Switzerland: Issued FDPIC ruling in investigation into legality of Digitec Galaxus' customer account requirement

On 15 April 2024, the Swiss Federal Data Protection and Information Commissioner (FDPIC) concluded an investigation into Digitec Galaxus for potential data protection violations. The investigation focused on the mandatory customer account requirement for purchases, which was found to infringe upon the principles of transparency and proportionality in data processing. The FDPIC's final report highlighted the need for Digitec Galaxus to revise its data protection declaration to ensure clear communication about data processing activities, including the nature of data collected, its purposes, and the recipients of such data. The FDPIC recommended offering a guest purchase option as a means to align data processing practices with the principle of proportionality.