A debt claim, even if documented, does not authorize the public disclosure of the debtor on the web.
With judgment A-3891/2025 of 22 June 2026, the Federal Administrative Court fully dismissed the appeal lodged by Inkasso-Team AG, thereby confirming the decision issued by the FDPIC – the Federal Data Protection and Information Commissioner on 28 April 2025.
The company published online names, addresses, professional information, photographs, voice recordings, and data relating to civil and criminal proceedings involving alleged debtors. In some cases, family members and other connected individuals were also involved.
The stated objective was twofold: to locate debtors through reports from the public and to warn potential third parties.
However, the Court confirmed the violation of the following principles:
• transparency;
• purpose limitation;
• proportionality.
Furthermore, no valid justification under Article 31 of the Federal Act on Data Protection (FADP) was recognized: there was no consent, no legal basis, and no overriding private or public interest.
Four aspects of the judgment are particularly significant:
– Data that is already publicly accessible cannot automatically be reused for a different purpose and in a new context.
– The effectiveness of a processing activity does not prove its lawfulness: the fact that publication may help locate a person does not make it proportionate.
– Even in the case of actual debtors, online dissemination may take on the character of a private search operation and produce a punitive effect and a form of “public shaming.”
– The data controller remains responsible for the lawfulness of the processing and cannot justify its actions by arguing that the authority failed to intervene promptly.
The Federal Act on Data Protection (FADP) allows, under specific conditions, the processing of data for the purpose of assessing creditworthiness. This is, however, fundamentally different from the indiscriminate publication of personal information before a potentially unlimited audience and for an indefinite period of time.
The judgment is final and binding, and the website has been deactivated.
An important indication for DPOs and Compliance Officers: in debt collection activities, the legitimacy of the purpose pursued does not automatically entail the lawfulness of every mean used to achieve it.
