On June 21, 2023, the Federal Data Protection and Information Commissioner (FDPIC) announced that it proceeded with a formal investigation, on June 20, 2023, against the Federal Office of Police (Fedpol) and the Federal Office of Customs and Border Security (FOCBS) concerning potential serious violations of data protection regulations. In particular, the FDPIC opened a preliminary inquiry, on April 13, 2023, into questions raised by the Aargauer Zeitung, a newspaper, on April 11, 2023, concerning the legality of access by FOCBS employees to the national search database (RIPOL) which is operated by Fedpol. During the preliminary inquiry, the FDPIC noted that both federal offices submitted written statements regarding the facts of the case.

In early June 2023, the two federal offices informed the FDPIC, first verbally and later in writing via the FDPIC's data breach reporting platform, that there had been data security breaches with potentially high risks for those affected. The breaches had resulted from outsourcing work to the software company Xplain AG.

After evaluating the statements of the two federal offices and questioning Xplain AG about the reported data security breaches, the FDPIC concluded its preliminary inquiry. As the investigation is ongoing, the FDPIC highlighted that no further information can be provided at present.

You can read the press release here.

Update July 17, 2023

FDPIC extends investigation activities to Xplain AG

On July 14, 2023, the FDPIC announced an extension of its formal investigation to include Xplain AG, due to additional information regarding the data security breach reported. The extended investigation was launched on July 13, 2023.

You can read the press release here.