1 The duty to provide information under Article 19 ceases to apply if one of the following requirements is satisfied:
- a.
The data subject already has the information concerned.
- b.
The processing is required by law.
- c.
The controller is a private person who is required by law to preserve confidentiality.
- d.
The requirements of Article 27 are satisfied.
2 If the personal data is not collected from the data subject, the duty to provide information also ceases to apply if any one of the following requirements is satisfied:
- a.
It is not possible to provide the information.
- b.
Providing the information requires disproportionate effort.
3 The controller may restrict, delay or dispense with the communication of the information in the following cases:
- a.
It is required to do so because of overriding third party interests.
- b.
Providing the information defeats the purpose of the processing.
- c.
The controller is a private person and the following requirements are satisfied:
- 1.
The controller is required to do so because of its own overriding interests.
- 2.
The controller does not intend to disclose the personal data to third parties.
- 1.
- d.
The controller is a federal body and any one of the following requirements is satisfied:
- 1.
The measure is required to satisfy overriding public interests, in particular to protect Switzerland's internal or external security.
- 2.
The communication of the information may compromise an enquiry, an investigation or administrative or judicial proceedings.
- 1.
4 Legal entities that belong to the same group of companies are not third parties within the meaning of paragraph 3 letter c number 2.