On 16 September 2026, Switzerland's Federal Data Protection and Information Commissioner (FDPIC/EDÖB) and privatim, the conference of cantonal data protection authorities, jointly published a guide on digital surveillance in hospitals and care homes. It covers cameras, infrared sensors and radar. The central rule is that monitoring must serve an objective that benefits the monitored person. Purely organisational reasons don't qualify. The press release gives checking whether a bed has been made as an example of an inadequate justification.
The guide is a sensible piece of regulatory work. It also shows where Swiss data protection law is stretched thin.
The strongest case for the regulator's position
The case for strictness is real. The guide notes that these systems process data intensively, because they intrude on the private and sometimes most intimate spaces of often vulnerable people. A resident with dementia cannot easily object to a radar sensor in their bedroom. Staff cannot easily object either, and neither can visitors. If a facility could install continuous video monitoring simply because it cuts night-shift costs, the people being watched would bear the burden while the institution kept the benefit. Requiring the monitored person to be the beneficiary is a clean way to stop that.
The ethical literature points the same way. The Swiss Academy of Medical Sciences (SAMW) recently argued that digital surveillance in hospitals should be used only exceptionally. Its working group leader, Regina Aebi-Müller of the University of Lucerne, noted that patients with delirium lack the capacity to consent, and that remote monitoring can even worsen delirium. The SAMW lists 14 ethical considerations, among them medical indication, proportionality, data minimisation, time limits and regular re-evaluation.
What the guide actually asks
The guide describes three forms of monitoring: direct (live images sent to care staff), indirect (the image is converted into a pictogram showing the person's position) and situational (a signal goes out only when a predefined event, such as a fall, occurs). Whatever the technology, the same principles apply: legality, an objective in the interest of the cared-for person, proportionality and secure solutions.
The guide ranks the options. Indirect or situational monitoring is preferred because it passes on only the data staff actually need, while protecting privacy outside critical moments.
On consent, the wording is blunt. According to the press release, the approval of the person concerned is desirable but neither required nor sufficient to legitimise the surveillance. Facilities must still inform people of the purpose and effects. Facilities are also expected to document risk analyses, review systems regularly, and train staff.
Where it gets harder
The legal basis differs by operator. Public institutions such as cantonal hospitals need a basis in cantonal law. Private facilities fall under the federal Data Protection Act (nFADP), where legitimacy rests on meeting its statutory requirements.
That split is a real practical problem. Switzerland has 26 cantons, each with its own health and data protection rules. A guide from privatim can tell a public care home what it needs, but it cannot supply the cantonal statute that may not exist yet. A public facility that follows the guide in good faith might conclude that the required legal basis is missing, and so might do nothing, including for safety tools that would help residents. A private home next door, working under federal law, faces a different and probably lighter test. Residents in similar situations end up with different protection depending on who runs the building.
There is a second tension. Regulators are right to reject consent as the sole basis in settings where people cannot freely refuse. But consent from the person or their representative is a signal that the intrusion is acceptable to them. Making it neither required nor sufficient is defensible for dementia wards. It is less obvious for a competent resident who asks for a fall sensor so they can live independently for longer. The guide's own logic, which starts from benefit to the monitored person, should leave room for that resident's choice to carry weight in the proportionality assessment, even if it can't stand alone.
A pro-innovation reading
The technology here is not the enemy. Situational and radar-based systems that send an alert only when a fall happens are more privacy-protective than the camera-and-watch-screen model they replace. They can also let older people stay in their own rooms with less staff intrusion. The guide's ranking rewards exactly these designs, which is the right incentive. Regulators should say plainly that privacy-preserving sensors are the compliant path, so vendors and facilities build toward them and don't freeze procurement out of caution.
Three things would make the guide work better in practice:
- Model cantonal provisions. privatim could publish a template clause so cantons can close the legality gap quickly and consistently.
- A worked risk-analysis template. The guide expects documented risk analyses. A standard form would cut costs for small homes that have no data protection officer.
- Room for resident choice. Guidance should say how a competent resident's stated preference is weighed within proportionality, instead of dismissing consent entirely.
Bottom line
The benefit-to-the-monitored-person test is principled, and preferring event-triggered alerts over live viewing is good engineering as well as good privacy. But guidance can only be as effective as the law beneath it. Until cantons fill their gaps and regulators give small operators usable tools, the guide risks discouraging safety technology at public facilities while leaving private ones to self-assess.