1 Federal bodies may only process personal data if there is a statutory basis for doing so.
2 A statutory basis in a formal law is required in the following cases:
- a.
The matter involves the processing of sensitive personal data.
- b.
The matter involves profiling.
- c.
The purpose or manner of the data processing may lead to a serious violation of the data subject's fundamental rights.
3 A statutory basis in a substantive law is sufficient as the basis for processing personal data under paragraph 2 letters a and b provided the following requirements are satisfied:
- a.
Processing is essential for a task required by a formal law.
- b.
The purpose of processing poses no particular risks to the data subject's fundamental rights.
4 In derogation from the paragraphs 1–3, federal bodies may process personal data if any one one of the following requirements is satisfied:
- a.
The Federal Council has authorised the processing because it considers that the data subject's rights are not at risk.
- b.
The data subject has consented to the processing in the specific case or has made their personal data generally accessible and has not explicitly prohibited any processing.
- c.
The processing is necessary in order to protect the life or physical integrity of the data subject or of a third party, and it is not possible to obtain the consent of the data subject within a reasonable time.