Swiss court confirms SkySale must publicly notify data-breach victims

The Swiss Federal Administrative Court dismissed SkySale Schweiz GmbH’s appeal against a Federal Data Protection and Information Commissioner (FDPIC) order requiring it to inform people affected by a data-security breach. The FDPIC reported on 6 November 2026 that the court’s judgment, dated 8 April 2026 in case A-3790/2024, is final. SkySale operates the online shop apfelkiste.ch.

The FDPIC’s order of 28 May 2024 required SkySale, under threat of penalty, to notify the affected persons within 10 days after the order became legally binding. The Commissioner found that notification was necessary to protect them from misuse, including phishing and fraud involving bank details.

What the court confirmed

The court held that technical measures SkySale took after the breach to remedy the problem did not remove its information obligation. The duty arises under Article 24(4) of Switzerland’s Federal Act on Data Protection, which requires affected persons to be informed where notification is necessary for their protection. Article 24(5) sets out grounds for restricting, delaying or waiving that information.

SkySale could no longer identify the affected people because of the measures it had implemented. The court therefore confirmed that the notice may be given by public announcement rather than individually.

The FDPIC’s recent records also show active litigation and enforcement on other data-protection controls. On 21 October it reported that the Federal Administrative Court had upheld its requirement for PostFinance AG to obtain explicit consent before creating voiceprints for authentication. On 5 November, the FDPIC published a decision prohibiting Baselland Transport AG from processing bodycam data, although that decision remains under appeal.

The SkySale order will be published once a separate publication order, issued at the company’s request, becomes legally binding.