Personal data may only be disclosed to third states if they can guarantee an adequate level of data protection in accordance with Article 16 paragraph 1 of the Data Protection Act of 25 September 20201(FADP).2
If a third state does not guarantee an adequate level of data protection, personal data may be disclosed in the following cases:
the person concerned has consented in accordance with Article 6 paragraph 6 and, if applicable, paragraph 7 FADP;
disclosure is necessary to protect the life or physical integrity of the person concerned and it is not possible to obtain that person’s consent within a reasonable time;
disclosure is necessary to safeguard overriding public interests or to determine, exercise or assert legal rights before a court or another competent foreign authority.3
Besides the cases mentioned in paragraph 2, personal data may also be disclosed in special cases if sufficient guarantees ensure adequate protection of the person concerned.
The Federal Council determines the scope and the terms of the guarantees to be provided.