235.1 Swiss Federal Act on Data Protection 2 Whoever wishes to transmit data abroad must notify the Federal Data Protection Commissioner beforehand in cases where: a) there is no legal obligation to disclose the data and b) the persons affected have no knowledge of the transmission. 3 The Federal Council shall regulate the notification procedure in detail. It may provide for a simplified notification procedure or exemptions from the duty to notify in the event that the processing does not endanger the privacy of the persons affected. $UWLFOH Data security 1 Personal data must be protected against unauthorised processing by appropriate organisational and technical means. 2 The Federal Council shall enact more detailed provisions on the minimum data security measures. $UWLFOH Right of information 1 Anyone may ask a file controller if data stored relating to him is being processed. 2 The file controller must provide information on: a) all data relating to the individual that is contained in the file; b) the purpose and if necessary the legal basis for the processing, the categories of processed data, the individuals involved in processing the file, and the individuals designated to receive the file. 3 The file controller may disclose data relating to the health of an affected person to that person via a doctor designated by the person. 4 In the event that the file controller has the personal data processed by a third party, the file controller shall remain responsible for providing any information that is requested. The third party shall be obliged to provide information in the event that it does not disclose the name of the file controller or in the event that the file controller is not resident in Switzerland. 5 The information should, as a general rule, be provided free of charge and submitted in writing in printed form or as a photocopy. The Federal Council shall regulate exemptions from the foregoing. 6 No authority shall have the right to waive their right to information in advance. $UWLFOH Restriction of the Right to Information: General 1 A file controller may refuse to provide, or restrict or defer the provision of the requested information in cases where: a) a formal provision of the law so provides; b) he is required to do so due to the overriding interests of a third party. 2 A Federal authority may refuse to provide, or restrict or defer the provision of the requested information in cases where: a) it is required due to overriding public interests, and in particular in the interests of the internal or external security of the Confederation; b) the communication of the information may compromise criminal proceedings or other investigative processes. 3