a. personal data that is processed by a natural person exclusively for personal use and which is not disclosed to outsiders;

1 Personal data may not be disclosed abroad if the privacy of the data subjects would be seriously endangered thereby, in particular due to the absence of legislation that guarantees adequate protection.

2 In the absence of legislation that guarantees adequate protection, personal data may be disclosed abroad only if:

4 If the controller of a data file has personal data processed by a third party, the controller remains under an obligation to provide information. The third party is under an obligation to provide information if he does not disclose the identity of the controller or if the controller is not domiciled in Switzerland.

4 The private controller of a data file may further refuse, restrict or defer the provision of information where his own overriding interests so require and he does not disclose the personal data to third parties.

b. they regularly disclose personal data to third parties.

c. disclose sensitive personal data or personality profiles to third parties without justification.

c. process data that is neither sensitive personal data nor a personality profile in order to verify the creditworthiness of another, and discloses such data to third parties only if the data is required for the conclusion or the performance of a contract with the data subject;

1 Actions relating to protection of privacy are governed by Articles 28, 28a and 28l of the Civil Code. The plaintiff may in particular request that data processing be stopped, that no data be disclosed to third parties, or that the personal data be corrected or destroyed.

1 In the case of systematic surveys, in particular by means of questionnaires, the federal organ shall disclose the purpose of and the legal basis for the processing, and the categories of persons involved with the data file and of the data recipients.

1 Federal bodies may disclose personal data if there is legal basis for doing so in accordance with Article 17 or if:

1bis Federal bodies may also disclose personal data within the terms of the official information disclosed to the general public, either ex officio or based on the Freedom of Information Act of 17 December 2004 if:

2 Federal bodies may on request also disclose the name, first name, address and date of birth of a person if the requirements of paragraph1 are not fulfilled.

b. the recipient only discloses the data with the consent of the federal body and

1 Anyone who without authorisation wilfully discloses confidential, sensitive personal data or personality profiles that have come to their knowledge in the course of their professional activities where such activities require the knowledge of such data is, on complaint, liable to a fine.

2 The same penalties apply to anyone who without authorisation wilfully discloses confidential, sensitive personal data or personality profiles that have come to their knowledge in the course of their activities for a person bound by professional confidentiality or in the course of training with such a person.