Worked example: the claim narrative that was pasted

A case handler at a Swiss health insurer has a difficult letter to write. The claimant has been refused reimbursement for a treatment, has written three times, and the file is long. The handler pastes the full claim narrative, including the medical history and the claimant's name, into a consumer chatbot on her personal account and asks for a clear, sympathetic refusal letter. The letter is good. She sends it. Nobody notices for five weeks.

What happened, in the language of the law

A disclosure occurred. Personal data was transmitted to a third party abroad. Under the revised FADP, disclosure is processing, and this processing has to satisfy the Article 6 principles.

Purpose limitation failed. The medical history was collected to assess a claim. It was not collected so that a drafting tool could operate on it. Convenience does not make a new purpose compatible with the old one.

The information duty was already breached. Article 19 required the claimant to have been told, at collection, about the recipients or categories of recipients, and for a transfer abroad the state and the safeguard. None of that could have been said, because nobody knew. This cannot be repaired now. The duty attached earlier.

Special category data was involved. Health data. That raises the risk to the personality of the data subject and is exactly the category around which the impact assessment duty in Articles 22 and 23 is framed, for processing that poses a high risk, in particular extensive processing of sensitive data.

The account was the wrong one. The organisation's assessed arrangement, if it has one, covers the enterprise product. She used a personal login to a different product with different terms. Whatever protections the assessment established do not apply.

Is it a notifiable breach?

Article 24 requires notification to the FDPIC as soon as possible where a breach of data security is likely to result in a high risk to the personality or fundamental rights of the data subject. That is a judgement to be made on the facts, and it is a judgement the handler cannot make alone.

Two things the responding team must not do. They must not reach for 72 hours. That deadline does not exist in Swiss law; the standard is as soon as possible, which in a case like this means the assessment starts today rather than being scheduled. And they must not defer the assessment until everything is understood, because "as soon as possible" is measured against what was knowable, not against the comfort of a complete picture.

If the organisation also falls under the GDPR for other processing, its incident playbook may contain a 72-hour clock. Both can be true at once. The playbook needs to say which standard applies to which processing, or it will teach the wrong one.

Who is exposed

This is the part that changes behaviour. Under Swiss law the penalties fall on responsible natural persons, with fines up to CHF 250,000 for wilful breaches, including breach of the Article 21 information duty. Not on the entity. On a person.

Whether any individual is at risk in a given case depends on facts well beyond this example, and it is not the point. The point is that the design of the Swiss regime puts named people in frame, which is why the question "who authorised this" is the first one asked.

What would have prevented it

Reformulation. She needed help with the structure and tone of a refusal letter for a claimant who has written three times and feels unheard. That request contains no name, no diagnosis and no policy number, and it would have produced a letter just as good.

An approved route for the case where detail is genuinely needed. If summarising the actual file was the task, there had to be a tool assessed for it. Where there is none, the refusal has nowhere to go, and people route around it.

A rule about accounts, not only about tools. "Approved tool" means nothing if the browser is logged into the consumer version.

A way to report it on day one. Five weeks passed because the handler realised it was a mistake and had no safe way to say so. An incident route that punishes the reporter produces five-week delays, and under a standard of as soon as possible, the delay is the part that is hardest to defend.

As of 24 September 2026.