Art. 37 BStatV: Disclosure of personal data and data of legal persons from federal statistics

BStatV Kommentar 2026 · 2026

Open DocumentOpen source

Function and statutory basis

Art. 37 BStatV implements Art. 19 para. 2 BStatG, as its parenthetical heading indicates 431.011--37. The statute allows federal statistics producers to disclose personal data and data of legal persons for non-personal purposes, in particular research, planning and statistics, to federal research and statistics bodies and to third parties. It sets four cumulative conditions 431.01--19:

  • lit. a: the data are anonymised as soon as the purpose of processing allows;
  • lit. b: the recipient passes the data on only with the producer's consent;
  • lit. c: the recipient discloses results only in a form that does not allow the persons concerned to be identified;
  • lit. d: the recipient is in a position to comply with statistical secrecy and the other data protection rules.

The current wording of the statutory provision dates from the revision of the DSG, in force since 1 September 2023 431.01--19. The general rule for federal bodies is Art. 39 para. 1 DSG, which governs processing for non-personal purposes on largely parallel conditions 235.1--39.

The ordinance gives these conditions a working form 431.011--37, but Art. 37 is not self-sufficient. Two statutory conditions do not appear in its text: anonymisation as soon as the purpose permits, and publication of results only in non-identifiable form. They nevertheless bind every disclosure because they flow directly from Art. 19 para. 2 lit. a and c BStatG 431.01--19. The ordinance also contains its own anonymisation rule: individual data must be anonymised once the processing purpose permits, and in any event no later than 30 years after collection, or 100 years for very long time series 431.011--26.

Art. 37 also governs data produced by linkage. Under Art. 31 BStatV, where statute provides for disclosure for non-personal purposes, the BFS may disclose linked data "nach Artikel 37" 431.011--31.

Art. 36 para. 6 DSG requires a federal body to refuse or restrict disclosure, or to attach conditions to it, where statutory secrecy duties or special data protection rules so require 235.1--36. The full anonymisation requirement of Abs. 2 is such a case, and so are the conditions of Abs. 1.

Disclosure does not release the recipient from statistical secrecy. Art. 14 para. 1 BStatG prohibits using data collected or passed on for statistical purposes for any other purpose. The exceptions are an express federal statute or the written consent of the natural or legal person concerned 431.01--14. Under Art. 14 para. 2 BStatG, the duty of secrecy extends expressly to persons who "die Daten nach Artikel 19 erhalten" 431.01--14. The consequences of this are discussed below under criminal and contractual sanctions.

Temporal scope: repeal of Abs. 3

Abs. 1, 2, 4 and 5 have been unchanged since the ordinance entered into force on 1 June 2025. Abs. 3 was repealed by the ordinance of 2 September 2026 with effect from 15 October 2026 ch-fedlex--431.011--2026101....

In the version valid from 1 June 2025 to 14 October 2026, Abs. 3 made EU law applicable to a specific situation: the disclosure of individual data under the 2004 statistical cooperation agreement between Switzerland and the European Community. It read: "Für die Bekanntgabe von Einzeldaten im Rahmen des Abkommens vom 26. Oktober 2004 zwischen der Schweizerischen Eidgenossenschaft und der Europäischen Gemeinschaft über die Zusammenarbeit im Bereich der Statistik sind anwendbar: a. die Bestimmungen der Verordnung (EG) Nr. 223/2009; b. die Bestimmungen der Verordnung (EG) Nr. 557/2013." ch-fedlex--431.011--2025060...

The official text does not state why Abs. 3 was repealed. Disclosures made up to 14 October 2026 must be assessed under the former wording. Since 15 October 2026, the ordinance contains no special rule referring to these EU regulations. Disclosures to European statistical bodies must therefore satisfy Abs. 1 and the general rules on cross-border disclosure (see the section on international statistical offices below).

Who may disclose and to whom

The disclosing organ

The "zuständige Organe" are the federal statistics producers that collect data for their statistical work under Art. 4 BStatG. Annex 1 lists them as the competent organ for each survey 431.011--4. The same provision requires each such organ to keep its statistical work clearly separate from "Vollzugs-, Aufsichts- oder Regulierungsaufgaben gegenüber bestimmten Privatpersonen oder Unternehmen" 431.011--4. That separation is the reason Art. 37 para. 1 excludes recipients that perform person-related enforcement tasks.

Bodies that are only partially subject to the BStatG need separate attention. Art. 3 para. 1 BStatV lists the areas in which the statute and ordinance apply to them. Lit. k covers "übrige Dienstleistungen (Art. 19 Abs. 1 und 2 BStatG; Art. 42 und 45 dieser Verordnung)", and lit. h covers data protection (Art. 35 and 36 BStatV) 431.011--3. Art. 37 BStatV is not among the listed provisions. On the wording, these bodies are therefore bound directly by Art. 19 para. 2 BStatG but not by the detailed conditions of Art. 37 BStatV. For the Swiss National Bank, only lit. a–e and i apply, so not even the statutory rule on services in lit. k 431.011--3.

Eligible recipients

Abs. 1 names three groups of recipients 431.011--37:

  • units of the federal administration;
  • third parties that do not perform person-related enforcement tasks;
  • statistical offices of international organisations.

The disclosure must be "für statistische Arbeiten". Art. 5 BStatV defines that term broadly 431.011--5:

  • Para. 1 lists surveys, synthesis statistics, classifications, the analysis of administrative and register data, methodological development, training and research in statistics, and the international exchange of statistical information.
  • Para. 2 treats as equivalent analyses for "weiteren nicht personenbezogenen Zwecken, insbesondere zu Forschungs-, Ausbildungs- und Planungszwecken".
  • Para. 3 excludes work that serves solely the producer's internal administrative activity and yields no information that is representative at federal level.

The decisive line is therefore functional. Research and planning by a university or a federal office qualify. Any use of the data to take a measure against a particular person or undertaking does not. This reading matches the general ban on non-statistical use in Art. 14 para. 1 BStatG 431.01--14.

Conditions for disclosure under Abs. 1

Removing identifiers is not anonymisation

Lit. a requires only that the disclosed data no longer contain the listed direct identifiers: name, first name, AHV number, company name and UID 431.011--37. The ordinance distinguishes this step from two others:

  • Pseudonymisation replaces personal identifiers, including the AHV number, with a non-meaningful statistical identifier. Reversing it requires a case-by-case check of compliance with data protection law 431.011--25.
  • Anonymisation additionally requires deleting the statistical identifier itself 431.011--26.

The BFS may also pseudonymise datasets specifically for use by other federal units and third parties 431.011--38.

Data released under Abs. 1 lit. a are therefore generally pseudonymised, not anonymised, and they remain personal data. The Federal Supreme Court applied this logic to the BFS in 1C_425/2020. An archived sampling frame was held to contain personal data because the stored AHV number allowed the BFS to link it to its address register. The Court defined anonymisation as any measure that makes the identity of the person impossible, or possible only with extraordinary effort, to determine: "Unter Anonymisierung ist jede Massnahme zu verstehen, die bewirkt, dass die Identität der betroffenen Person nicht mehr oder nur noch mit ausserordentlichem Aufwand festgestellt werden kann." 1c-425-2020 The BFS argued that archiving, protective measures or the statistical purpose removed the data's personal character, and the Court rejected that argument 1c-425-2020.

In a civil-law context, 4A_365/2017 held that data from which names had been removed may still relate to determinable persons. Determinability is assessed relative to the additional information available and the interest in identification, and a merely theoretical possibility of identification is not enough 4a-365-2017. Applied to Art. 37 para. 1, this means that removing identifiers alone does not take the recipient outside data protection law. That is why the ordinance adds a contract and security measures, and why Art. 19 para. 2 lit. a and c BStatG continue to apply after disclosure 431.01--19.

Sensitive personal data and private recipients

Art. 39 para. 1 lit. b DSG allows a federal body to disclose particularly sensitive personal data to private persons only in a form that does not allow the persons concerned to be identified 235.1--39. Art. 5 lit. c DSG lists these categories, for example health data, data on social assistance measures and data on criminal prosecutions 235.1--5.

Art. 37 para. 1 BStatV lets the producer give "Dritten" data from which only the direct identifiers have been removed 431.011--37. Where such data are particularly sensitive and the recipient is private, the statute prevails over the ordinance. Removing identifiers then suffices only if, applying the test in 1C_425/2020, the persons concerned are no longer determinable 1c-425-2020.

The ordinance contains related safeguards for this category of data:

  • Art. 36 BStatV requires a processing regulation with additional data protection and security measures for particularly sensitive personal data 431.011--36.
  • Linked data that are particularly sensitive, or that reveal the essential characteristics of a natural or legal person, must be destroyed, not merely anonymised, once the source data of the last collection have been integrated into the analysis 431.011--32.
  • An exception applies to research projects of national importance: at the request of the applicant, the BFS may keep the source data and the key separately to ensure the project can be reproduced 431.011--33.

Content of the data protection contract

Under lit. b, the recipient must undertake in a data protection contract 431.011--37:

  1. not to pass the data on to third parties without the consent of the competent organ;
  2. to destroy the data when the work is finished or, in justified cases, to hand them to the BFS or the competent organ for safekeeping.

The first undertaking carries out Art. 19 para. 2 lit. b BStatG and Art. 39 para. 1 lit. c DSG 431.01--19+1. The destruction obligation has no direct counterpart in those statutory provisions. It gives effect to the purpose limitation in Art. 14 para. 1 BStatG 431.01--14.

Since the contract is the means by which the recipient's ability to comply with statistical secrecy is secured under Art. 19 para. 2 lit. d BStatG, it should also cover the other statutory conditions: publishing results only in non-identifiable form, and anonymising early 431.01--19.

The model differs from the linkage contract under Art. 39 BStatV 431.011--39:

  • In linkage on request, the BFS carries out the linkage itself.
  • It may involve the applicant in particular tasks, which must be defined in a "Verknüpfungs- und Datenschutzvertrag".
  • Creating the project-specific pseudo-identifier always remains reserved to the BFS.
  • The BFS destroys the third-party data when the contract expires, subject to Art. 33 BStatV.

Data security

Lit. c requires the necessary data security measures 431.011--37. Art. 8 DSG supplies the yardstick: technical and organisational measures that ensure security appropriate to the risk 235.1--8. Under Art. 34 BStatV, the EDI defines the data security requirements 431.011--34. Art. 34 sits in the section on data linkage. Because lit. c refers generally to "die nötigen Massnahmen", the risk-based standard of Art. 8 DSG governs disclosures under Art. 37 in any case 235.1--8.

Disclosure to international statistical offices

Abs. 1 permits disclosure to statistical offices of international organisations on the same conditions as to domestic recipients 431.011--37. Art. 19 para. 2 BStatG does not name this group separately, so it has to be read as falling under "Dritte" 431.01--19. The international exchange of statistical information counts as statistical work under Art. 5 para. 1 lit. h BStatV 431.011--5.

Data from which only identifiers have been removed remain personal data (see above). In 4A_365/2017, a transfer abroad of data from which names had been removed, but whose subjects remained determinable, stayed subject to data protection rules 4a-365-2017. Art. 16 and 17 DSG therefore apply in addition. Under Art. 16 DSG, disclosure abroad, including to an international body, requires one of two things 235.1--16:

  • a Federal Council finding that the protection is adequate; or
  • suitable safeguards, in particular contractual clauses or guarantees that have been communicated to or approved by the EDÖB.

Art. 17 DSG provides exceptions, among them the safeguarding of an overriding public interest 235.1--17.

An Art. 37 data protection contract may serve as such a safeguard only if it meets the requirements of Art. 16 DSG. Until 14 October 2026, data exchange with the European statistical system was additionally governed by the EU regulations referred to in the former Abs. 3 ch-fedlex--431.011--2025060....

Administrative data under special secrecy (Abs. 2)

Statutory background

Abs. 2 applies to personal administrative data that are subject to a statutory duty of secrecy and that reached the statistics producer by one of two routes 431.011--37:

  • Art. 7 para. 2 BStatG: data taken over from cantonal and communal databases. If they are subject to a statutory duty of secrecy, they may not be passed on under Art. 19 BStatG and Art. 39 DSG 431.01--7.
  • Art. 10 para. 5 BStatG: data delivered to the BFS. As a rule, secrecy duties can be raised against a delivery to the BFS only where a federal statute expressly excludes statistical use. The BFS may not pass such data on under Art. 19 BStatG and Art. 39 DSG 431.01--10.

Read literally, the statute thus forbids passing such data on through the channel of Art. 19 para. 2 BStatG. The ordinance allows them to be passed on, but "nur in vollständig anonymisierter Form" 431.011--37. The two can be reconciled: fully anonymised data are no longer personal data, so their release is not a "Weitergabe" of secret data at all. Under Art. 26 para. 3 BStatV, full anonymisation requires deleting both the statistical identifier and the personal identifiers 431.011--26. In substance, it must also meet the standard of 1C_425/2020: identity can no longer be established, or only with extraordinary effort 1c-425-2020. Pseudonymised data under Abs. 1 lit. a never satisfy Abs. 2.

The secrecy follows the data

Federal Supreme Court case law on the relationship between secrecy and freedom of information shows why Abs. 2 is needed. In BGE 150 II 191, the customs authority had collected data on gold imports from importers' declarations while acting as tax authority. The Court held that VAT secrecy under Art. 74 MWSTG covered all of this information. In the Court's words: "even if the information collected may also serve purposes, in particular, of statistics" ("même si les renseignements recueillis peuvent également servir à des fins, notamment, de statistique") 150-ii-191. Art. 74 MWSTG is a special provision within the meaning of Art. 4 BGÖ, and once it applies there is no room for balancing interests 152.3--4150-ii-191. The decision concerned the customs authority, not a statistics producer. By analogy, it supports the premise of Abs. 2: special secrecy is not lost because the data are reused for statistics.

How far the secrecy reaches depends on the special statute. Art. 74 para. 2 MWSTG excludes certain register data from VAT secrecy, including the registration number, address, economic activity and the start and end of tax liability 641.20--74. Art. 110 para. 2 DBG allows information to be given where there is a basis in federal law 642.11--110.

The Federal Administrative Court has held that secrecy protects only the persons it is designed to protect. In A-5111/2013, the Court found that Art. 33 ATSG (which reads "gegenüber Dritten Verschwiegenheit zu bewahren") serves primarily to protect the insured person. It therefore did not bar access to data about employers 830.1--33a-5111-2013. For Abs. 2, the precise question is whose data the special secrecy shields. Data about other persons contained in the same administrative dataset fall under the general regime of Abs. 1.

What counts as fully anonymised

A-6255/2018 gives a concrete test drawn from tax secrecy under Art. 110 DBG a-6255-2018:

  • Canton-level totals of back taxes and fines could be disclosed because they allowed no conclusion about the taxpayers concerned.
  • The number of proceedings per canton was withheld because it was "nicht vollständig ausgeschlossen" that in individual cases a particular taxpayer's back taxes or fine could be inferred a-6255-2018.

The decisive factor was the combination of small cell counts with knowledge the requester might already have. That is a useful check for any release under Abs. 2.

A cantonal decision from Basel-Stadt illustrates the outer limit. Where a request concerns a named company, even redacted documents can be linked to that company. Anonymisation is then factually impossible, and cantonal tax secrecy prevails over the cantonal freedom-of-information law bs-49419. The decision applies cantonal law. It shows that anonymity has to be assessed in light of what the recipient already knows, not only by looking at the dataset in isolation.

Partners in the federal statistics system (Abs. 4)

Abs. 4 creates a separate disclosure channel to the partners in the federal statistics system 431.011--37. Under Art. 14 para. 3 BStatV, these are central cantonal statistical offices and communal statistical offices that meet two conditions: they are based on a cantonal statistics law, and they comply with the recognised principles of statistics defined in the Charter of Public Statistics of Switzerland 431.011--14. Whether a particular office qualifies therefore depends on cantonal legislation and on its compliance with the Charter.

Unlike Abs. 1, Abs. 4 does not require prior removal of identifiers. Its purposes, plausibility checks and linkages under Art. 30 BStatV, presuppose identifiable or at least linkable data 431.011--37. The safeguard lies instead in the contract. For linkage, Art. 30 para. 2 BStatV sets out what the cantonal and communal offices must undertake in a data protection contract 431.011--30:

  • to ensure data protection to the same degree as the BFS;
  • to take adequate data security measures;
  • to comply with statistical principles and standards;
  • to issue and implement a data processing regulation before the data are disclosed;
  • to guarantee their professional independence from enforcement bodies.

The EDI determines when the standards and independence requirements are deemed met 431.011--30. Where an office cannot meet these requirements, the BFS may carry out the linkage itself on request under Art. 39 BStatV, which expressly supports linkage projects of cantonal and communal statistical offices 431.011--39.

The language versions differ on the contract. The German text of Abs. 4 states only that the details are laid down "in einem Vertrag". The French and Italian texts speak of a "contrat de protection des données" and a "contratto di protezione dei dati" 431.011--37. Art. 30 para. 2 BStatV, read together with the French and Italian wording, indicates that a data protection contract is required 431.011--30.

Non-personal data (Abs. 5)

Data that are not personal may be passed on without a contract 431.011--37. The term must be read in the light of the article's subject matter. The DSG defines personal data as relating only to natural persons 235.1--5. Art. 37 BStatV, however, protects data of legal persons alongside personal data. "Nicht personenbezogen" therefore excludes data that can be attributed to an identifiable undertaking as well.

Two points frame the exemption:

  • Combining aggregated data from different sources is not a linkage of individual data 431.011--28. Genuinely aggregated results, such as synthesis statistics, therefore fall under Abs. 5.
  • Aggregation is not anonymous in itself. A-6255/2018 shows that small cell counts can make individuals identifiable a-6255-2018. Under the determinability test, data from which names have been removed may still be personal data 4a-365-2017. A producer that relies on Abs. 5 must therefore check, before release, that no attribution to particular persons is possible.

Relationship to freedom of information and to the data subject's access right

Art. 37 governs disclosures that the producer initiates for statistical work. It does not decide whether third parties may request access under the BGÖ. Three lines of case law define the boundary:

  • Administrative data reused for statistics. In 1C_50/2015, journalists sought an EFD supplier list without anonymisation. The data had arisen in procurement and payment, not in statistical collection. For such data, the Court held that the transparency purpose of the BGÖ must prevail. Any confidentiality rule under Art. 19 para. 2 BStatG could go no further than the more specific procurement law. Where procurement law permitted publication of suppliers' names, "hat das allgemeine Statistikgeheimnis zurückzustehen" 1c-50-2015.
  • Register data collected for statistics. In A-4708/2022, a request for the list of all registered companies with UID and NOGA code from the BUR was at issue. The Federal Administrative Court held that Art. 14 BStatG is not, at least for that list, a special provision that takes precedence over the BGÖ. It added that "Die Regelung auf Verordnungsstufe im BURV reicht für eine Spezialnorm unbestrittenermassen nicht aus" a-4708-2022. The Court stressed that legal persons need less protection than natural persons. It remanded the case for a balancing of interests a-4708-2022. In A-4618/2024, the BFS had again refused the list on the basis of Art. 10 para. 3 and 14 BStatG. The Court held the remand binding and found that disregarding it "stellt eine materielle Rechtsverweigerung dar". It annulled the refusal and remanded again without itself granting access a-4618-2024.
  • Consequence for Art. 37 BStatV. The contrast is the special statutory secrecy in BGE 150 II 191, which excludes access under Art. 4 BGÖ (see the section on Abs. 2 above) 150-ii-191. The reasoning of A-4708/2022 applies to Art. 37 BStatV, which is likewise an ordinance-level rule. It cannot be read as a closed list of permissible recipients that excludes BGÖ access. Where a document cannot be anonymised, Art. 9 BGÖ refers the assessment to Art. 36 DSG or Art. 57s RVOG 152.3--9. Art. 7 para. 2 BGÖ protects third parties' privacy, subject to an overriding public interest 152.3--7.

The data subject's own access right is also unaffected by statistical secrecy. In 1C_425/2020, the Federal Supreme Court found that the BFS had neither substantiated nor shown how Art. 14 para. 1 BStatG could bar the data subject's access to his own data in the archived sampling frame 1c-425-2020. That decision applied the former DSG.

Criminal and contractual sanctions

A recipient of data under Art. 19 BStatG is bound by statistical secrecy under Art. 14 para. 2 BStatG 431.01--14. Art. 23 BStatG makes it an offence to breach Art. 14 by passing on data that must be kept secret, or by using them for non-statistical purposes 431.01--23:

  • intentional breach: custodial sentence of up to three years or a monetary penalty;
  • negligent breach: monetary penalty.

A breach of the undertakings in the Art. 37 contract (onward transfer without consent, or use beyond the agreed work) can therefore be a criminal offence as well as a breach of contract.

For staff of the disclosing organ, Art. 320 StGB also applies. Breach of official secrecy carries a custodial sentence of up to three years or a monetary penalty, remains punishable after the service relationship ends, and is not punishable if the superior authority has given written consent 311.0--320.

Practical checkpoints

For the disclosing organ:

  • Classify the dataset first:
    • personal data or data of legal persons (Abs. 1);
    • administrative data under special secrecy received under Art. 7 para. 2 or 10 para. 5 BStatG (Abs. 2: full anonymisation only);
    • non-personal data (Abs. 5).
  • Identify the recipient's function. A recipient with enforcement or supervisory tasks towards particular persons does not qualify under Abs. 1 431.011--4.
  • For particularly sensitive data going to private recipients, check non-determinability under Art. 39 para. 1 lit. b DSG. Removing identifiers does not settle it 235.1--39.
  • For cells with small counts, apply the re-identification test of A-6255/2018 before treating results as anonymous a-6255-2018.
  • For international recipients, document the basis under Art. 16 or 17 DSG 235.1--16.

For recipients:

  • Expect a data protection contract covering onward transfer, destruction or return, security, and publication only in non-identifiable form (see the section on the contract above). Breaches can be criminal offences (see the section on sanctions above).

For cantonal and communal offices:

  • Partner status depends on a cantonal statistics law and on compliance with the Charter 431.011--14.
  • A data processing regulation must be in place before any data are received 431.011--30.