A third party is any entity other than the disclosing entity. The economic links between the disclosing party/entity and the recipient entities are not relevant. Therefore, companies within the same group as the disclosing entity, i.e., the parent, sister companies or subsidiaries are considered third parties and the sharing of personal data within a group is deemed to be a disclosure to third parties for the purposes of the Swiss Federal Data Protection Act (DPA).
The DPA does not permit the disclosure of sensitive data or personality profiles to third parties without lawful justification. The consent of the data subject can constitute a lawful justification. Breach of this prohibition is an offence if knowledge of the sensitive data has been gathered in the course of a professional activity requiring knowledge of such data and can be punished by a fine of up to CHF 10'000.--. If the fine is not paid, it can be replaced by imprisonment for up to 3 months.
Excerpt from www.data.protection.ch Copyright Walder Wyss Ltd., Zurich, Switzerland
This excerpt provides general information which may not be current or complete. It is not made available for the purpose of providing legal advice and it should not be relied upon as legal advice. Before taking any action with regard to the matters discussed in this excerpt, advice specifically addressing the applicable facts and circumstances should be obtained.