235.1 Swiss Federal Act on Data Protection 3 A private file controller may additionally refuse to provide, or restrict or defer the provision of requested information when it is in his own overriding interest and on the condition that the data is not passed on to a third party. 4 The file controller must indicate the reason why he is refusing, restricting or deferring access to the information. $UWLFOH Restriction of the Right to Information for Media Employees 1 The file controller who uses a file for the sole purpose of publication in the editorially-controlled section of a periodically published media organ may refuse to provide, or restrict or defer the provision of the requested information if: a) the personal data provides information as to its source; b) a right to examine drafts for publication must result; c) the freedom to shape public opinion will be compromised. 2 Journalists may additionally refuse, restrict or prevent the communication of information requested if a file is being used exclusively as personal work aid. $UWLFOH File register 1 The Federal Data Protection Commissioner shall keep a file register. Anyone may inspect the register. 2 Federal government authorities must declare all files to the Federal Data Protection Commissioner for registration. 3 Private individuals who regularly process sensitive data, data profiles or communicate personal data to a third party must register their files if: a) the processing of such data is not subject to a legal requirement and b) the persons affected are unaware that such data is being processed. 4 The files must be registered prior to processing. 5 The Federal Council shall issue regulations on the registration of files and on the maintenance and publication of the register. It may also provide for exemptions from the duty to declare or register for certain types of files, provided the processing does not endanger the privacy of the persons affected. 6HFWLRQ3URFHVVLQJRISHUVRQDOGDWDE\SULYDWHSHUVRQV $UWLFOH Infringement of privacy 1 Whoever processes personal data must not unlawfully infringe the privacy of the persons affected. 2 No one shall have the right without justification to: a) process personal data in a manner that contravenes the principles as set forth in Articles 4, 5 paragraph 1, 6 paragraph 1 and 7 paragraph 1; b) process personal data against the express wishes of the data subject; c) disclose to a third party any sensitive data or personal profiles. 3 As a general rule, a person’s rights cannot be infringed if the person affected has made the data generally available to the public and has not expressly prohibited processing. 4