A Debt Collector's Public Pillory, Ended
Switzerland's Federal Administrative Court has confirmed that a debt-collection agency cannot publish the names, photos, and identifying details of alleged debtors online to pressure them into paying up. In a ruling dated June 22, 2026 and publicized by the Federal Data Protection and Information Commissioner (FDPIC/EDÖB) on August 20, 2026, the court dismissed Inkasso-Team AG's appeal and upheld the regulator's order against the company's website, Schuldner-finden.com ("find-a-debtor"), which crowdsourced tips from the public to locate people who allegedly owed money and warn others about them (FDPIC, "Bundesverwaltungsgericht bestätigt Entscheid des EDÖB").
The court's language was unambiguous: publishing personal data "for purposes of locating alleged debtors and warning third parties" is a violation of personality rights that cannot be justified. Inkasso-Team must pay CHF 5,000 in procedural costs and, per the FDPIC's original order, was required to stop the publication and delete already-published data within 30 days (FDPIC). The site is now offline.
The Regulatory Timeline
The FDPIC first opened an investigation into Inkasso-Team under Article 49 of the revised Federal Act on Data Protection (nFADP/DSG), which took effect September 1, 2023, and issued its enforcement order on April 28, 2025, directing the company to cease publishing debtors' personal data and delete what it had already posted (FDPIC, "Verfügung des EDÖB gegen die Inkasso-Team AG"). Inkasso-Team appealed to the Federal Administrative Court in St. Gallen, and it took roughly fourteen months for that appeal to be fully resolved — a reminder that even a comparatively lean enforcement regime like Switzerland's still runs on a court timeline measured in over a year, not weeks.
The legal basis is straightforward under the nFADP: Article 6 sets baseline principles of proportionality and good faith in processing personal data; Article 19 requires transparency about how and why data is collected; and Article 31 lists the narrow grounds — consent, overriding private or public interest, or statutory authorization — on which an otherwise unlawful disclosure can be justified (Federal Act on Data Protection, SR 235.1). The FDPIC found none of those applied: Inkasso-Team had neither the debtors' consent nor an interest compelling enough to override their personality rights, particularly since the publications targeted people merely alleged to owe money, with no judicial finding against them.
The Case for the Registry
Before dismissing the model, it's worth taking seriously why a debt-collection agency would build one. Locating debtors who have moved, changed numbers, or otherwise gone dark is a genuine, mundane operational problem — Inkasso-Team's own marketing still centers on debtor-tracing services. Public creditors, landlords, and small businesses lose real money to debtors who successfully evade collection, and crowdsourced tips can be faster and cheaper than formal tracing channels or court-ordered disclosure. There's also a coherent, narrower version of the underlying idea that Swiss law explicitly allows: Article 31(2)(c) nFADP permits processing personal data to assess creditworthiness, which is exactly what licensed credit-reporting bureaus do every day without running afoul of the FADP. The line the court drew isn't that debtor data can never be shared — it's that publishing identifying details to the entire internet, for the purpose of public pressure rather than a bounded credit assessment, fails the proportionality test.
Why the Court Got the Balance Right
That is the correct line, and this publication has generally argued that data protection regimes risk over-reach when they treat any commercial use of personal data as presumptively suspect. This case is not that. A privately-run public registry of "alleged" debtors — a status that, unlike a court judgment, requires no due process to attach — creates exactly the kind of unaccountable, hard-to-correct reputational harm that personality-rights law exists to prevent. Someone wrongly listed, or a debtor who has since paid, has no clean mechanism to force removal from a database run by the party that benefits financially from their public shaming. That's a fundamentally different power asymmetry than, say, a company using data to personalize ads or a credit bureau operating under statutory disclosure and dispute-resolution obligations.
The FDPIC's own enforcement pattern this year reinforces that the concern is specifically about public shaming as a collection tactic, not debtor-tracing generally: on June 25, 2026, the agency separately warned the operator of another website for making debtors' documents, photos, and ID copies publicly accessible, closing that case with a formal warning after the operator voluntarily deleted the data mid-investigation (FDPIC mitteilungen; Steiger Legal analysis). Two independent cases within two months suggest debtor-shaming sites were becoming a recognizable business model in the Swiss collections industry — one the regulator has now closed off with appellate-court backing rather than a single first-instance order.
The Broader Signal
For Swiss businesses handling any personal data tied to financial disputes, the ruling is a clean compliance marker: crowdsourced public exposure is not a permissible substitute for licensed credit-reporting or judicial debt enforcement, however useful it might be operationally. For regulators elsewhere weighing how to handle "shame as enforcement" business models — whether debtor registries, deadbeat-parent websites, or informal blacklists — the FDPIC's approach offers a template: target the specific harm (unaccountable public exposure of unproven claims) rather than banning debt-related data processing outright. That's the proportionate regulation this publication wants to see more of — narrow enough to leave legitimate credit-assessment and tracing tools intact, firm enough that a company can't outsource due process to a comment-tip form.