Collecting Personal Data
Disclosing Personal Data

Disclosing Personal Data

Definition of "third parties"

A third party is any entity other than the disclosing entity. The economic links between the disclosing party/entity and the recipient entities are not relevant. Therefore, companies within the same group as the disclosing entity, i.e., parent companies, sister companies or subsidiaries, are principally considered third parties and the sharing of personal data within a group is principally deemed to be a disclosure to third parties for the purposes of the FADP. Only in the context of limitation of the right to information, legal entities that belong to the same group of companies may not be considered as third parties (see Art. 26 par. 3 FADP).

Restrictions on disclosure

Disclosure is a form of data processing; therefore, all processing principles must be respected. It must be taken into account that disclosure of personal data can be particularly intrusive in certain circumstances. Therefore, even within a group, it must be ensured that personal data is only disclosed to other persons or companies as long as the processing principles are respected and that the required contracts are concluded, if necessary.

Additional restrictions may apply depending on the circumstances of disclosure. For example, if personal data is disclosed to recipients abroad, further restrictions may apply, as well as in the case of disclosure of particularly sensitive personal data to third parties (whereby processors are typically not considered third parties).