Crash course on the Act · Part 7 of 12
Data protection in healthcare, finance, work and school
The FADP applies across all sectors. In many areas, however, there are additional special laws that are stricter or take precedence.
Healthcare
Health data is sensitive personal data (Art. 5 let. c). Doctors, pharmacists, psychologists and other health professionals are also bound by professional secrecy, which is protected under criminal law (Art. 321 SCC).
- You are entitled to access your patient data; with your consent, it can also be communicated to you through a health professional of your choice (Art. 25 para. 3).
- Private practices and private clinics are subject to the FADP; cantonal and municipal hospitals are subject to cantonal data protection law.
Banks and insurance companies
In addition to the FADP, banks are subject to banking client confidentiality (Art. 47 of the Banking Act): anyone who discloses client data without authorisation commits a criminal offence. You can also request access to your data from banks and insurance companies. For credit checks, the FADP sets explicit limits: an overriding interest can only be considered if no sensitive data is processed, the data is no more than ten years old and the data subject is of age (Art. 31 para. 2 let. c).
The workplace
Employers may only process data about employees insofar as it concerns their suitability for the employment relationship or is necessary for performing the employment contract (Art. 328b CO). Questions about private life, religion or family planning are therefore generally not permitted.
Monitoring and control systems intended to monitor the behaviour of employees in the workplace are prohibited (Art. 26 OLL 3). If such systems are necessary for other reasons, for example safety, they must be designed in such a way that they do not impair health and freedom of movement. You also have a right of access against your employer, for example to your personnel file.
Schools and authorities
State schools, municipalities and cantonal offices are subject to the cantonal data protection act; the point of contact is the cantonal or municipal data protection authority, not the FDPIC. Private schools and educational platforms, on the other hand, fall under the FADP. The FADP applies to federal authorities with stricter rules: they may only process personal data if there is a legal basis for doing so (Art. 34).
Look up definitions: Art. 5 FADP – Definitions – request your data: access.