1 Federal bodies may process personal data if there is a statutory basis for doing so.
2 They may process sensitive personal data and personality profiles only if a formal enactment expressly provides therefor or if, by way of exception:
a. such processing is essential for a task clearly defined in a formal enactment;
b. the Federal Council authorises processing in an individual case because the rights of the data subject are not endangered; or
c. the data subject has given his consent in an individual case or made his data general accessible and has not expressly prohibited its processing.