EDÖB/PFPDT/IFPDT (Switzerland) - EDÖB-A-26B43401/1
From GDPRhub
| EDÖB/PFPDT/IFPDT - EDÖB-A-26B43401/1 | |
|---|---|
 | |
| Authority: | EDÖB/PFPDT/IFPDT (Switzerland) |
| Jurisdiction: | Switzerland |
| Relevant Law: | Article 30 DSG Article 31 Article 6 DSG |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | 11.12.2023 |
| Decided: | 09.04.2024 |
| Published: | 20.10.2025 |
| Fine: | 3,750 CHF |
| Parties: | Bürgerforum Schweiz |
| National Case Number/Name: | EDÖB-A-26B43401/1 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | German |
| Original Source: | EDÖB (in DE) |
| Initial Contributor: | xz |
The DPA prohibited the provider of a platform comparing church personnel from publishing a list of church personnel which received a questionnaire about their religious beliefs.
English Summary
Facts
Bürgerforum Schweiz, a civil association (the controller) launched a campaign called “Pfarrer-Check” on its website to publicly question church personnel (the data subjects) about their personal faith. A questionnaire was used to assess the theological views of these data subjects and published information about them in an online database. Data subjects received the questionnaire from the controller or third parties.
The controller provided an online database contained data on about 6,000 data subjects. The database, accessible to anyone, contained personal details such as names, organizations, functions, postal codes, and response status. Specifically, each listed data subject was assigned a status: “recorded” (publicly known but not yet contacted), “requested” (contacted but no response or consent), or “answered” (responded and explicitly consented to publication). Nevertheless, thousands of names and response statuses without prior consent were included.
There was no requirement in the questionnaire or on the website that third parties asked for consent before sharing personal data of the data subjects with the controller. Likewise, data subjects that received the questionnaire were not asked whether they agree to have their data or response status.
The controller’s website hosted a general privacy policy that applies to all activities, not just Pfarrer-Check. The policy distinguished between public and non-public personal data, stating that public data could be used freely, while non-public data required explicit authorization. It granted a limited right to object, applying only to data subjects whose data were not publicly visible online. If the data subjects, whose addresses were publicly available, submitted a request to the controller to be deleted from the database, this request would not be granted.
Based on inquiries from the controller as well as various reports from data subjects, the EDÖB, the Swiss DPA, was made aware of the launched campaign of the controller. The EDÖB instructed the controller to comply with requests for objection or deletion from affected data subjects whose data is publicly accessible elsewhere and to ensure explicit consent before any publication, but the controller refused deletion requests from data subjects whose publicly available addresses appeared in the Pfarrer-Check database, arguing that publication served an overriding public interest.
Then, the DPA opened a formal investigation on December 11, 2023.
Holding
The DPA held that the controller violated Article 6 of the Swiss data protection act (“DSG”) in several respects.
The unsolicited publication of publicly available personal data combined with the status "recorded" in a publicly accessible database violates the principles of purpose limitation and recognizability. According to the principle of purpose limitation enshrined in Article 6 (3) DSG, personal data may only be processed in a manner that is compatible with the purpose for which the data was collected and which was apparent to the data subject.
The DPA mentioned that Article 30(3) DSG, which presumes that there is no violation of privacy if the data subject has made the personal data generally accessible and has not expressly prohibited its processing, does not apply to this data. The data subjects concerned did not make this data accessible themselves, but merely tolerated its disclosure by third parties, namely the parish for which they work. The processing of this data therefore violates the principle of purpose limitation.
Also, according to the principle of transparency enshrined in Article 6 (3) DSG, personal data may only be collected for a specific purpose that is recognizable to the data subject. The court argued that the controller obtained and published publicly available data before sending the "Pfarrer-Check" questionnaire to the data subjects concerned, violating the principle of recognizability.
Moreover, the data processing carried out by the controller must comply with the principle of proportionality under Article 6(2) DSG. It must therefore be suitable and necessary for achieving the purpose of the processing and must be reasonable for the persons concerned. The court claimed that listing data subjects in the database with the status "recorded" or "requested" was not necessary for the processing purpose and was disproportionate.
The aforementioned violation of data processing principles constitutes a violation of personal rights under Article 30(2) DSG and the DPA held that there was no overriding private or public interest in disclosing the exact status of the request on a personal basis, nor was there any apparent overriding private or public interest that could justify a violation of the principles of purpose limitation or transparency, taking into consideration Article 19 and 20 DSG.
Accordingly, the controller was, from now then, prohibited from listing data subjects in the "Pfarrer-Check" database in combination with the status "recorded" or "requested" without valid consent and existing entries must be deleted unless legally valid consent obtained from the data subjects concerned. Also requests for deletion submitted by data subjects whose data have already been published elsewhere and who are listed in the "Pfarrer-Check" database with the status "recorded" or "requested" must be implemented. Finally , the controller was ordered to pay a fee of CHF 3,750(€3,900).
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Federal Data Protection and Information Commissioner
FDPIC
Data Protection
Data Protection Team 3
This decision has been appealed to the Federal Administrative Court
and is not yet legally binding.
Decision
of April 9, 2024
in the matter of
Investigation pursuant to Art. 49 of the Federal Act on Data Protection (Data Protection Act, DPA;
SR 235.1)
against
Citizens' Forum Switzerland, Kornamtsweg 8, 8046 Zurich
(Party in the proceedings)
concerning data processing within the framework of the "Pastor Check" campaign
Feldeggweg 1
3003 Bern
Tel. +41 58 463 74 84, Fax +41 58 465 99 96
www.edoeb.admin.ch
FDPIC-A-26B43401/1A. Facts
I. Subject of the Investigation
1. The subject of this investigation is whether the association Bürgerforum
Switzerland, in processing personal data in connection with the "Pastor Check" published on the website
https://www.buergerforum-schweiz.ch/pfarrer-check, violates federal
data protection regulations.
1. Basis
2. Bürgerforum Switzerland, an association pursuant to Art. 60 of the Swiss Civil Code (ZGB;
SR 210) (hereinafter: "Bürgerforum"), has set itself the goal of "publicly questioning church personnel about their
beliefs" (Evidence 1: Pastor Check website/search function "questioned
persons", p. 1). To this end, the association is running a PR campaign called "Pastor Check" on its website https://www.buergerforum-
schweiz.ch/pfarrer-check (see Evidence 1: Pastor Check website/search form "persons requested", p. 1; Evidence 2: Pastor Check website/campaign, p. 1).
3 By "church personnel," "Bürgerforum" means personnel in "Christian churches & organizations" (see Evidence 3: Pastor Check questionnaire, p. 1). According to
the information on the website, contrary to the campaign title "Pastor Check," not only pastors, but also church council members, professors, priests, and vicars are to be surveyed (see Evidence 1: Pastor Check website/search form "persons requested", p. 1).
3 4 The survey is conducted using a questionnaire available on the website (see below,
para. 9 ff.). The "Citizens' Forum" provides information on the status and results of the survey via a
database available on the website. This database allows users to obtain personal
information, among other things, on whether a specific church member has received the Pastor Check questionnaire
and whether and how they responded (see below, para. 24 ff.).
5 Regarding the campaign's objective, the "Citizens' Forum" website states: "The publicly presented
responses are intended to enable the public to distinguish between Christian churches and merely
supposedly Christian events... in order to draw personal
consequences, if necessary." (Evidence 4: Citizens' Forum website/entry page, p. 1).
6 A similar statement can be found in the questionnaire used to test church members.
In it, “Citizens’ Forum” points out that information about the individuals contacted and their responses will be published on its website – meaning in the database
hosted there – and justifies this as follows: “This allows one to get a picture
of the theological foundation of church congregations and Christian organizations…
and, if necessary, draw the appropriate conclusions.” (Evidence 3: Pastor Check questionnaire, p. 4).
7 The goal of the campaign is further specified on the Pastor Check website under the title
“Necessity and Objectives” (Evidence 5: Pastor Check website/Necessity and Objectives, p. 1). Among other things, it states: “The aim is to promote the public’s ability
to understand the quality of Christian churches, congregations, and organizations.” At the end
of the relevant statements, the following goals of the "Pastor Check" project are mentioned:
- "In public discourse, a clear distinction should once again be made between genuinely Protestant churches/organizations
and watered-down/fake offerings.
- Church members and interested parties should, based on improved information, have a
better choice regarding which church personnel they trust and in which churches they become involved.
- The social and political influence of churches that are merely imitations should be reduced.
2/15 - The public presence of genuinely Christian church personnel should be established and/or
intensified. In this way, the state should once again receive more of the necessary corrective and helpful
support that emanates from vibrant churches."
8 In the run-up to this investigation, "Citizens' Forum" refused to comply with the deletion requests of
publicly accessible individuals whose addresses do not wish to be listed in the "Pastor Check" database.
"Pastor Check" database. This is justified by an “undeniable,
overriding public interest in an unadulterated Christian religion in public discourse” (Exhibit 6: Letter from the Citizens' Forum dated September 11, 2023, p. 7).
2. Data Processing in Connection with the Questionnaire
9 For the purpose of surveying church personnel, the Citizens' Forum provides a questionnaire entitled “Pastor Check” on its website (see Exhibit 3: Pastor Check Questionnaire).
10 This “Questionnaire on the Quality of Personnel in Christian Churches & Organizations,” which
is also intended for priests, church council members, teachers, etc. (Evidence 3: Pastor Check Questionnaire, p. 1) encourages readers on page 3 to assess church personnel:
“[…] it is extremely important that you recognize who is capable of bringing God’s saving message.
If you want to assess church personnel, you can do so by asking these individuals the following questions on central topics of the Christian faith:”
11 A field follows in which the following information can be entered:
- Last name/First name:
- Church/Organization:
- Position:
- Postal code/City:
12 Following this is a catalog of eight questions. The answer to each question can be either
“Yes” or “No”. The questions are, in detail,
as follows (see Evidence 3: Pastor Check Questionnaire, p. 3):
1. “Is Jesus God incarnate?”
2. Did Jesus rise bodily from the dead?
3. Does the self-sacrifice of the crucified and risen Jesus alone grant humanity
forgiveness, salvation, peace with God, and eternal life?
4. Does the meaning of life consist in the believing reception of God's grace, love, and fatherhood,
in active love for God and fellow human beings, and in the growing
knowledge and worship of the triune God?
5. Is obediently following the biblical commandments the sole basis for a successful,
happy life in family, church, society, and state?
6. Can and will the Holy Spirit free people from selfishness, compulsions, addictions,
the consequences of abortion, fears, hatred, guilt, occult attachments, unnecessary illnesses, and
loneliness?
7. Does salvation come from the Jews?
8. Will God condemn those who reject His offer of forgiveness and salvation to the separation from God, the second death, at the
Last Judgment?
13 Below the questions, there is a note that “information on the correct answers” can be found on the
website www.buergerforum-schweiz.ch under the heading ‘Pastor Check’ (see
Exhibit 3: Pastor Check Questionnaire, p. 3). Under the heading “Pastor Check,” in the section
“Justification of Answers,” each question is answered with “yes,” and a justification is provided for each answer (see Exhibit 7: Pastor Check Website/Justification of Answers).
3/1514 On page 4 of the questionnaire, “Bürgerforum” recommends the following: “For one’s own benefit, one should
only follow the teachings of church personnel who answer questions 1–8 with ‘yes.’
Self-determined Christianity does not lead believers to the freedom and abundance of blessings that
God wishes to bestow. Moreover, eternal life in heaven exists only on God's conditions.
(Evidence 3: Pastor Check questionnaire, p. 4; cf. paragraphs 5 ff. above regarding the campaign's objective).
15 Regarding church personnel who do not answer the questions, the questionnaire states
the following: “Church life is a public matter. It is perfectly legitimate to question church personnel about their
faith. However,
people who do not answer a presented questionnaire should be treated with respect. Even good pastors, ministers, etc., will prefer not to answer the
questions of the provocative Pastor Check publicly. Perhaps they would be happy
to provide information in a private setting.” (Evidence 3: Pastor Check questionnaire, p. 4).
16 The following note is included: “The information on the individuals contacted and any responses they may provide
will be published on our website. This will allow people to gain insight into the theological
foundation of parishes and Christian organizations… and, if necessary, to draw the appropriate conclusions.” (Evidence 3: Pastor Check questionnaire, p. 4; cf. para. 6 above).
17 The questionnaire is sent directly by “Citizens’ Forum” to relevant groups of people.
In this context, “Citizens’ Forum” notes that the addresses of the contacted
pastors, church council members, professors, priests, vicars, etc., were freely accessible on the internet.
(Evidence 1: Pastor Check website/search term “persons contacted”, p. 1).
18 On the other hand, on page 4 of the questionnaire, "Bürgerforum" (Citizens' Forum) asks readers for their help
in distributing the "Pastor Check" within their own circles and specifically:
- informing "Bürgerforum" to whom they have given the Pastor Check.
These individuals will then be listed as "requested" on the website.
- sending the responses received to "Bürgerforum" by mail or email: info@buergerfo-
rum-schweiz.ch (see also Evidence 3: Pastor Check Questionnaire, p. 4).
19 Whether individuals to whom the "Pastor Check" questionnaire has been given (for example,
by a neighbor on the street) actually take note of its contents remains unclear. Furthermore,
neither the website Pfarrercheck nor the questionnaire stipulates that
a third party distributing the questionnaire to a church member must ask them for permission to disclose their personal information (see paragraph 18 above) to Bürgerforum.
20 Likewise, neither the Pfarrercheck website nor the questionnaire stipulates that individuals who receive a questionnaire from Bürgerforum or a third party are asked whether they agree to have their personal information, along with their survey status (e.g., "requested"), published in the online database.
21 Those who answer the Bürgerforum questionnaire have no way of consenting to the publication of their answers by checking a box (or similar means). On the website
of "Bürgerforum," however, the following note can be found: "Incoming responses will be entered
and published after explicit permission has been granted by the individuals contacted."
(cf. Evidence 1: Pfarrercheck website/search form "individuals contacted," p. 1).
22 On its website, "Bürgerforum" published an unsigned version of the letter to the FDPIC dated September 11, 2023, under the heading "Review," which differs in content
from the version submitted to the FDPIC. It states:
"Due to the proactive nature of the campaign, it was clear from the outset that initially only
a few people would submit their responses and give their consent for publication. Any further responses received will only be published after direct contact with
the respondent and with their explicit permission." Of course, such consent is archived by us so that the consent can be demonstrated at any time.
Evidence 8: published letter from "Bürgerforum" dated September 11, 2023, p. 7, which was not delivered to the FDPIC;
see Evidence 9: Bürgerforum website/section "Review", p. 1).
23 According to the statement from "Bürgerforum" dated January 4, 2024, the inquiry as to whether a submitted response may be published is made exclusively in writing, and consent is only accepted in writing.
The email correspondence concerning the preparation and approval of the publication of received responses is archived (see Evidence 16: Bürgerforum statement dated January 4, 2024, answers to questions 1, p. 2).
According to the statement from "Bürgerforum" dated January 4, 2024, the inquiry as to whether a submitted response may be published is made exclusively in writing, and consent is only accepted in writing.
The email correspondence concerning the preparation and approval of the publication of received responses is archived (see Evidence 16: Bürgerforum statement dated January 4, 2024, answers to questions 1, p. 2). 3. Data Processing in Connection with the Database
24 A database is available on the "Citizens' Forum" website (see Exhibit 10:
Screenshot of Database Overview). According to "Citizens' Forum," it contains
information on approximately 6,000 people from all over German-speaking Switzerland who will be contacted in a
first project phase starting in May 2023 (Exhibit 1: Pastor Check website/search form
"persons contacted," p. 1). According to "Citizens' Forum," by September 11, 2023,
approximately 3,717 people had been "personally contacted" (see Exhibit 6: Letter from Citizens' Forum dated
September 11, 2023, p. 7, p. 2). These individuals are—in the words of "Citizens' Forum"
so-called "church personnel" (see above, para. 3).
Citizens' Forum 25. The database allows for personalized queries to determine whether "Citizens' Forum" has recorded a specific
person (status: recorded), whether a specific (recorded) person has received the "Pastor Check"
questionnaire (status: requested), and whether they have answered the questions
(status: answered). Published answers (and thus the information about the person who
provided the answer) can be directly clicked and viewed. To date,
two answers have been published; one of them is from a co-founder of the Pastor Check
(see Exhibit 11: Screenshot of the database with the status "answered").
26. The database can be accessed via the following two search fields (see Exhibit 10: Screenshot of the database overview):
- "Who (First / Last Name)"
- "Where (Postal Code / City / Canton (Abbreviation) / Organization)".
27 If filling out one of these search fields yields a match, the database provides the following additional information, in addition to the first
and last name of the person(s) found, for the purpose of providing an overview (see Exhibit 12: Screenshot of the database with the status "recorded" and "requested"):
- "Organization / Denomination"
- "Task / Field of Activity"
- "Postal Code / City"
- the status of the data processing, i.e., "recorded," "requested," or "answered."
28 When a found person is clicked, the "Service Category" (e.g., "Teacher" or "Clerical
Pastoral Office") appears in addition to the data mentioned in the preceding
paragraph (see Exhibit 13: Screenshot of the database with details of the found person).
29 The status "recorded" is assigned to individuals whose addresses are freely accessible on the internet,
but who have not yet received a questionnaire.
30 The status "requested" is assigned to individuals to whom "Citizens' Forum" has sent a questionnaire
or to whom a third party has given a questionnaire, but who have not yet responded (at the time
the status is entered into the database).
This status is also assigned to those individuals who have provided an answer but have not yet expressly consented to the publication of their answers (see Evidence 16:
Citizens' Forum statement of January 4, 2024, answers to questions 2, pp. 2-3).
31 The entry in the database, combined with the status "recorded" or "requested,"
occurs for persons whose addresses are publicly available, without "Bürgerforum" requesting prior consent from the
church members concerned. If the persons concerned submit a request to "Bürgerforum" to be deleted from the database, this request is
not granted (see Evidence 6: Letter from Bürgerforum dated September 11, 2023, p. 7).
32 However, if the association receives data from persons whose addresses are not publicly available,
according to "Bürgerforum," these persons are only recorded in the database with the status "requested" "after unambiguous identification and consent" (see Evidence 16: Statement from Bürgerforum dated January 4, 2024, answers to questions 3, p. 3).
If a person whose data is not publicly listed requests its deletion from the database,
Citizens' Forum complies with this request immediately (see ibid., Answers to Questions 3, p. 3).
33 The status "answered" (regardless of whether their addresses are publicly available elsewhere or not) is only given to those persons who have answered a received questionnaire and have also expressly consented to the publication of their answers (see Evidence 16: Citizens' Forum Statement of January 4, 2024, Answers to Questions 2, p. 2).
Evidence 16: Citizens' Forum Statement of January 4, 2024, Answers to Questions 2, p. 2). 34 Responses received will be published in accordance with the Pfarrercheck website and the letter from Bürgerforum dated
September 11, 2023, published under the heading "Review" (which was not delivered to the FDPIC), if the person contacted has given their prior express consent to publication (see paragraphs 21 et seq. above). If the clergy member revokes their express consent to the publication of the responses, Bürgerforum will delete the responses and reassign the person's status to "inquired" (see Evidence 16:
Statement from Bürgerforum dated January 4, 2024, answers to questions 3, p. 3).
... 4. Excursus: Information in the Privacy Policy
35 On the website of "Bürgerforum" (Citizens' Forum), there is a privacy policy – separate from the topic of "Pfarrer-Check" (Church Priest Check) –
Exhibit 14: Screenshot of the Bürgerforum homepage. In it, "Bürgerforum"
distinguishes between the processing of personal data that is already publicly
accessible and data that is provided to "Bürgerforum" by third parties:
36 Regarding publicly accessible personal data, "Bürgerforum" mentions that the association
collects "data of persons whose names, email addresses, functions, etc. are already publicly
accessible (politicians, church personnel, etc.)", stores it in a database,
and uses it for its PR work (see Exhibit 15: Bürgerforum Privacy Policy, In-
gress).
37 Regarding non-public data, the privacy policy states the following: “Data of persons
whose names, email addresses, function, etc. are not already publicly accessible,
may only be provided to us if this has been expressly authorized, and if
this personal data is correct. For security reasons, such persons will subsequently be asked by
us for their personal consent to the inclusion of their data in a mailing list
of the Citizens' Forum.” (Evidence 15: Citizens' Forum Privacy Policy,
Ingress). According to the "Citizens' Forum," this applies analogously to information about a requested person
that third parties provide to the "Citizens' Forum" in connection with the "Pastor Check":
Since non-public individuals have the right to refuse, their data (name, organization/denomination, role/field of activity, service category, status) will only be published in the "Pastor Check" database after their prior consent (see Evidence 16:
Statement by the Citizens' Forum dated January 4, 2024, answers to questions 5, p. 3).
Section 6/1538, paragraph 3 of the data protection declaration states: "Personal data will not be published unless
this data was already publicly available or was transmitted to us within the framework of the
"Pastor Check" project with appropriate authorization." According to the "Citizens' Forum," the "corresponding legitimation" refers to the consent of a non-public person mentioned in the aforementioned marginal note,
that their data should appear in the "Pastor Check" database (Evidence 16: Citizens' Forum statement of January 4, 2024, answers to questions 6, p. 3).
39 Section 5 of the data protection declaration states: "Persons whose data is not accessible on the internet due to their public function have the right to object to data processing."
... II. Procedural History
40 Following inquiries from "Bürgerforum" on May 16, 2023, and August 24, 2023, and
as a result of various reports from citizens, the Federal Data Protection and Information Commissioner (FDPIC) became aware of the "Pastor Check" published online by
"Bürgerforum": Pastor Check: Bürgerforum
Switzerland (buergerforum-schweiz.ch). He affirmed that "Bürgerforum" is obligated to grant the
objection or deletion requests of affected individuals (pastors, etc.) whose data is publicly accessible elsewhere and who do not wish to be listed in the online "Pastor Check" database, and informed "Bürgerforum" of this in a
letter dated August 31, 2023. He also requested adjustments to be made regarding
explicit consent to the publication of responses.
41 In its reply dated September 11, 2023, “Bürgerforum” stated that it would not comply with the deletion
requests of data subjects whose data were already publicly recorded elsewhere,
because publication in the “Pfarrer-Check” database was justified by an overriding public interest.
Since the FDPIC saw sufficient indications of a data protection breach in this procedure, it opened an investigation on December 11, 2023,
pursuant to Article 49 of the Data Protection Act, and sent “Bürgerforum” a written statement of facts to ensure its right to be heard.
“Bürgerforum” responded to this in a timely written statement dated January 4, 2024. The order is based
on the facts established on December 11, 2023, as amended by the statement of January 4,
2024.
B. Considerations
I. Formalities
1. Applicability of the Data Protection Act (DSG)
42 The DSG applies to the processing of personal data of natural persons by private individuals and federal bodies (see Art. 2 para. 1 DSG). "Bürgerforum" is organized as a private association within the meaning of the Swiss Civil Code (ZGB) and thus constitutes a private individual within the meaning of Art. 2 para. 1 letter a DSG.
It processes personal data of clergy and other natural persons using the online questionnaire and the online database, i.e., information relating to a specific or identifiable natural person (see Art. 5 letter a DSG).
There are no grounds that would preclude the applicability of the Data Protection Act (see Art. 2 para. 2 DPA).
Therefore, the DPA is applicable in both personal and material terms. The data processing activities to be assessed also fall within the geographical and temporal scope of the DPA.
7/152. Prerequisites for Opening an Investigation
43 According to Art. 4 para. 1 DPA, the Federal Data Protection and Information Commissioner (FDPIC) supervises the application of federal data protection regulations. He opens an investigation ex officio or upon notification against a federal body or a private individual if there are sufficient indications that data processing could violate data protection regulations (Art. 49 para. 1 DPA).
44 In the present case, “Bürgerforum” stated in its reply of 11 September 2023 to the
FDPIC that it does not intend to remove data subjects whose data is also publicly accessible elsewhere from the online database, despite their requests for erasure or objections, because it considers the data processing justified by an overriding public interest.
However, the FDPIC does not recognize, in the case of a data subject’s request for erasure, an overriding public interest that could justify the entry of this person in the database.
There are therefore sufficient indications that the data processing by “Bürgerforum” violates data protection regulations (see Art. 49 para. 1
FADP).
II. Substantive Issues
1. Foundations
45 The FADP aims to protect the personality and fundamental rights of natural persons whose personal data is processed (see Art. 1 FADP). In its private law
part, the Data Protection Act (DSG) supplements and specifies the protection of personality rights under the
Swiss Civil Code (ZGB) (see Federal Data Protection Act (DSG) message of March
1988, Federal Gazette 1988 II 413, 458; Federal Supreme Court Decision 127 III 481 E. 3/bb). When a
infringement of personality rights by a private data processor occurs in the area of data protection is set out in Art. 30 et seq.
DSG.
46 According to Art. 30 para. 2 DSG, an infringement of personality rights occurs in particular if
personal data is processed contrary to the principles set out in Art. 6 and 8 (letter a),
personal data is processed contrary to the express wishes of the data subject (letter b), or if particularly sensitive personal data is disclosed to third parties (letter c).
2. Compliance with Data Processing Principles
a. Principle of Purpose Limitation
47 According to the principle of purpose limitation enshrined in Art. 6 para. 3 of the Data Protection Act (DSG), personal data may
only be processed in a manner consistent with the purpose for which the data were
obtained and which was apparent to the data subject.
48 The "Citizens' Forum" obtains publicly published personal data of clergy and other
persons from the church environment, such as surname/first name, postal code/city/canton (abbreviation),
organization/denomination, role/field of activity, and service category. Art. 30 para. 3 DSG, which
presumes the absence of a violation of personal rights if the data subject has made the personal
data publicly accessible and has not expressly prohibited its processing,
is not applicable to this data. The affected pastors, etc., did not make this data accessible themselves,
but merely tolerated its accessibility by third parties –
namely the parish for which they work (cf. OILLAT/
WERLY, in: Meier/Métille (eds.), Commentaire Romand: Loi fédérale sur la protection des
données, Basel 2023, Art. 30 N 35). In the "Pastor-Check" database, the aforementioned
8/15 publicly published personal data are then placed in a new context ("Pastor-Check")
and supplemented with further data – namely the status "recorded", "requested", or "answered".
The personal data already published elsewhere is being processed for a different
purpose than was apparent to the data subjects at the time of initial publication – for example,
on the website of the parish for which they work. The processing
of this data therefore violates the principle of purpose limitation (see Art. 6 para. 3
DSG).
b. Transparency of data processing when the status is “recorded”
49 According to the transparency principle enshrined in Art. 6 para. 3 DSG, personal data may only be collected
for a specific purpose that is recognizable to the data subject.
The obligation to provide information regulated in Art. 19 also serves the purpose of transparency: According to Art. 19 DSG, the controller must
adequately inform the data subject about the collection of personal
data (para. 1) and provide the information necessary for them to exercise their
rights under this Act (para. 2), in particular the processing
purpose. If the controller does not obtain the data directly from the data subject and discloses it
before the expiry of one month from receipt of the data, the controller must inform the data subject no later than
at the time of disclosure of the data (see Art. 19 para. 5 GDPR).
50. The "Citizens' Forum" obtains publicly available data on clergy and other individuals
from the church environment and publishes this data—combined with the status "recorded"—in
the "Church Priest Check" database before sending the "Church Priest Check" questionnaire to the individuals concerned.
The fact that the "Church Priest Check" database already lists individuals "recorded" by the "Citizens' Forum" is not apparent from the questionnaire itself.
Furthermore, church members cannot be expected to consult the "Citizens' Forum" website.
Contrary to Art. 19 of the Data Protection Act (DSG), the individuals concerned are therefore not informed about the
collection of their personal data, and no grounds for exemption from the obligation to provide information within the meaning of Art. 20 of the DSG are apparent. Therefore, the data published elsewhere concerning individuals from
the church environment are not obtained for a purpose recognizable to the data subject,
and thus the principle of recognizability (cf. Art. 6 para. 3 GDPR) is violated.
c. Transparency of data processing with the status "requested"
51 Data subjects are recorded in the database with the status "requested" after
either "Citizens' Forum" itself or a third party has sent or delivered the "Pastor Check" questionnaire to them (see para. 30 above for further details).
52 The questionnaire contains the following note: "The information on the requested individuals
and any answers they provide will be published on our website." (Evidence 3: Pastor Check questionnaire, p. 4; see para. 16 above). The association "Bürgerforum" does not specify who it considers to be the "persons being surveyed" or exactly what information will be published.
Most importantly, the questionnaire does not inform users that the publication on the website
is carried out using a database that displays the current status of the survey on a personal basis.
53 Transparency of data processing means, beyond Art. 6 para. 3 of the Data Protection Act (DSG), that the important parameters of the data processing are identifiable (cf. the principle of good faith in Art. 6 para. 2 DSG). As shown in the preceding paragraph, this is not the case here.
9/15d. Principle of Proportionality
54 The data processing by "Bürgerforum" must comply with the principle of proportionality
(cf. Art. 6 para. 2 DSG). It must therefore be suitable and necessary to achieve the processing
purpose and be reasonable for the data subjects to accept.
Reasonableness is given if there is a reasonable relationship between the processing purpose and any necessary infringement of personal rights (cf.
re: Federal Data Protection Act (DSG) Message on the Federal Act on Data Protection (DSG), BBl 1988 II 413, 450).
55 Regarding the purpose of the "Pastor Check" database, the following can be stated: According to the
information provided by "Citizens' Forum," "church members and interested parties […] should have a better choice, based on the optimized level of information, regarding which church personnel they
trust and in which churches they become involved" (Evidence 5: Website
Pastor Check/Necessity and Objectives, p. 1; cf. above, para. 7). It should therefore be publicly
described whether a specific pastor or professor shares the religious
views of "Citizens' Forum" or not. Any deviation from its own views is viewed very negatively by the Forum
(see Evidence 3: Pastor Check Questionnaire, p. 4; above, para. 14).
56 Whether a specific person shares the views of the "Citizens' Forum" or not becomes clear when
they have answered the questionnaire and the answers (with their express consent) are published in the database (see above, paras. 21 et seq.).
57 However, the "Citizens' Forum" does not only publish in its database the data (including the status)
of persons who have answered the questionnaire (and expressly consented to the publication of the answers). Rather, the database also contains the data (including status)
of persons who have merely been registered or contacted.
58 However, insofar as "Citizens' Forum" aims to enable reliable statements about whether a
specific person shares its religious views, the publication of individuals who have not yet received or answered the
questionnaire – including the status "recorded" or "requested" – is not a suitable and therefore not a necessary means of achieving this aim:
59 The status "recorded" simply means that "Citizens' Forum" has included the data of the
person in question in the database (see paragraph 29 above).
60 The status "requested" merely indicates that a
questionnaire has been sent or delivered to the
person in question and no response has been received (see paragraph 30 above). Whether
a response might still be received or why a response has not been received cannot be objectively
assessed. "Citizens' Forum" itself states in its questionnaire that even "good priests,
pastors, etc." will prefer not to answer the questions of the provocative Pastor Check publicly
(see Evidence 3: Pastor Check Questionnaire, p. 4; above, para. 15).
61 To enable reliable statements about religious attitudes, it would therefore
suffice to indicate in general terms which groups of people have received or will receive the Pastor Check (see above, para. 24) and to publish only the data of those
who answered the questionnaire and have also expressly
consented to the publication of their answers. In other words, listing church personnel in combination with the status
"recorded" or "requested" is neither suitable nor necessary to enable
a reliable statement about religious attitudes.
62 Moreover, pastors (etc.) as public figures must
accept being confronted with questions such as those from "Citizens' Forum". They
are, however, not obligated to comment on this, especially since "Citizens' Forum" negatively assesses
deviations from its own convictions per se and conducts the survey
in the interest of showing the public who is a "good" pastor and who is not.
10/15 If "Citizens' Forum" publishes personal data with the purpose of enabling a public
discourse about the views of "Citizens' Forum," its survey project, and the handling
of church personnel with it, the personal data of the individuals surveyed is of only limited public interest.
The exact same discourse could
take place if "Citizens' Forum" were to provide information without reference to individuals about which
people received the pastor check, how many of these people returned the questionnaire,
and how many responses were received—in other words, if its database
only showed those individuals who answered the questionnaire and expressly consented to
publication of their responses. The inclusion in the database
with the status "recorded" or "requested" would therefore be unnecessary and thus disproportionate, even with regard to such a processing purpose.
63 Finally, a person listed in the database with the status "requested"
faces the risk of being labeled a potentially bad pastor based on speculation about their religious beliefs (indirect shaming). For all these
reasons (see paragraphs 58-63), the publication of persons with the status "recorded" or
"requested" violates the principle of proportionality (see Art. 6 para. 2 GDPR).
3. Justification
64 The aforementioned violation of data processing principles constitutes a violation of personal rights (see Art. 30 para. 2 let. a GDPR). Violations of personal rights are unlawful (see Art. 30 para. 1 GDPR), unless they are justified by consent, an overriding private or public interest, or by law (see Art. 31 para. 1 GDPR).
According to the Federal Supreme Court's jurisprudence, justifications for violations of data processing principles can only be affirmed with great reluctance (see BGE 136 II 508 E. 5.2.4; see also, for example, BGer 6B_68/2023, of October 9, 2023, E. 2.1.2).
a. No overriding private or public interest
65 Without obtaining prior legally valid consent, the publication of individuals
with the status "recorded," "requested," or "answered" is only compliant with data protection regulations if this is
justified by an overriding private or public interest (see Art. 31 GDPR).
A legal basis for the data processing by "Bürgerforum" is not applicable.
Before publishing responses (combined with the status "answered"), "Bürgerforum" obtains explicit consent from the data subjects (see above, para. 21 et seq.;
see also Art. 5(c)(1), Art. 30(2)(c), and Art. 6(7)(a) GDPR).
... 67 Moreover, it argues that there is “an undeniably overriding public interest
in an unadulterated Christian religion in public discourse” (Evidence
6: Letter from the Citizens' Forum dated September 11, 2023, p. 7; cf. above, para. 8). However, the interest
in demonstrating and enforcing an “unadulterated Christian religion” and in identifying
“good” pastors is a private interest of the Citizens' Forum, which claims for itself
the authority to interpret theological matters, and not a public one.
68 As explained above, the publication of persons in the database with the status
information “recorded” or “requested” violates the principle of proportionality within the meaning of
Art. 6 para. 2 GDPR. Consequently, it cannot be assumed that the asserted private interest
outweighs the data protection interests of the data subjects at stake (see in detail above, para. 58 ff.; see also BGE 136 II 508 E. 2.5, according to which a
distinction between the processing principle of proportionality and the justification
of overriding interest proves difficult).
11/1569 Based on Article 16 paragraph 3 of the Federal Constitution (FC; SR 101), the association "Citizens' Forum"
and the public may, in principle, have a legitimate interest in freely receiving information and obtaining and disseminating information from generally accessible sources.
However, an overriding public interest cannot be assumed.
The personal data of the individuals queried are not relevant for
forming an independent opinion, and public discourse on the views of
"Citizens' Forum," its survey project, and the handling of the church staff is
guaranteed, even if "Citizens' Forum" provides information without reference to individuals about which
groups of people received the pastor check, how many people returned the questionnaire,
and how many responses were received – in other words, if its database only showed those
people who answered the questionnaire and expressly consented to the publication
of the responses (see paragraph 62 above).
70 In summary, there is no overriding private or public interest
in maintaining a publicly accessible database in which affected individuals are recorded (even
against their will), including the status of the inquiry. This
applies regardless of whether the data of the data subjects are already publicly
accessible elsewhere or not.
71 Furthermore, no overriding private or public interest is apparent that could justify the aforementioned violation of the principle of purpose limitation or the principle of transparency (see paragraphs 47-53 above). Regarding the violation of the duty to provide information
under Art. 19 of the Data Protection Act (DPA), Art. 20 DPA definitively defines the cases in which information about the acquisition of personal data may be waived.
b. Requirements for legally valid consent
72 Since “Bürgerforum” cannot rely on the justification of overriding private or
public interest, it may only record persons in the database if they have given their prior legally valid consent (see Art. 31 para. 1 DPA).
73 Consent to be published in the database is only conceivable if "Bürgerforum"
informs the data subjects adequately beforehand (cf. Art. 6 para. 6 GDPR). Based on this information, the data subject must be able to assess the implications of their decision as precisely as possible (Baeriswyl et al. (eds.), Data Protection Act, 2nd ed., Bern 2023,
Art. 6 N 91). The adequacy of the information depends on the intensity of the infringement of personal rights (ibid., Art. 6 para. 92).
74 Based on the information in the questionnaire, individuals can generally recognize that "Bürgerforum" intends to process their personal data for a new purpose. In order for
adequate information within the meaning of Art. 6 para. 6 GDPR to be provided, the questionnaire
must clearly indicate that all personal information provided on the questionnaire will be marked with a status (e.g., "requested") and published in a public internet
database that can be accessed on a personal basis.
75 The fact that the data subjects passively take note of the relevant information does not constitute implied consent to be published in the database with the status "requested" (see ROSENTHAL, in: Rosenthal/Jöhri (eds.), Handkommentar zum Datenschutzgesetz [Concise Commentary on the Data Protection Act], Zurich/Basel/Geneva 2008, Art. 4 N 79; R AMPINI, in: Maurer-Lambrou/Blechta (eds.), Basler Kommentar DSG [Basel Commentary on the Data Protection Act], 3rd edition, Basel 2014, Art. 13 N 11). Only when a person actively expresses their will,
for example, by completing the personal information on the questionnaire and returning it to the "Citizens' Forum", can this be considered (implied) consent to publication in the database, combined with the status "requested".
12/1576 Consent for the publication of answers in the database (and consequently the "answered" status appearing in the database) must be explicit, as data
concerning religious views constitutes particularly sensitive personal data (see Art. 5 lit. c
no. 1 and Art. 6 para. 7 lit. a GDPR). The data subject must therefore explicitly declare
that they wish their answers to be published. Since "Bürgerforum" obtains
explicit consent from the data subjects in this regard (see para. 21 et seq. above), there is
a legal basis for processing under Art. 31 GDPR (see Art. 30 para. 2 lit. c in conjunction with Art. 31 para. 1 GDPR).
77 According to the questionnaire, third parties are to inform "Bürgerforum" to whom they have submitted the
Pastor Check (see above, para. 18). It must be clear to the person concerned
that the third party is informing "Bürgerforum" to enable contact
to whom they submitted the questionnaire (see Art. 6 para. 3 and Art. 19 GDPR). If the person concerned
is not publicly listed, the disclosure of their data to "Bürgerforum"
also requires legally valid consent, which presupposes appropriate information in accordance with Art. 6
para. 6 GDPR. This must be clearly explained on the "Pastor Check" website as well as on the
questionnaire; otherwise, statements stipulating that third parties should
inform "Bürgerforum" to whom they submitted the questionnaire must be avoided.
... 78 If the "Citizens' Forum" receives data from third parties concerning individuals who have received a questionnaire,
these individuals must be asked for their consent to be recorded in the database with the status "requested" (see paragraph 72 above). It is not sufficient for the "Citizens' Forum" to request consent only from those individuals who are not publicly listed elsewhere (see paragraph 32 above). Rather, such consent must be obtained regardless of whether the individuals are publicly listed elsewhere or not (see paragraph 70 above) and requires appropriate information (see paragraph 73 above).
... 4. Summary and Measures
79 The data processing by "Bürgerforum" violates data processing principles under Art. 6 of the GDPR in several respects: The unsolicited publication of publicly available personal data
combined with the status "recorded" in a publicly accessible database violates
the principle of purpose limitation and transparency (see above, paras. 47 ff. and Art. 49 f.). Since
the questionnaire is inadequately designed, the data processing by "Bürgerforum"
is also not sufficiently transparent for those data subjects who are contacted by
the forum by letter (see above, paras. 51 ff.).
80 The publication of personal data of pastors, etc., in conjunction with the
status information "recorded" or "requested" also violates the principle of proportionality in all data processing (see paragraphs 58 ff. above for a detailed explanation).
81 There is no overriding private or public interest in disclosing the precise status of the request on a personal basis (see paragraph 70 above). Nor is there any overriding private or public interest that could justify a violation of the principle of purpose limitation or transparency (see paragraph 71 above).
82 For these reasons, once this order becomes legally binding, "Bürgerforum" may only publish church members,
regardless of whether they are publicly listed elsewhere or not, in the database with the status "recorded" or "requested"
if they give their legally valid consent after being adequately informed (see above, paragraphs 72 ff.).
83 Entries for persons whose data are already published elsewhere and who are listed in the database with the status "recorded" or "requested" must be deleted within 40 days of this order becoming legally binding,
unless legally valid consent has been obtained from the persons concerned within this period.
13/1584 Deletion requests submitted before this order becomes legally binding by persons whose data
has already been published elsewhere and who are listed in the database with the status "recorded"
or "requested" must be implemented within 40 days of the order becoming legally binding (see above
para. 83) (see Art. 30 para. 2 let. b GDPR).
III. Reference to Penal Provisions
85 Pursuant to Art. 63 of the Federal Act on Data Protection (FADP), private individuals who intentionally fail to comply with an order issued by the Federal Data Protection and Information Commissioner (FDPIC)
with reference to the penalty provisions of this article are subject to punishment.
The present order is issued with reference to the penalty provisions of Art. 63 FADP. It is addressed
to the association “Bürgerforum” and thus to a legal entity. Criminal liability arises
by virtue of Art. 29 of the Swiss Criminal Code (SCC; SR 311.0) for the natural person(s) responsible within the association “Bürgerforum”, that is, for the natural person(s)
who, within the association, should have ensured that the order of the Commissioner was
obeyed (see Message on the revised FADP, Federal Gazette 2017 6941 ff., 7103 and 6974).
IV. Fees
86 Pursuant to Art. 59 para. 1 let. d of the Federal Data Protection Act (FDPA), the FDPIC levies fees on private individuals for measures
under Art. 51 FDPA. In the present case, an administrative measure
under Art. 51 FDPA is ordered against "Bürgerforum". Therefore, a fee is payable.
87 The amount of the fees is determined by the Ordinance on Data Protection (ODP; SR 235.11). The fees charged by the
FDIC are based on the time spent; an hourly rate of CHF
150 to CHF
250 applies, depending on the function of the personnel carrying out the action (see Art. 44
paras. 1 and 2 ODP).
88 The total time spent in this case amounts to 20.75 hours. This results in a total fee of CHF 3,750.
89 Reasons that would lead to an increase or decrease in the fees according to the DSV or the subsidiarily applicable General Fee Ordinance (AllgGebV; SR 172.041.1)
are not apparent.
90 The fee becomes due upon the decision becoming legally binding; the payment period is generally
30 days from the due date (see Art. 44 para. 5 DSV in conjunction with Art. 12 para. 1 let. a and para. 2 AllgGebV).
V. Operative Provisions
Based on the facts and the foregoing considerations,
the following is ordered:
1. The association "Bürgerforum" is prohibited from recording persons in the "Pfarrer-Check" database in combination with the status "recorded" or "requested" without first obtaining legally valid consent from them.
2. Entries concerning persons whose data has already been published elsewhere and who are recorded in the "Pfarrer-Check" database with the status "recorded" or "requested" must be deleted within 40 days of this order becoming legally binding, unless legally valid consent has been obtained from the persons concerned within this period.
14/153. Deletion requests submitted before this order becomes legally binding by individuals whose data
has already been published elsewhere and who are listed in the "Pastor Check" database with the
status "recorded" or "requested" must be implemented within 40 days of the order becoming legally binding.
4. The natural persons within the association responsible for compliance with this order are
expressly advised that this order is issued under threat of a fine
pursuant to Article 63 of the Data Protection Act, which provides the following:
"Private individuals who intentionally fail to comply with an order issued by the
Federal Data Protection and Information Commissioner (FDPIC) or a decision of the appellate bodies issued with reference to the penalty
in this article shall be subject to a fine of up to CHF 250,000."
5. A fee totaling CHF 3,750 is imposed on the "Citizens' Forum" association.
... 6. This decision is served on the association "Bürgerforum" (Citizens' Forum).
Adrian Lobsiger
To be served on:
Party to the proceedings
Information on legal remedies
An appeal against this decision may be lodged within 30 days of receipt of the written copy (see Art. 52 para. 1 of the Federal Data Protection Act (DSG) in conjunction with Art. 50 of the Federal Act on Administrative Procedure (VwVG); SR 172.021). This time limit is suspended from the seventh day before Easter to and including the seventh day after Easter; from July 15 to and including August 15; and from December 18 to and including
January 2 (see Art. 52 para. 1 DSG in conjunction with Art. 22a VwVG). The appeal must be filed with the
Federal Administrative Court
P.O. Box
9023 St. Gallen
It must contain the requests, their grounds including a statement of the evidence, and the signature of the appellant or their representative. The contested decision and the documents cited as
evidence must be enclosed with the appeal, insofar as they are available to the appellant (see Art. 52 para. 1 of the Federal Data Protection Act in conjunction with Art. 52 para. 1 of the Federal Administrative Procedure Act).
15/15
