235.1 Swiss Federal Act on Data Protection 6HFWLRQ3URFHVVLQJRI3HUVRQDO'DWDE\)HGHUDO$XWKRULWLHV $UWLFOH Responsible authority 1 Any Federal authority that processes personal data or has such data processed in the execution of its duties shall be responsible for ensuring the protection of such data. 2 In the event that a Federal authority processes personal data jointly with other Federal authorities, with cantonal authorities or with private persons, the Federal council may regulate the specific responsibilities with regard to data protection. $UWLFOH 1 Legal principles Federal authorities may process data only if there is a legal basis for doing so. 2 Sensitive data or personal profiles may be processed only if a formal law expressly provides therefor or if, exceptionally: a) such processing is indispensable for the fulfilment of a task clearly defined in a formal law; b) the Federal council has authorised such processing, because rights of the persons affected are not jeopardised or c) the person affected in the specific case has granted express consent or has personally made the data accessible to the public. $UWLFOH Collection of personal data 1 Any Federal authority that systematically collects data, in particular through the use of questionnaires, must specify the objective of and the legal basis for the processing, the categories of persons dealing with the file, and the recipients of the data. 2 The collection of sensitive data or of personal profiles relating to the characteristics of a person must be carried out in a manner that is visible to the persons affected. $UWLFOH Disclosure of personal data 1 Federal authorities may disclose personal data provided they have legal grounds for doing so in terms of Article 17 or if: a. the data is indispensable to the recipient in the specific case in order to fulfil its legal duties; b. the person affected has given his express consent in the specific case or the circumstances imply such consent; c. the person affected has made the data accessible to the public or d. the recipient credibly asserts that the person affected is refusing to give consent or prohibiting disclosure in order to prevent the recipient from asserting legal rights or from safeguarding other interests that are worthy of protection; whenever possible the person affected must be allowed the opportunity to state his case. 2 Federal authorities may, on request, disclose the name, first name, the address and the date of birth of a person even if the conditions set forth in paragraph 1 are not fulfilled. 3 Federal authorities may make personal data available via remote access, provided express provision is made therefor. Sensitive data or personal profiles may only be made available via remote access provided a formal law provides therefor. 6