What personal data a sign-up form actually collects

A music school in Chur puts its term registration online. The form is quick to build: first name, surname, email, phone, address, the child’s date of birth, instrument, a box for remarks, a tick for the terms and conditions. Nine fields, half an hour’s work.

What ends up in the spreadsheet afterwards is more than nine entries. Part of it was never asked for, part of it falls into a category that the Swiss Federal Act on Data Protection (FADP) singles out — and one field takes in whatever nobody planned for.

Field by field

Personal data, under Art. 5 let. a FADP, is “all information relating to an identified or identifiable natural person”. That is wider than it sounds in everyday use: it is enough that a person can be identified, not that their name is written down.

Field	What actually arrives in it	What comes with it
First name, surname	Identity, directly	Makes every other field attributable
Email address	Often first name, surname and employer in one line	A channel the person stays reachable on
Phone number	A number, usually the same one for years	Easy to match against other directories
Address	Where someone lives, the neighbourhood, sometimes the housing situation	Together with a name, almost always unique
Date of birth	Age, minority, year group	A common key for joining records together
Select fields	Exactly what was asked — and sometimes more	“Course for the unemployed” says something about the person’s situation
Free-text box	Whatever the person filling it in thinks matters	See below
File upload	The contents of the file and its metadata	A photo often carries capture time and device, a PDF the author’s name
Consent tick	The fact of consent, sensibly with a timestamp and the wording that was shown	The record of what was consented to, and when

The select field deserves a second look. A dropdown seems harmless because the options are given. But the options themselves can carry statements: “reduced rate for disability pensioners”, “returners’ group after illness”, “evening course for union members”. Ticking such an option discloses something that the form never asked as a question.

What arrives without anyone typing it

Alongside the filled-in fields, a second layer of information comes into being at the moment of submission. It is invisible on the form and usually already visible in the results table.

The time. Every entry carries a timestamp. On a registration form, that is administrative. On an internal reporting form, the timestamp is itself information: in a small business, whoever filed something at 23:40 on a Sunday may already be narrowed down.

The page it came from. Many form tools record which page the person arrived from. That can be harmless. It can also mean the table records that someone read the page “advice on over-indebtedness” before signing up.

Technical details. Depending on the tool, IP address, browser and device are recorded. Whether such details make a person identifiable in a given case turns on Art. 5 let. a FADP — and therefore on what else is in the same row.

Intermediate states. Forms that save as you type also keep what someone wrote and then deleted. The second, more considered answer does not always replace the first everywhere.

This layer is not the product of bad intent but of defaults. Art. 7 para. 3 FADP addresses exactly this point: the controller ensures, through appropriate default settings, that processing is limited to the minimum required for the purpose, unless the data subject specifies otherwise.

The category the law treats separately

The FADP does not sort personal data into “important” and “unimportant”, but it does define one exhaustively listed group. Art. 5 let. c FADP names as sensitive personal data:

1. data on religious, ideological, political or trade union views or activities
2. data on health, the intimate sphere or affiliation to a race or ethnicity
3. genetic data
4. biometric data that uniquely identifies a natural person
5. data on administrative or criminal proceedings and sanctions
6. data on social assistance measures

A name is not that. Nor is a phone number. But the note that a child has asthma is, as is the note that someone cannot attend on a given day for religious reasons, or that a registration runs through social services — or the fingerprint that opens an access control system. The Swiss Federal Data Protection and Information Commissioner (FDPIC) names health data and biometric features such as fingerprints as examples of this category.

What hangs on the classification

The category is not a label but the trigger for several provisions. Among other things, the law attaches to it:

• The form of consent. Where consent is required, it is valid only if given voluntarily for one or more specific instances of processing and after appropriate information (Art. 6 para. 6 FADP). For sensitive personal data it must additionally be explicit (Art. 6 para. 7 let. a FADP). Writing about health questionnaires, the FDPIC states that general blanket consents do not suffice, whereas specifically worded declarations do.
• Disclosure to third parties. A breach of personality exists in particular where sensitive personal data is disclosed to third parties (Art. 30 para. 2 let. c FADP). It is unlawful where no justification under Art. 31 FADP applies.
• Logging and a processing policy. Where sensitive personal data is processed automatically on a large scale and preventive measures cannot ensure data protection, Art. 4 DPO requires at least the logging of storage, alteration, reading, disclosure, deletion and destruction. Processing on a large scale also brings a processing policy under Art. 5 DPO.
• The register of processing activities. Businesses with fewer than 250 employees on 1 January are in principle exempt — unless sensitive personal data is processed on a large scale or high-risk profiling takes place (Art. 24 DPO).
• The data protection impact assessment. A high risk exists in particular where sensitive personal data is processed extensively (Art. 22 para. 2 let. a FADP).

“On a large scale” and “extensively” are not given a number anywhere. Whether a music school with 300 registrations a term falls under them is a question of the individual case, not something that can be read off the statute.

The free-text box

That leaves the field that gets the least thought and receives the most.

“Anything else we should know?” is a friendly question. It is also an open invitation. At a music school, the answer reads: “Nora has a nut allergy, please bear that in mind at camp.” At a sports club: “I’m on blood thinners, my GP knows.” On a course form: “I’m coming through the work integration programme, the invoice goes to the social services office.” In the contact form of an advice centre, the whole story sometimes turns up.

Three things about that are worth noting.

First: the information was not collected, it was offered. Nobody asked about health. The entries are nevertheless now in the same table as the phone numbers — and, once they are there, they are data on health within the meaning of Art. 5 let. c item 2 FADP. That they arrived unasked changes nothing about the classification.

Second: free text cannot be sorted. A field called “allergies” can be hidden, stored separately, shown to a limited group and deleted after a set period. A field called “remarks” cannot, because nobody knows in advance what it will contain. Everyone who may open the table sees everything.

Third: it is a design question before it is a legal one. The law requires personal data to be collected proportionately and only for a specific purpose that is evident to the data subject (Art. 6 paras. 2 and 3 FADP). The FDPIC puts the same point to associations by saying that only data genuinely necessary to fulfil the association’s purpose may be processed. A field whose contents are undetermined in advance makes that assessment hard — not because it is prohibited, but because something unknown is difficult to judge. Turning “remarks” into two concrete, clearly labelled fields means knowing in advance what will arrive.

A form where none of this applies

The counter-case is just as instructive. A joinery in Langenthal has a contact form on its website with three fields: name, email, message. No date of birth, no address, no upload, no dropdown with sensitive options. The enquiries are about kitchen fronts and delivery dates.

This is personal data, and the principles of Art. 6 FADP apply as they do everywhere. But none of the provisions on sensitive data come into play, because no such data arises — with one qualification. The “message” field is a free-text field. One day a sentence about an illness may appear there too. The difference from the first example is not the technology but the likelihood and the volume.

That is exactly why the question of which fields a form has is more useful than the question of which software produced it. The first can be answered in ten minutes by printing your own form and going through it line by line. For private individuals setting up a form for an event or a group order, it is the same half page of work.

With Formulare we are building a web app for precisely this case: forms whose answers are encrypted in the browser and stored in Switzerland. That changes nothing about which fields a form has — that stays the decision of whoever sets it up. It changes how many places can read the answers along the way.