A Five-Year Fight Ends in Zurich's Favor for Privacy
On June 22, 2026, Switzerland's Federal Administrative Court dismissed the appeal of Inkasso-Team AG, a debt collection agency, closing out one of the more instructive enforcement sagas under the country's revised Federal Act on Data Protection (nFADP). The court's ruling in case A-3891/2025 upheld an order the Federal Data Protection and Information Commissioner (FDPIC) issued on April 28, 2025: shut down the website "Schuldner-finden.com" and delete every piece of personal data it had published (FDPIC ruling). Inkasso-Team must also pay CHF 5,000 in procedural costs, and the site — once searchable, now dark — is gone (SwissCybersecurity.net).
What the Site Actually Did
Schuldner-finden.com was not a passive database. It published names, voice recordings, and narrative allegations of fraud, unpaid loans, and ongoing legal proceedings against people the company identified as debtors — and it solicited tips from the public to help track down those whose whereabouts were unknown. The stated purpose, per the FDPIC's original decision, was twofold: locate debtors and "warn third parties" away from them. The court found that this crowdsourced exposure violated personality rights and could not be justified under Article 31 of the Data Protection Act, since Inkasso-Team had neither consent from the people named nor an overriding public or private interest strong enough to outweigh the harm (FDPIC order, German).
The FDPIC first flagged the site informally back in September 2021, under the old law — a warning Inkasso-Team ignored. Only after the nFADP took effect in September 2023 did the regulator open a formal investigation, culminating in last year's order and now this court affirmance. It is, notably, only the second Federal Administrative Court ruling to uphold FDPIC enforcement practice since the revised law took effect, following an autumn 2025 case against a similar "naming and shaming" religious-affiliation portal.
Steelmanning the Debt Collector's Case
Before dismissing Inkasso-Team's position, it's worth taking it seriously. Creditors have a legitimate interest in locating debtors who dodge service of process or simply vanish, and information asymmetry genuinely favors people who default and disappear. Publishing true, verifiable facts about unpaid debts is not inherently defamatory, and a purely speech-based objection to "debtor shaming" would prove too much — plenty of jurisdictions tolerate public debt registries precisely because transparency disciplines bad-faith borrowers and protects future creditors from fraud repeats.
Why This Isn't a Speech Case
But that steelman actually cuts against Inkasso-Team, because Switzerland already has the institution that argument calls for: the state-run debt enforcement register (Betreibungsregister). Anyone with a credible interest — a landlord, a lender, a prospective business partner — can obtain an extract, and it works precisely because it is bounded. Entries are deleted five years after a proceeding closes, and as of amendments effective January 1, 2026, debtors can even request that unjustified enforcement actions be withheld from extracts for the full five-year window (Swiss debt register overview). That is what proportionate, purpose-limited disclosure looks like: access gated to people with a real stake, a fixed retention clock, and a dispute mechanism.
Schuldner-finden.com had none of that. It layered unverified fraud and criminal-proceedings allegations onto identity data, added voice recordings, invited the public at large — not just people with a contractual interest — to participate in locating named individuals, and imposed no retention limit or correction process. That is the proportionality failure the court actually ruled on: not whether debt information may ever be shared, but whether a private company may build an unbounded, crowdsourced alternative to the register the state already calibrated for this exact purpose.
Part of a Pattern, Not a One-Off
This is not an isolated result. In June 2026, the FDPIC separately warned a different website operator — unnamed, in a case triggered by complaint — after finding it had published documents, photos, and ID copies of alleged debtors; that operator deleted the material during the proceedings and received a warning rather than a formal order, since the underlying conduct had already stopped (Steiger Legal). Read together, the two cases show a regulator applying a consistent, narrow test — proportionality and justification under Article 6 and Article 31 DSG — rather than reaching for a blanket rule against publishing debt information.
The Right Takeaway for Innovators
For companies operating in Switzerland, the lesson is not that data-driven debt collection tools are off-limits. It's that any private registry mimicking a state function needs the same guardrails the state built: access limited to parties with a genuine interest, verified rather than crowdsourced claims, and a retention and correction mechanism. Inkasso-Team's failure was not innovation — it was skipping every safeguard that makes public disclosure of sensitive financial data defensible in the first place. The FDPIC and the Federal Administrative Court didn't need to invent new doctrine to stop it; they applied the proportionality test the nFADP already contains. That's proportionate regulation working as intended, not overreach.