Disclosure of personal data

1 Federal bodies may disclose personal data if there is legal basis for doing so in accordance with Article 17 or if:

a. the data is indispensable to the recipient in the individual case for the fulfilment of his statutory task;

b. the data subject has consented in the individual case;

c. the data subject has made the data generally accessible and has not expressly prohibited disclosure; or

d. the recipient demonstrates credibly that the data subject is withholding consent or blocking disclosure in order to prevent the enforcement of legal claims or the safeguarding of other legitimate interests; the data subject must if possible be given the opportunity to comment beforehand.

1bis Federal bodies may also disclose personal data within the terms of the official information disclosed to the general public, either ex officio or based on the Freedom of Information Act of 17 December 2004 if:

a. the personal data concerned is connected with the fulfilment of public duties; and

b. there is an overriding public interest in its disclosure.

2 Federal bodies may on request also disclose the name, first name, address and date of birth of a person if the requirements of paragraph1 are not fulfilled.

3 Federal bodies may make personal data accessible online if this is expressly provided for. Sensitive personal data and personality profiles may be made accessible online only if this is expressly provided for in a formal enactment.

3bis Federal bodies may make personal data generally accessible by means of automated information and communication services if a legal basis is provided for the publication of such data or if they make information accessible to the general public on the basis of paragraph1bis. If there is no longer a public interest in the accessibility of such data, the data concerned must be removed from the automated information and communication service.

4 The federal body shall refuse or restrict disclosure, or make it subject to conditions if:

a. essential public interests or clearly legitimate interests of a data subject so require or

b. statutory duties of confidentiality or special data protection regulations so require.