Consent in online forms: what the Swiss FADP provides

A Pilates studio in Lucerne puts its course sign-up online: name, email, phone, the course, a question about back complaints. At the very bottom, as on many forms, there is a tick box: “I have read the privacy policy and agree.” Without the tick, the form cannot be sent.

The owner copied the tick box from another website. Whether it is needed, what it does and whether it covers the question about back complaints, she does not know. She is in good company: the tick box is so common that it looks like a legal requirement. The Swiss Federal Act on Data Protection (FADP, in German DSG) takes a more differentiated view.

Informing and consent are two different things

The FADP distinguishes two things that forms often merge into a single tick box.

Information is the business’s duty. Whoever collects personal data informs the person concerned appropriately (Art. 19 para. 1 FADP). At a minimum, that means the identity and contact details of the controller, the purpose of processing and, where applicable, the recipients (Art. 19 para. 2 FADP). The information is given whether or not the person agrees to anything.

Consent is a declaration by the person concerned. The FADP names it as one of several grounds that can justify processing — alongside an overriding private or public interest and the law (Art. 31 para. 1 FADP).

The Federal Data Protection and Information Commissioner (FDPIC) has described this distinction in detail in a fact sheet on patient forms. On information, it states that explicit acknowledgement is not a condition of validity: whether the duty to inform has been met does not depend on a patient’s signature. To avoid needless problems, it is better not to ask for a signature at all.

Applied to an online form, this means a tick box saying “I have read the privacy policy” confirms an acknowledgement the law does not ask for. What the law asks for is that the information is there — easy to see, understandable, and without anyone having to look for it.

When the FADP calls for consent

In the private sector, not every processing of personal data needs a justification. The FADP prohibits unlawfully infringing the privacy of the persons concerned (Art. 30 para. 1 FADP) and lists cases in which an infringement exists in particular (Art. 30 para. 2 FADP):

• when personal data is processed contrary to the principles, for example disproportionately or for a purpose that is not recognisable;
• when it is processed against the express wishes of the person concerned;
• when sensitive personal data is disclosed to third parties.

Only then does the question of a justification arise. One of them applies to forms particularly often: an overriding interest may exist in particular where the controller processes personal data about a contracting party in direct connection with concluding or performing a contract (Art. 31 para. 2 let. a FADP).

For the Pilates studio, this means name, email and course serve the sign-up itself. As a rule, that requires information, not consent. The FDPIC describes the same pattern in a doctor’s practice: data processed as part of a treatment falls under the treatment contract; consent matters mainly where data is passed on to third parties.

Where consent comes into play

A few situations in which forms genuinely ask for consent come up again and again in small businesses.

Situation in the form	What the FADP says
Health details, such as complaints or allergies	Health data is sensitive; where consent is needed, it must be express (Art. 6 para. 7 FADP)
A newsletter on top of the sign-up	A separate purpose beside the contract; consent must relate to that specific processing (Art. 6 para. 6 FADP)
Passing details on to a partner business	A disclosure to third parties; for sensitive data, the law names it explicitly (Art. 30 para. 2 let. c FADP)
Photos of participants for the website	A purpose unrelated to the sign-up that must be recognisable to the person (Art. 6 para. 3 FADP)

The question about back complaints falls into the first row. Whether the studio can rely on the contract or needs express consent depends on the case. What is clear: a general tick box about the privacy policy is not consent that recognisably relates to the health details.

What makes consent valid

Where consent is required, it is only valid if it is given voluntarily, for one or more specific processing operations, after adequate information (Art. 6 para. 6 FADP). The FDPIC’s fact sheet sums this up in three qualities:

Informed. The person knows which data is processed for what purpose and can assess the consequences. That includes at least the information under Art. 19 FADP and, depending on the case, the retention period and the recipients.

Specific. Consent relates to specific processing operations. The FDPIC rules out blanket clauses and open-ended consent; consent should be obtained when the question actually arises.

Free. The person has a real choice and can refuse or withdraw without disproportionate disadvantages. If she has no real alternative to agreeing, the FDPIC says the consent is not free.

Two practical observations follow for a form. A tick box without which the course sign-up cannot be sent leaves the person no choice — and the course itself does not need consent anyway. And a tick box covering several purposes at once is not specific. Where the fact sheet describes a genuine choice, its example is a box to tick on the form.

Record and withdrawal

Consent is not tied to any form. The FDPIC notes, however, that documented consent is preferable for evidential reasons. An online form makes this easy: the time and the exact wording the person agreed to can be stored with the response. If the business changes the text later, it remains clear what applied at the time.

That is how we do it on this website. When someone asks to be told when an app launches, the entry records the time of consent and the wording shown at the moment.

Where consent is the legal basis, it can be withdrawn at any time and without giving reasons. The controller should provide simple ways to do so, the FDPIC writes. For a form, that means stating next to the tick box how to take it back — an address, a link, an unsubscribe route in the newsletter.

A tidier form

Back to the Pilates studio. A revised version of its form could look like this:

1. Above the send button, a short sentence: who receives the details, for what, how long they are kept, with a link to the full privacy policy. No mandatory tick box.
2. The question about complaints with its own note on why it is asked — and, if the studio obtains consent for it, a separate box naming exactly these details.
3. The newsletter as a separate, empty box; the sign-up works without it.
4. One sentence on how to withdraw consent that has been given.

The form does not get longer. It gets clearer: everyone can see what they are agreeing to and what they are not.

How far these considerations go for a particular business depends on the purpose, the data and the context. The FDPIC’s fact sheets are a good starting point for going through one’s own forms. In the Forms app we are building, you will set retention periods for each form yourself — one of the details that belongs in the note above the send button.