12 December 2016 – In a decision of 16 November 2016 (available here), rendered within the context of an ongoing criminal lawsuit, the Swiss Federal Supreme Court (Supreme Court) ruled that Facebook Switzerland Sàrl (Facebook Switzerland) was not the proper addressee for data production requests.

The historical premises of this ruling go back to 22 April 2015 when a Belgian journalist filed a criminal complaint for defamation, wilful defamation (libel) and insult. A person using a pseudonymous Facebook account had previously accused the journalist of antisemitism, among other things.

Upon reception of the complaint, the Central Public Prosecutor’s Office of the Canton of Vaud, ordered Facebook Switzerland to produce the following information: identity of the holder of the pseudonymous account, the IP addresses used to create the said account, connection logs and the related IP addresses, as well as the private content of the account. Facebook Switzerland and its two managers appealed against the production order, first on the cantonal level where they were denied by the Cantonal Court of the Canton of Vaud, and then successfully before the Supreme Court.

The Supreme Court started by analysing the applicable law for the production of the above-mentioned information within the context of criminal proceedings. It held that the Code of Criminal Procedure remains the valid legal basis for the production of information from service providers such as Facebook and other social media. The Supreme Court noted, however, that this would not have been the case had the revised Federal Act on the Surveillance of Correspondence by Post and Telecommunications (ASCPT) already been applicable at that time. Indeed, under this revised legislation, even service providers which do not use IP addresses and technologies for the transmission of information nonetheless fall under the scope of the ASCPT.

The above considerations did, however, not have a material impact on the Supreme Court’s ruling. Indeed, key to the decision was the fact that Facebook Switzerland’s purpose is confined to the provision of advertisement and marketing strategy. Facebook users domiciled outside of the US and Canada enter into contractual relationships solely with Facebook Ireland and not with Facebook Switzerland. Facebook Ireland is the sole owner of the personal data of such users. In contrast, Facebook Switzerland has neither direct access to such personal data nor does it have control over the personal data processed in connection with the provision of the services of Facebook.

Consequently, the Swiss prosecutors have to address their requests for information to Facebook Ireland by way of mutual legal assistance proceedings.