or tax advice, does not replace advice on an individual case and creates no lawyer-client relationship. It reflects the legal position as of August 2025.