Constitutional Rights in the Digital Context

IV.A Democratic Lens on

the Right to Informational

Self-Determination

The challenges to personal political autonomy outlined above are connected with personal data and new opportunities of data analytics. Data protection and its further development and implementation in the digital sphere are already a field of research for itself. In the following, an outline of this field of research will be presented, in order to provide a democratic perspective on it as the next step. Furthermore, the connection between the right to informational self-determination and constitutional political rights will be presented. In chapter III.E, it has already been outlined that data-based targeting for political reasons is of constitutional relevance.

In recent years a variety of concerns have been raised about the use of personal data within society²⁷⁸ and within academic discussions.²⁷⁹ On the occasion of the rise of ‘Big Data’ scholarly work has focused on the pitfalls of the data protection framework and the vulnerability of the individual in terms of enforcing data protection within the digital sphere.²⁸⁰ With the subsequent innovations in artificial intelligence the possibilities of gathering information about an individual have drastically increased. The concerns raised about these developments are an occasion to assess the legal instruments that protect — S. 60 —informational autonomy. Tamo-larrieux has presented a valuable overview of the legal concerns about data processing that she categorised according to the stages of data processing: 1) data collection, 2) data analysis, 3) data use, and 4) data erasure or data storage.²⁸¹ In the context of these different stages of data processing the following concerns can be summarised.

At the point of data collection, the required consent for data processing is usually obtained within the terms and conditions users have to agree to. The paradox that people call for strengthening data protection online and at the same time broadly share personal information is discussed as the ‘privacy paradox’.²⁸² This development indicates the power of the digital market players. Further concerns that are addressed in academic publications are the lack of transparency, an imbalance of power²⁸³, informational asymmetry, and a lack of autonomy to exercise adequate control with respect to the collection of data.²⁸⁴

At the point of data analysis, the legal and ethical concerns relate to the resulting asymmetry of the knowledge that is gathered,²⁸⁵ error-prone analysis, biases within the analytics that can translate into automated decisionmaking processes,²⁸⁶ and a de-humanisation with respect to the underlying value of the data. With respect to the use of data analytics, scholars are concerned with a lack of transparency of automated decision-making processes, discrimination, manipulation within relationships characterised by informational and/or power asymmetry, and the lack of autonomy with respect to use of the results of data analytics.²⁸⁷ The use of data analytics influences the — S. 61 —sphere of the political will-formation process²⁸⁸ as well as the freedom of communication online.²⁸⁹

Regarding the possibility of data storage, Hildebrandt address the lack of autonomy that can result in a self-fulfilling prophecy.²⁹⁰ Another problem with data storage is possibilities of re-identification of anonymised data.²⁹¹ In this context, the lines between legal and ethical concerns are blurred as the legal relevance is difficult to substantiate.

Scholars either question the entire concept of granting autonomy over one’s own personal data to the data subject,²⁹² or they doubt that the FADP and the GDPR can ensure the protection of the constitutional scope of informational self-determination in the digital sphere.²⁹³ Furthermore, scholarly publications within this field have increasingly drawn attention to the public value of privacy rights and data protection rights. Scholars claim that privacy and data protection have a democratic value and that the current legal framework does not protect this value in an adequate manner in the digital sphere.²⁹⁴ Nevertheless, there is little discussion of what exactly the democratic content of the right to informational self-determination is and how such a constitutional content shall be protected in the digital sphere. It seems, therefore, appropriate to take a democratic perspective on this constitutional right. On the one hand, this is because collective interests are also protected through this right. On the other hand, a further development of the doctrine against the background of the possibilities of implementation and the new risks is necessary.

A.Legal Theory on the Right to Informational Self-Determination

The protection of one’s own self-determined life is at the heart of a democracy and is protected by a variety of legal instruments.²⁹⁵ In the following sections, the different constitutional rights that protect the individual’s agency are briefly outlined with a focus on the right to informational self-determination. The author views the concept of informational self-determination from a democratic perspective. A democratic perspective requires the understanding of the principles of protecting the rule of law and the sovereignty of the people. Nevertheless, the regulations for the protection of one’s own personality development and the right to a private life have been developed mostly in the context of protecting the freedoms of individuals.

The Swiss constitution of 1874 contained a guarantee of the protection of personality with the constitutional right of ‘personal freedom’.²⁹⁶ This right is not a protection of one’s own personality, but a protection of those aspects which are of elementary importance for the development of the personality of the individual.²⁹⁷ Art. 10 para. 2 BV guarantees a comprehensive right to determine one’s own life in its elementary manifestations. Art. 13 para. 1 BV also protects the self-determined development of the personality, but in a narrower area than Art. 10 para. 2 BV. The right to private life guarantees an area of individual personality development protected from external interference. Consequently, the right to private life is often understood as a subcategory of the protection of self-development of one’s own personality.²⁹⁸ The following elements are considered elementary for the autonomous development of one’s own personality: the choice and maintenance of personal relationships, the protection of social reputation, the freedom of sexual development, self-determined decisions about abortion, knowledge of one’s own origin, self-determined termination of one’s own life, and the postmortem protection of one’s own personality.²⁹⁹

The connection between democracy as a system that protects the dignity and self-determination of every individual equally and seeks to establish a governing system among the interests of the individuals, and the concept of privacy is also contained in the protection of human dignity by Art. 7 BV. Human dignity is violated when the privacy of a person is affected in a particularly severe way.³⁰⁰ In my view, this protective aspect of data protection needs to be further defined in relationship to advancing technologies.

On an international level, art. 8 of the European Convention on Human Rights (ECtHR) protects everyone’s right for their private and family life to be respected, including protection against intrusions into one’s privacy by governmental bodies or by other individuals.³⁰¹ This right provides the protection of one’s personal data, one’s physical and moral integrity, as well as the right to establish relationships. Art. 7 of the Charter of Fundamental Rights of the EU protects the right to privacy while the right to control personal data is separately enshrined in art. 8 of the Charter.³⁰²

The constitutional right to the protection of one’s privacy is enshrined in Art. 13 BV. Each person has the right to respect for their private life, their family life, and their home. Pursuant to Art. 13 para. 2 BV, every person is entitled to protection against the misuse of their personal data. Within the constitution, the right to respect for one’s private life and to protection against misuse of one’s personal data is enshrined under the header of ‘privacy protection’.³⁰³ There is dispute in the doctrine as to whether Art. 13 para. 2 BV is to be understood as a comprehensive guarantee of autonomy over any processing of one’s personal data or whether it is a protection against misuse of personal data.³⁰⁴ However, it is clear that self-determined action requires a certain control over one’s personal data.

The right to informational self-determination originated in a constitutional risk that was seen in the relationship between the state and the citizen.³⁰⁵ Today, risks rather stem from the relationships between private parties and — S. 64 —market players. With the introduction of art. 13 para. 2 BV, the right to data protection is now independently protected and is part of the general right to respect for one’s privacy.³⁰⁶ Art. 13 para. 2 BV is particularly relevant against the background of the fact that numerous instances of data processing by private and governmental parties have led to an increased need for protection of the individual.³⁰⁷

According to the wording of Art. 13 para. 2 BV, everyone has the right to protection against misuse of their personal data.³⁰⁸ The prevailing opinion interprets this provision as a comprehensive right to informational self-determination both vis-à-vis state authorities and vis-à-vis information-processing by private individuals.³⁰⁹ Understood as personal data sovereignty, this right includes comprehensive control over the processing of one’s personal data, independent from the value of personal information.³¹⁰ The individual determines whether their personal data can be processed for specific purposes and can withdraw their consent at a later point.³¹¹ The FADP reaffirms this comprehensive understanding of Art. 13 para. 2 BV. The comprehensive understanding of the state’s duty to protect in Art. 13 para. 2 BV corresponds to the constitutive-institutional understanding of constitutional rights. According to this understanding, authoritative decisions must be implemented in the entire legal system, as data protection is understood as a cross-sectoral task of the state.³¹² As a consequence, the state must provide effective protection of this constitutional right against public authorities as well as against private parties.³¹³ Art. 13 para. 2 BV addresses the legislator, who is required — S. 65 —to ensure effective safeguards in the relationships between private individuals and public authorities as well as between private parties on the horizontal level. The concept of informational self-determination incorporates a negative right granted to the individual as well as a constitutional obligation for the state to protect against private impairments.³¹⁴

The definition of the protective scope of art. 13 para. 2 BV posed difficulties to legal doctrine even before digitalisation. It has been argued that the wording in the constitution is misphrased.³¹⁵ Certain authors have pointed out that art. 13 para. 2 BV does not describe the object of protection, nor does it contain information about the purpose of protection.³¹⁶ According to Gächter/Egli, this constitutional article cannot be understood as codifying a comprehensive sovereignty over personal data.³¹⁷ It is argued that the protection of personality is also reasonably limited in legal practice. In this context, it is argued that only the elementary phenomena of personality development are legally protected, and no general freedom of action is protected. Belser also points out that the broad scope of the protection of informational self-determination creates a problem in the digital sphere. Belser argues that Art. 13 para. 2 BV should be understood as protection against misuse of personal data, not as granting comprehensive autonomy over personal data.³¹⁸ Similarly, Thouvenin suggests a solution to the challenges related to data protection with an interpretation of this constitutional right that is oriented toward protection against negative consequences.³¹⁹

According to the prevailing understanding of Art. 13 para. 2 BV, any type of personal data processing must comply with the requirements of Art. 36 BV.³²⁰ This constitutional scope of protection is primarily protected through the FADP and the cantonal data protection laws. The general principles of the FADP are the main instruments to enforce the right to informational self-determination that apply to private data processors and governmental processors.³²¹ The collection of personal data must be carried out in good faith and must be proportionate.³²² Personal data may only be processed for the purpose indicated at the time of the collection and must be transparent to the data subject.³²³ In order for the principles to be translated into legal reality, appropriate organisational and procedural conditions must be ensured.³²⁴ The instruments further include the obligation to register the data file with the data protection officer and a right granted to the individual to access their personal data that was collected.³²⁵

The scope of art. 13 para. 2 FADP encompasses a right to legal enforcement. This part of the content is directed at the legislator to protect against abusive data processing by private individuals. The guarantee of a right to informational self-determination is not absolute and restrictions of this right must meet the requirements of Art. 36 BV.³²⁶

As outlined within the introductory chapter, digitalisation and the amount of available data have changed the value and potential of personal data. In data analytics, data that was not previously linked is combined and correlated, which can lead to new findings that can create new social, economic, and political value. New self-learning algorithms enable new insights, which can hardly be predicted without data processing. Such data processing can be applied in various areas such as personalised medicine, stock exchange trading, and political advertising. The vulnerability of the protection of informational selfdetermination — S. 67 —by data protection rights has been addressed since the early years of these technological advances, and some scholars now even question the legal concept of data protection itself. For instance, Härting claims that the instruments of the current data protection framework are not suitable for the Internet sphere and therefore create legal uncertainty.³²⁷ bull questions the concept of informational self-determination itself and stresses that given the amount of personal information circulating, one cannot assume that anyone ever knew who had knowledge of their personal data. The author argues that this detailed knowledge based on personal data is irrelevant as long as the possession of information by third parties does not have an adverse effect on the individual.³²⁸ Weber also argues that the subjective-legal approach to constitutional rights can no longer be maintained in order to achieve the necessary level of protection against the new digital threats. He argues that it is mainly the transmission processes that must be considered worthy of protection by the regulatory authorities.³²⁹ Due to the challenges of digitisation, a future-oriented model of constitutional rights must be discussed.

Within Swiss legal theory, there is no consensus on the conceptual basis of the data protection rights. According to Thouvenin, it is questionable whether data protection is based on the protection of personal freedom, the protection of privacy, the protection of the right of personality according to Art. 27 ZGB, or on the protection of constitutional rights.³³⁰ A few scholars view the right to informational self-determination as a lex specialis in relation to the rights to the protection of personality.³³¹

At the European level, the EU-specific catalogue of constitutional rights recognised by EU law makes a distinction between the respect for privacy and personal data protection.³³² Fuster claims in an international analysis that — S. 68 —it is a misconception that the protection of personal data is derived from privacy and that these rights are comparable or similar.³³³ She argues, however, that the right to privacy is relevant for the interpretation of personal data protection. The right to data protection is autonomous from the right to respect for private life as it can be applied in an independent manner. The relationship between two autonomous rights can, however, still be instrumental.³³⁴

In what follows, the emergence and development of the right to informational self-determination will be summarised and a democratic perspective will then be adopted in order to examine the right to informational self-determination more closely.

B.Development and Regulatory Amendments

The concept of informational self-determination was initially developed by the Swiss Federal Supreme Court with reference to a landmark decision of the German Constitutional Court in 1983.³³⁵ The subject of the famous census ruling in Germany that the Swiss Federal Supreme Court referenced was a population census which resulted in a public debate about data protection.³³⁶ The possibilities of data collection were regarded as innovative in 1983. The data collection generated fears in Germany society about the uncontrollable proliferation of private data. Clearly, it was not data collection itself but rather the storage, further usage, and analysis of the data that might create threats to the right to private life. The Court’s analysis was based on the evolution data analytics in the 1980s. Consequently, the right to informational self-determination was established against the background of the data analytics capabilities in the 1980s. In its analysis, the court considered the technical innovations that allow unlimited storage and use of personal data a special danger to the general right to freedom of self-development and the right to informational selfdetermination. Furthermore, the court addressed new possibilities to create profiles on the basis of new data storage and analysis potentials in relation to the informational asymmetries. Already in the 1980s, when data analysis was, compared to today, in a primitive form, the court outlined the danger of psychological pressure based on the creation of profiles without the knowledge of data subjects. According to the wording of the judgement, the individual has — S. 69 —the right to decide about the disclosure and usage of their personal data.³³⁷ Against the backdrop of modern data processing possibilities, this right includes the protection against unrestricted collection, retention, processing, and transfer of personal information. Individual self-determination requires the freedom of choice to take or refrain from taking specific actions, including the possibility to act according to the decision taken.

With the proposal for the data protection law in 1988, the Federal Council also referenced the German Census ruling.³³⁸ The need for data protection at the time was explained by referring to how individuals feel if they lack transparency about what personal data is known by others or the government. When an individual has no oversight on who holds and processes personal data about them, the individual may feel insecure. The Federal Council further explained that many people find it problematic to be no longer able to keep track of who is processing all the data about them. The legislator considered that the concerned individual does not appreciate, for example, when information about their employment is used in another context.³³⁹ Against the background of the possibilities of data processing in 1988, the Federal Council stated that the individual is no longer in a position to predict who processes which data about them, where, and for what purposes.³⁴⁰

The evolution of the right to informational self-determination shows that data protection has been coupled with the right to privacy.³⁴¹ Moreover, the systemic understanding of informational autonomy is that it is one of the five parts of Art. 13 BV.³⁴² The other parts are all mentioned in Art. 13 para. 1 BV, namely the right to respect for private life, the home, and confidentiality of postal and telecommunications services. Within the Constitution, the protection against misuse of one’s personal data is enshrined in paragraph 2 of art. 13 under the title ‘privacy protection’.³⁴³ The FADP is understood as a concretisation of the constitutional right to personal freedom, privacy, and protection against abuse of data protected in art. 10 para. 2 and art. 13 of the Federal Constitution and the protection of personality under private law in — S. 70 —art. 28 et seqq. ZGB.³⁴⁴ According to the prevailing opinion, the concept of informational self-determination is understood to be embedded in the general constitutional protection of personality rights, where this concept supplements the constitutional protection in the area of data processing.³⁴⁵ The Federal Supreme Court also finds it difficult to distinguish between personal freedom, informational self-determination, and the right of personality. In BGE 128 I 63, the Federal Supreme Court assigned the processing of personal data to the scope of protection of personal freedom.³⁴⁶

In May 2018, the European Data Protection Regulation came into force at the European level. Already in 2011, the Federal Council decided to revise Switzerland’s Data Protection Act of 1992. When the EU published its data protection regulation in 2016, the National Council wanted to include it in the revision of Switzerland’s data protection law. The revision of the Swiss Data Protection Act entered into force in 2023.³⁴⁷ The Data Protection Act was revised mostly due to technological developments. In substance, the legislator did not deviate from the original concept of informational self-determination, and the majority of the norms have not changed significantly. The information obligations and the transparency instruments are underlined, and a stronger distinction is made between the handling of personal data by private actors and the handling of personal data by the state.³⁴⁸ In addition, data processors are subject to enhanced duties of care, especially with respect to data security.³⁴⁹

According to Art. 22 FADP, a data protection impact assessment must be carried out if a data processing may entail a high risk to the personality or constitutional rights of the data subject. A high risk results from the type, scope, circumstances, and purpose of the processing when new technologies are used.³⁵⁰ A high risk exists in the case of extensive processing of sensitive personal data and if extensive public areas are monitored.³⁵¹ If the impact — S. 71 —assessment shows that the planned processing, despite the measures envisaged by the data controller, will still result in a high risk to the personality or constitutional rights of the data subject, the data controller must first obtain the opinion of the FDPIC. If the FDPIC has objections to the data processing, they will propose additional measures to the data controller.³⁵² The consequence of this regulation is that a risk impact assessment must be carried out in the case of extensive processing of political personal data. If a data protection officer has been appointed, consultation with the FDPIC can be dispensed with.³⁵³ This creates the situation that an internally appointed data protection officer weighs up conflicting interests without any transparency being established. Large-scale analyses of political personal data can have an influence that is relevant from the perspective of discourse ethics. Accordingly, the author suggests that in any case of such political personal data analytics, transparency should be ensured by reporting to the FDPIC.

The author has pointed out that the right to informational self-determination and its enforcement is of relevance for the political rights. Furthermore, the right is related to human dignity. Since there is controversy about the dogmatic classification and the further development of the right to informational self-determination, a democratic perspective on the right may provide indications for the further development of this right.

C.Examining the Democratic Values within the Right to Informational Self-Determination

Within the legal theory about the rights to privacy and data protection, a variety of theories, classifications, and aspects of the concepts of privacy and data protection have evolved. Among scholarly voices, there is no consensus regarding the scope of protection of data protection and its underlying value.³⁵⁴

In this chapter, the author addresses the role of the different aspects of the individual in a democratic context, the doctrine in this context, and how these might possibly respond to technological innovations. The norms that protect the individual’s agency concern different aspects of the individual and the right to informational self-determination takes on an important role in this context.

As an introductory example, two different dogmatic concepts of privacy shall be outlined. The first concept is autonomy-privacy. In essence, it protects the self-determined agency of individuals that requires other actors to retreat in order not to constrain this agency. The second basic idea of privacy relates to identity and dignity-privacy.³⁵⁵ At its core, it protects certain social norms that are regarded as fundamental to the identity and dignity of the individual in a civilised society, such as public prestige or the need to protect one’s own identity. According to Post, the tension between these basic ideas is caused by the fact that the protection of identity and dignity tends to require an active and formative state, whereas the protection of privacy as autonomy requires above all the restraint of the state.³⁵⁶ Post’s assumption shows that within legal theory, there is a tendency to interpret the scope of protection of a constitutional right in relationship with the implemented protective instrument(s). Such interpretations create the difficulty of defining the scope of the constitutional rights independently from their practical implementability. For this reason, I argue that an analysis of the protective content of the right to informational self-determination should be embedded in its democratic function and take into account the vulnerability that the processing of personal data creates for the individual and for other constitutional interests.

1.The Dignity Aspect as Protected through the Right to Informational Self-Determination

From a philosophical viewpoint, the right to informational self-determination as a constitutional right protects the individual in its autonomy, which is connected to human dignity. Not only have there been cases where human dignity has been violated by surveillance; the GDPR explicitly established the connection between human dignity and data protection law in its art. 88. Art. 88 GDPR clarifies that human dignity is one of the interests protected by the GDPR. As already outlined in chapter III.A, Art. 7 BV, which enshrines the protection of human dignity, mirrors this value and protects individuals’ dignities as unconditionally equal to each other.³⁵⁷ The constitutional protection of human dignity includes the protection of self-determination of the individual as an intrinsic value. The protective content of constitutional — S. 73 —human dignity encompasses the individual’s agency and includes its protection if necessary.³⁵⁸

Legal theory reasons that the right to protect one’s own privacy and personal data is derived from human dignity. The interpretation of the constitutional protection of human dignity within art. 7 BV includes the protection of self-determination and considers severe limitations on self-determination and privacy as a violation of human dignity. From a legal perspective, human dignity is an undefined (or undefinable) legal term and a philosophical concept, but all constitutional rights are rooted in an understanding of each individual’s human dignity.³⁵⁹ The philosophical body of thought creates a clearer connection between legal norms and autonomy: personal autonomy is what grounds the capacity to claim freedoms. Human beings cannot be considered to be able to claim freedoms unless they are considered autonomous. Thus, within private law, the protection of one’s personality is protected for its own sake.³⁶⁰ The challenge of finding adequate legal protections for the concepts of autonomy and human dignity is thus not a novel phenomenon of the digital era. However, as new threats are arising, it is necessary to draw attention to the underlying aspects of human dignity within the right to informational self-determination. The anchoring in human dignity has the consequence that a core content of informational self-determination exists. The further development of this right must be carried out in alignment with the protection of human dignity. In cases where human dignity is affected by a processing of personal data, the right to informational self-determination has to create the necessary transparency. In this context, a compromise in enforcement due to the difficulty of implementation in the digital would thus results in a violation of the rule of law. In addition, this aspect of human dignity within the right to informational self-determination also shows why it is insufficient for the further development of this law to focus only on specified negative consequences.

Human dignity is the starting point of the constitutional rights and is also relevant for the interpretation of the constitutional rights insofar as within each right the inviolable core can be determined on the basis of human dignity.³⁶¹ Within the discussion on the protection of individuals’ agency and freedoms against new risks arising from newly developed technologies, a — S. 74 —particular focus shall be on where human dignity is affected, and in such cases enforcement of uncompromised agency over one’s personal data is required to create the necessary transparency. An example of this is the analysis of emotions on the basis of voice recordings, body temperature, or facial expressions. Under the revised FADP, biometric data processed to uniquely identify an individual is considered sensitive personal data.³⁶² This classification ensures the necessary transparency on possible infringements of other rights, such as the protection against discrimination or damage to reputation. Depending on how and for what purposes they are applied, such innovations create a vulnerability that may directly affect or compromise human dignity.

2.Safeguarding Identity through the Right to Informational Self-Determination

One possible violation of the right to informational self-determination derives from the use of personal information to make decisions about individuals without their participation in the decision-making process. This aspect of the constitutional right is also illustrated in the Art. 15 of the revised FADP, which establishes consultation obligations and increased information obligations for automated individual decisions based on personal data. It is therefore assumed that the right to informational self-determination provides the control of aspects of a person’s own identity and thus protects their legitimate interest in being free from unreasonable constraints on the construction of their identity. As a consequence, the right to identity and the right to informational self-determination are considered to be linked to the concept of identity. The concept of identity has been defined as the right to have the attributes or facets of personality that are considered unique to an individual and recognised by others. Italian jurisprudence has added a social dimension for the right to identity and describes the characteristics as ‘the right everybody has to appear and to be represented in social life […] in a way that fits with […] his or her personal identity’.³⁶³ According to this definition, the right to identity grants a right to develop one’s own personality and is at the same time linked to the image that one wants to have in society. de andrade concludes that based on this conceptualization, the right to identity is limited or affected when one’s own indicia are used without authorisation in a way that cannot be reconciled — S. 75 —with the identity that one wants to convey.³⁶⁴ As a consequence, the individual must have the opportunity to correct their externally perceived identity. The concept of identity thus creates a bridge between the capacity to create an identity and what is perceived from the outside as an identity. Both concepts are legally protected by the right to a private life, the protection of one’s personality, and the right to informational self-determination.³⁶⁵

The right to be forgotten is illustrative of the link between the concept of autonomy and identity. In the Google vs. Spain case, the ECJ strengthened the individual’s informational self-determination against the background of the identity perceived in the digital realm by means of search engines.³⁶⁶ The right to be forgotten serves a substantive identity interest that operates to enforce the right to identity also in contrast to one’s own past identity. The Data Protection Directive of the European Union and the FADP in Switzerland predate not only the Internet era, but also the European Charter of Fundamental Rights. Thus, the development of enhanced data analytics as it exists today could not have been foreseen at that time. In 2014 the ECJ decided on the Google vs. Spain case and highlighted the right to informational autonomy by establishing the ‘right to be forgotten’ on the basis of the Data Protection Directive 95/46/EC. The right to data protection is not enshrined as an absolute right in the European Directive, as the processing of personal information is possible in the absence of consent when it is necessary for specific objectives. In that sense, the Directive requires a balance to be struck between conflicting rights in each individual case. Such balancing of interests also takes place in the application of the FADP.³⁶⁷ The judgement established a right to have search results delisted based on art. 12(b) and 14(a) of the Data Protection Directive. The temporal aspect within this case shows that with the evolution of technologies, new criteria will be continuously developed within the application of the right to informational self-determination. The possibility to request a delisting of search results has been called a ‘right to be forgotten’. Within the balancing of interests, the Court clarifies that the right to be forgotten does not amount to an obligation to delete search results, but to an obligation to seek a fair balance — S. 76 —between the interests of internet users in having access to the information and the data subject’s constitutional rights guaranteed by articles 7 and 8 of the Charter. Art. 17 of the GDPR now provides a digital right to be forgotten to tackle the source of the problems of de-contextualised stored data and personal data processing.

The right to be forgotten has a wider scope and purpose as a concern about the link between the past and the present at a conceptual level.³⁶⁸ As the recognised right relates to informational autonomy, it is one dimension of the protection of individual self-determination. In other words, the right to be forgotten is the recognition of the right to be different from one’s past self (as an individual making conscious choices about oneself).³⁶⁹ Thus, de andrade concludes that the broader set of rights under which the right to be forgotten operates are the right to personal data protection, the right to privacy, and the right to identity. The established case by the Court lays out a specific process to de-link search results with the goal of protecting a substantive interest or right. The right to be forgotten pursues a substantive identity interest that operates to enforce the right to identity. Besides an interest in the right to identity, the right to be forgotten pursues the right to be different from one’s own past personality. This understanding draws attention to the fact that the de-construction of a past identity is necessary in order to construct a new one. The right to identity concerns all personal facts that are capable of transmitting an image to the public that is not correct according to the individual concerned. de andrade argues that the right to be forgotten must be associated with the right to identity instead of the right to privacy to protect the personal information that has become untruthful or false. Linking the right to be forgotten with the right to identity brings within its scope certain information that it would not normally cover if it were conceptualised as a privacy right or derived from the right to privacy.³⁷⁰ At this point, de andrade makes the legitimate point that the right to informational self-determination (as encompassing the right to be forgotten) pursues the interests of the right to identity.

A right to the deletion of personal data is now expressed in art. 25 para. lit. c FADP and expressly guaranteed in connection with lawsuits arising from the protection of personality rights according to art. 28, 28a, 28g–28l ZGB.

Against the background of the preceding analysis, data autonomy creates the legitimate freedoms that can only be afforded against conflicting interests, and such a balance is to be struck in each individual case. The possibilities of data retention and further analysis against new data sets change how the balance is struck with conflicting rights and interests. As a consequence, the right to informational self-determination creates the necessary transparency to balance conflicting rights and interests that can be of constitutional relevance. The concept of identity includes a temporal element. Personal data as derived from internal aspects of identity are subject to change. The link between autonomy, the agency to create and re-create one’s identity, and the concept of informational self-determination shows that the right is anchored in the autonomy of the individual and should not be seen as a consequence of the protection of personality. This aspect of the right to informational selfdetermination is also reflected in the new provision in the revised FADP on profiling (art. 4 lit. c FADP). This addresses the vulnerability of autonomy over one’s identity that can arise from the fact that a data processor holds a vast amount of personal data about a data subject.

3.Ensuring Unhindered Political Will-Formation through the Right to Informational Self-Determination

The FADP affords enhanced protection to sensitive personal data and personality profiles. Art. 3 lit. c FADP defines sensitive personal data by means of an exhaustive list. Information on the religious, ideological, and political views or activities of the data subject, personal information on health and genetic data, biometric data, data on administrative or criminal prosecutions and sanctions, and data on social assistance measures are sensitive personal data.

Political decision-making requires the consumption of information that nowadays predominantly takes place online. As outlined in chapter II, data analytics of political information consumption is part of new business models. As a consequence, a new threat has evolved that not only concerns the concept of informational self-determination but also affects the constitutional scope of the political rights. The secrecy of voting in particular protects not only the individual interests but also the collective legal interest of the unhindered deliberation process.³⁷¹ Due to the innovations of political targeting, the scope of protection of the political rights is affected bypersonal data processing but is currently protected by the right to informational self-determination.

In the 1988 consultation on the Data Protection Act, a majority rejected a Data Protection Act that would cover both the private sector and the federal — S. 78 —administration. With regard to the main issue, it was argued that data protection in the federal administration and in the private sector are conceptually different, and that regulation of both areas is hardly possible in a single decree. Furthermore, it was argued that a common standardisation would lead to a complication of the law.³⁷² The Federal Council rejected this objection and argued that the purpose of the law, e.g. the protection of personality from personal data violations, is the same in the Federal Administration and in the private sector. The most important principles of data protection law must also apply in both the private and public sectors. It was therefore argued that it is desirable that the same authorities are responsible for assessing data protection issues in both areas. Their power to intervene in the private sector was supposed to be much more limited, however. At that time, it was considered that this would be the best way to ensure a harmonious and coordinated development of personal data protection law on the horizontal level.³⁷³ It seems possible that this decision has been the reason that public interests have been neglected in the further drafting of the law. The author has established in chapter III.D and chapter I.V.C that the protection of political personal data connects to the exercise of the right to vote. To this extent, the constitutionally protected scope of free opinion formation is also protected by the instrument of informational self-determination.

By granting the individual agency over their politically relevant personal data, a right to transparency about the processing of this information is granted. The scope of voting secrecy is thus protected by the right to informational selfdetermination on the horizontal level. Voting secrecy as a legal instrument is the implementation of the collective interests enshrined in the political rights. Such political rights are instrumental to the self-governance of a society as outlined in chapter III.D. Thus, in my view, the discussion of further development of the right to informational self-determination concerning political personal data needs to take the parameters of voting secrecy into account. Voting secrecy (the protection of voting activity as a form of sensitive political information) is protected in its formal nature. As the principle of voting secrecy extends before and after the poll, the legal asset is protected by the data protection framework.³⁷⁴ Applying the doctrine of the protection of one’s personality to the concept of informational self-determination undermines the underlying value of the political rights within this complex balance of interests.

The objection could be raised that only the actual vote is covered by the scope of constitutional protection. A teleological interpretation, especially against the background of the deliberative theory of democracy, contradicts this argument. What is protected is the unhindered decision-making process, and the legislator has used various legal instruments to protect this unhindered sphere.³⁷⁵ It is clear that in this context there must also be a process of weighing up interests, where individual interests in personalization, the economic freedom of the gatekeepers, and the right to freedom of information are opposed in an matrix of interests. The balancing of these interests is one part of the challenge, and transparency problems precede it.

At the moment, data protection experts carry out this balancing of interests in practice, predominantly using a risk-based approach. Accordingly, it seems necessary to specify criteria for balancing interests. Furthermore, the author recommends that when political personal data is intentionally collected and processed within large data sets, this data collection should be required to be reported to the FDPIC and an impact analysis should be submitted for approval. A data protection officer (external or internal to the company) does not appear to be the appropriate regulatory instrument to weigh public-law interests against private ones without corresponding guidelines.

4.The Transparency Aspect as Protected through the Right to Informational Self-Determination

Experts in data protection law are having to deal with a variety of applicable regulatory norms and a quickly evolving jurisprudence. Scholars have drawn attention to the fact that the enforcement of complete data protection compliance is unrealistic. Consequently, scholars have concluded that the understanding of the right to informational self-determination as complete autonomy over personal data should not be upheld. The right to informational self-determination should be reframed against the background of the arising risks.³⁷⁶

Moreover, data protection rights are a vulnerable concept due to the individual-rights framework. Tying the affordance of protection to individuals’ rights makes the protection uncertain. The framework of subjective individual rights places the enforcement of the right to privacy in the hands of the individual concerned. Hildebrandt similarly elaborated that the affordance of privacy rights depends on social values and the sense of self. Furthermore, the public value of privacy rights is affected by the limited affordance of privacy — S. 80 —rights at a larger scale. She further elaborates on the limitations to the rule of law due to informational asymmetries online that affect individuals’ autonomy.³⁷⁷ The transparency that the concept of informational self-determination creates is an important part of the rule of law in a democracy. In the actual affordance of the individual rights, this does not mean the protection includes a comprehensive protection of one’s personal data. However, especially in the pre-digital world, the concept of personal data sovereignty was a simple instrument to grant transparency to the individual when an abuse could possibly take place. The additional rights in the event a data controller takes autonomous decisions on the basis of personal data illustrates this transparency-function of data protection rights.³⁷⁸ In such cases, the data subject has a right to be heard and the data controller needs to actively inform about autonomous decision-making processes.³⁷⁹ Concluding from this constitutional context, the transparency aspect needs to be enforced without compromise if a core aspect of another constitutional right might be violated.

5.Data Protection Challenges in Innovation and Legislation

The fears and concerns related to data analytics and emerging technologies have, among other things, driven the recent revisions to data protection law in Europe. These driving concerns have been related to different constitutionalrights interests (for instance some of them were of political nature, some of them stand in connection with the interference with physical integrity, and so forth). In practice these different underlying interests have not been properly taken into account and are not reflected in the revised act. As a consequence, there is not enough guidance on how conflicting interests should be balanced in particular cases. Rather, the data protection supervisory authorities respond in a reactive manner to arising risks. For example, three data protection supervisory authorities in Europe decided in 2022 that the use of Google Analytics as a cookie does not meet the level of protection required by the GDPR anymore, even when the data transfer is based on a concluded standard contractual clause. Legal practice in Switzerland adapted to these decisions.³⁸⁰ This has resulted in high costs for companies to comply with the ever-changing data — S. 81 —protection requirements. At the same time, there is also greater uncertainty for experts in data protection law as there is a lack of guiding criteria for weighing up interests and assessing risks in the particular case.³⁸¹

The democratic lens on the right to informational self-determination in this chapter has highlighted different aspects and functions of this constitutional right. This democratic lens has led to certain conclusions about the theoretical level of this right. They are summarised in what follows.

A part of the protected scope of the right to informational self-determination connects to the rule of law, especially its function of protecting human dignity and its transparency function to unravel potential violations of other constitutional rights. Since the right to informational self-determination protects a part of human dignity and at the same time fulfils an essential transparency function, the further development of this constitutional right cannot be oriented (only) towards the negative consequences. As already mentioned, this approach has been proposed in academia.³⁸² Moreover, these aspects of the right to informational self-determination suggest disconnecting the right to informational self-determination from the right to privacy and understanding this constitutional right as an independent constitutional right instead.

Furthermore, the democratic view has provided further insights on how conflicting interests should be balanced. The author suggests that depending on which aspect of the right to informational self-determination is engaged, different parameters should apply in practice. If the processing of personal data amounts to a violation of human dignity, there is no space to strike the balance in favor of a contradicting interest. Consequently, the first evaluation should be about this relational aspect. There is a need to create guidelines on the violation of human dignity by emerging data-driven technologies. Moreover, if political autonomy is engaged, legal theory on political rights should be consulted when balancing conflicting interests. If the autonomy to create and re-create one’s identity is compromised, probably new parameters need to be developed to strike an adequate balance in each case. Such parameters could be introduced to the FADP.

As has been shown within this chapter, the right to informational selfdetermination is understood either as informational sovereignty or as protection against abuse on the basis of the processing of personal data. Furthermore, this constitutional right is seen either as an outflow of the general protection of personality or as connected with the right to privacy. The right to informational — S. 82 —self-determination has different facets and has been greatly challenged by the rapid development of new technologies and business models. The existing theory of this right no longer provides for conclusive solutions. Some scholars have called for a reinterpretation of the right to informational self-determination under the conditions of the information society, or for changes and extensions of the tools of protection for this constitutional right.³⁸³ Furthermore, there are authors who dismiss the right to informational self-determination as a legal misconstruction.³⁸⁴ Their arguments concern in particular the relationship between scope of protection on the one hand and intervention on the other hand.

The questions that arise regarding data protection in the digital sphere or the concept of informational self-determination are numerous. However, within this chapter various aspects of the right to informational self-determination have been discussed that are of relevance for the further development of this constitutional right. The transparency function of this right is necessary for the enforcement of various interests relevant to constitutional rights. Against the background of the functions of the right to informational self-determination previously outlined, the author recommends disentangling the right to informational self-determination from the protection of personality. Furthermore, I propose to define the protective content of the right to informational self-determination as ‘an impermissible vulnerability resulting from the processing of personal data that has constitutional significance’. By this definition, the constitutional content would not be understood as a comprehensive sovereignty of the individual over their data, as the implementation of such an understanding is practically impossible. At the same time, with this definition the constitutional right is not limited to protection against misuse and would include vulnerabilities of the individual created by personal data processing.³⁸⁵ If, from the point of view of the content of constitutional political rights, an inadmissible vulnerability of the independent formation of political opinions has been brought about on the basis of data processing, adequate protection would have to be implemented to prevent such vulnerability. If a — S. 83 —vulnerability that directly affects human dignity arises through the processing of personal data, the standard of art. 7 BV should be applied. The proposed definition also appears to be in line with the need for continuous development of the content of this constitutional right as technologies evolve, allowing for the interest in innovation to be balanced against other interests. As technology develops, these interests must be protected such that the right balance is struck between innovation, economic interests, and the interests of informational self-determination. Within this process, the democratic interests in the right to informational self-determination should be considered in the context of further technological developments. The proposed definition of the protected content of the constitutional right would allow for an adequate balancing of conflicting interests, and more guidance on how to balance the interests would have to be developed. The revised FADP strengthens existing data protection rights but retains the same governance instruments as the previous version. However, it still lacks comprehensive guidelines at an abstract and doctrinal level for balancing conflicting interests in the course practical implementation, especially when multiple constitutional rights are at stake. The FADP neither clarifies how the protective scope of the relevant constitutional article should be interpreted nor resolves ongoing disagreements in legal scholarship. Due to the legal uncertainty within academia about the definition of the scope of the constitutional right, there continues to be a variety of recommendations for data protection measures at both the cantonal and federal levels, perpetuating a fragmented and challenging regulatory landscape.

The latest revision of the FADP has strengthened existing data protection rights, however, the revised version uses the same governance instruments as the previous one. Nevertheless, there remains a notable absence of comprehensive guidelines on an abstract and dogmatic level to govern the balancing of conflicting interests during practical implementation, particularly when multiple constitutional interests are involved.