By Thomas Contin, Managing PartnerThree years after the revised Federal Act on Data Protection (FADP) entered into force, the Federal Data Protection and Information Commissioner (FDPIC) is using its power to issue binding decisions. The autumn of 2026 brought a cluster of them, together with a first important judgment of the Federal Administrative Court.
Marketing needs consent you can prove
Add Conti GmbH sold addresses to advertisers and claimed the consents came from online prize draws. The FDPIC found the account not credible, prohibited the processing and ordered the data deleted within 30 days of the decision becoming final. The company had also ignored requests for access and erasure, and having outsourced them to service providers did not relieve it of responsibility. The decision of 26 June 2026, published on 22 October, is final.
The practical point: whoever uses personal data for marketing bears the burden of proving consent. A purchased list with a consent nobody can document is a liability, not an asset.
Data collected for one purpose stay with that purpose
On 29 October 2026 the FDPIC announced a decision against a credit reference agency that also used creditworthiness data for marketing. It prohibited this use, prohibited adding to its database the data people supplied when asking for access, and required the agency to examine erasure requests even when they give no reason. The agency has appealed, so the decision is not yet final.
Biometric data require explicit consent
In two judgments of 13 October 2026 (A-4467/2025 and A-6813/2025) the Federal Administrative Court confirmed the FDPIC's position on PostFinance's voice recognition. A voiceprint is sensitive personal data. A customer who carries on talking after a recorded notice has not given explicit consent, and voiceprints created without it must be deleted.
Recording people is a serious intrusion
On 29 September 2026 the FDPIC prohibited Baselland Transport AG from using bodycams that recorded images and sound of passengers and staff, because no law provides a sufficient basis for a company performing a public task. BLT has appealed. A purely private company does not need a legal basis, but it must still justify the recording with an overriding interest, keep it proportionate and inform the people concerned.
What to do now
Review the consent records behind every marketing list. Check that each processing activity matches the purpose stated in your privacy notice. If you use voice, face or fingerprint recognition, obtain explicit and separate consent. Before installing cameras, document why a less intrusive measure is not enough.
Advisorn helps companies review their processing activities, privacy notices and records of consent, and assists them in proceedings before the FDPIC.
For questions about this topic, contact us.
Get in Touch