In its decision of 17 April 2026, which became final following the expiry of the appeal period, the Federal Data Protection and Information Commissioner — FDPIC — concluded an investigation into Cream della Cream Switzerland GmbH and Philipp Plein International AG.
The decision is particularly noteworthy because it provides very practical guidance on how objections to marketing and erasure requests must be handled under the Federal Act on Data Protection — FADP.
From informal intervention to formal investigation
The proceedings began in December 2023, when an individual reported that they continued to receive numerous advertising messages despite having objected to such communications.
The FDPIC initially intervened informally, reminding the companies that using email addresses and telephone numbers to send advertising communications constitutes the processing of personal data and that the data subject’s objection must be duly respected.
After receiving no response, the Authority subsequently sent a formal communication requesting that the companies establish simple and effective methods for unsubscribing from commercial communications. This request also remained unanswered.
In the meantime, the FDPIC received further reports from individuals residing in several European countries. Some text messages did not provide any procedure for objecting to further communications; in other cases, the link contained in the emails did not allow users to unsubscribe effectively.
In October 2025, the Authority therefore opened a formal investigation pursuant to Article 49 FADP.
An objection is not subject to specific formal requirements
The FDPIC recalls that, pursuant to Article 30(2)(b) FADP, processing personal data contrary to the data subject’s expressly stated wishes constitutes an infringement of their personality rights.
An objection may be submitted by email, by telephone, or through a contact form. No particular legal wording is required: it must simply be clear that the individual no longer wishes their data to be used for the relevant purpose.
Once an objection has been made, the continuation of marketing activities constitutes an infringement of personality rights. The burden is also on the data controller to demonstrate the existence of any justification under Article 31 FADP.
In the case under examination, the companies did not provide any justification.
The right to erasure under the FADP
Another significant aspect of the decision concerns the erasure of data.
The FDPIC derives the right to erasure from Articles 6(3) and 6(4), together with Article 30(2)(b), FADP. Where data are no longer necessary for the purpose for which they were collected, or where the data subject requests their erasure, the controller must delete or anonymise them, unless there is a specific reason for retaining them, such as a statutory obligation.
The decision does not therefore state that every request necessarily requires all customer data to be erased. Data needed to comply with accounting or contractual obligations may, for example, be retained. What must unquestionably cease is their use for advertising purposes.
Breach of the principle of good faith
In some cases, the companies confirmed to the data subjects that their data had been erased, while continuing to send commercial messages.
According to the FDPIC, this conduct infringes not only the right to object, but also the principle of good faith laid down in Article 6(2) FADP. Confirming that data have been erased when the erasure has not actually been carried out means processing the data in an unfair and unreliable manner.
The case demonstrates that the handling of data subject rights cannot be limited to sending a standard response. The response must result into actual changes to the systems, marketing lists, and platforms used.
The measures ordered by the FDPIC
The Authority ordered the two companies to:
- immediately cease all processing for advertising purposes in relation to individuals who had objected;
- erase personal data upon request, unless a justification for retaining them existed;
- discontinue the processing of data relating to individuals who had already exercised their right to object or requested erasure.
The measures had to be implemented within 30 days after the decision became legally effective. The companies were also charged CHF 5,500 in procedural fees.
The scope of the sanctions requires careful consideration
The decision also refers to Article 63 FADP, which provides for a fine of up to CHF 250,000 for any person who intentionally fails to comply with an FDPIC decision issued under threat of criminal penalty.
It is important to clarify that this amount does not represent a penalty automatically imposed for sending advertising communications. Criminal liability may arise only if the Authority’s decision is intentionally disregarded.
Under Article 29 of the Swiss Criminal Code, liability may extend to the natural persons within the organisation who were responsible for ensuring compliance with the decision.
Practical guidance for companies
The decision highlights that compliance must be assessed throughout the entire operational chain: the e-commerce website, CRM systems, marketing automation platforms, external service providers, SMS distribution lists, and customer support systems.
Simply including an “unsubscribe” link is not sufficient. Companies must verify that it actually works and that the objection is propagated across all the systems in use.
The message conveyed by the decision is straightforward: a right that is formally recognised but not technically implemented remains a violated right.
