skip to content
 

Data Protection Laws and Freedom of Expression: LiechtensteinFlag of Liechtenstein

 

 

I. First-Generation Statutory Law

Liechtenstein did not adopt a first-generation data protection legislation.
 

II. Second Generation Statutory Law

Liechtenstein adopted data Data Protection Act 2002 (and the associated Data Protection Ordinance 2002).
 
Special Expression Derogation
The Liechtenstein law set out very limited explicit derogations in favour of journalism, particularly the periodically published media. As regards the reactive transparency (subject access), the law set out allowed for a refusal, restriction or deferral of information provisions if the ‘personal data provides information as to its source’, ‘access to drafts of publications would have to be granted’, ‘the public’s freedom to form an opinion would be compromise’ or if the file ‘is being used exclusively as a personal work aid’ by an individual journalist as opposed to a wider group within a media organization (Data Protection Act 2002, art. 13).No specific exemptions at all were set out for other forms of special expression such as literature and art.However, the law did set out an overarching disproportionate effort limitation on the proactive transparency rules which, in contrast to Directive 95/46, was in principle applicable even where information was directly collected from data subjects (Ibid, art. 5(4)).The Data Protection Ordinance set out an exemption from the requirement to notify the DPA of processing where “files are used exclusively for publication in the editorially-controlled section of a periodically-published media organ and their data is not disclosed to third parties without the knowledge of the data subjects” or “such files are being used by journalists exclusively as a personal work aid” (Data Protection Ordinance 2002, art. 4).The Ordinance also explicitly stated that if data was made available to the general public on the territory of the EEA “by way of automated information and communication services with the purpose of informing the public, this shall not be considered to a cross-border data flow” (Ibid, art. 5).
 
Broad Expression Derogation
No specific provisions were adopted (although see above as regards the gloss on the meaning of cross-border data flow in the Data Protection Ordinance).
 
Personal Exemption
The law provided for an exemption for data that was processed by a natural person exclusively for personal data but with the explicit requirement that no data was disclosed to a third party (Ibid, art. 2(3)(a)).
 
Knowledge Facilitation Framework
No exemption was provided from the transparency rules (although as noted above the disproportionate effort limitation was generally extended also to direct collection from the data subject), the sensitive data regime or the requirement to notify processing with the DPA.The private sector was not absolved from having to comply with any of data quality principles. Public authorities, in contrast, were exempted from the compatibility principle and the requirement of an ordinary legal basis for processing where personal data was processed for ‘the purposes of research, planning, and statistics’, provided that (i) such data were anonymized as soon as the objective of data processing allowed it; (ii) the recipient only passed on the data to a third party with the consent of the controller; and (iii) the results of the data processing were published in a form that did not allow the identification of the data subject (Data Protection Act 2002, art. 26(1)).No general exemption was set out from the legitimating ground condition. However, art. 17(2)(e) of the Act provided that ordinary personal data could be processed for ‘non-personal purposes, and in particular in the context of research, planning or statistics, and publishes the results in such a manner that the identity or the data subjects cannot be established’. No exemption from provided from general criteria restricting the transfer of personal data outside the EEA (Ibid, art. 8).However, whilst DPA authorisation was generally required unless the legislation offering adequate protection remained applicable, the Ordinance lifted this requirement ‘for the transmission of files for purposes not relating to the data subjects, in particular for the purposes of research, planning, and statistics, provided that the form in which the results are published do not allow the identification of the data subject’ (Data Protection Ordinance 2002, art. 8(1)).
Parliamentary Debates
Special Expression Derogation
MP Paul Vogt questioned the privileged treatment of periodical media, noting he could not see the difference between periodical media and (other) types of scientific publications.[1] MP Alois Beck expressed concern regarding the distinction made in the treatment of periodical and non-periodical media.[2] This question was seconded by the Deputy Head of Government [Stellvertretende Regierungschefin] Rita Kieber-Beck. However, no substantive debate followed after their respective statements.[3]
 
Broad Expression Derogation
No relevant parliamentary debates recorded.
 
Personal Exemption
No relevant parliamentary debates recorded.
 
Knowledge Facilitation Framework
MP Paul Vogt noted that there was a conflict of interest between an individual’s right to data protection and the public’s right to access information which were not sufficiently addressed by the draft data protection law. To illustrate this conflict, he gave a concrete example from practice. Data relating to a person has been prosecuted for spying against Liechtenstein or individuals in Liechtenstein during the Second World War would clearly be highly sensitive. However, there was also a legitimate public interest in such cases and the prosecuted person’s name and data should be allowed to be made public in a scientific publication. MP Vogt was of the opinion that this would not be possible under the proposed data protection law. Pursuant to him, public interests would outweigh any private data protection interests in such a case. MP Vogt accordingly observed that the provisions on scientific research lacked precision. These provisions were copied from the Swiss Data Protection Act but did not adequately address the appropriate balance between data protection and public interest.[4] Another example in this regard, he continued, are the ‘family books’ [Familienbücher] published by villages. The pedigrees contained therein contained much personal information. This would be highly problematic from a data protection perspective.
MP Dorothee Laternser agreed with MP Paul Vogt and noted that while some provisions in this regard were copied from the Swiss Data Protection Act, others—like the provision on medical research—were not adopted. She accordingly recommended that this omission should be corrected before the second reading. However, no debate followed in the second reading.
 
MP Paul Vogt reiterated his concerns regarding the lack of a clear regulation of scientific research in the parliamentary debates leading up to the adoption of the 2008 Amendment of the Data Protection Act.[5] No mention thereof was made in the second reading.
MP Paul Vogt moreover raised the issue of historical research. According to the Law on Archives, a general protection period of 30 years and a protection period of 80 years for sensitive personal data applies to the processing of personal data for historical research. This would render historical research impossible. The President of the Parliament, Klaus Wanger, took note of this argument. However, no further debate thereon took place.[6] MP Vogt returned to the issue of historic research, noting in particular that there was considerable insecurity with regard to the permissibility of publishing names.[7]
 

III. Third-Generation Statutory Law

 
Special Expression Derogation
Liechtenstein only sets out a journalistic derogation in relation to subject access. This enables ‘media professionals’ to limit or refuse access when the data is ‘used exclusively as a personal working tool’ or as regards the ‘editorial part of a periodical medium’. Also where the data would provide information as to its source, access to drafts of publication would have to be granted to avoid compromising the public’s freedom to form an opinion. This results in a permissive public interest derogation from this one provision. Otherwise, the default GDPR is set out to apply in full. Importantly, only ‘media professionals’ benefit from this statutory special expression derogation (Data Protection Act, art. 25).  Highly unusually in a third-generation instrument, the Liechtenstein special expression derogation is less permissive than the Knowledge Facilitation Framework.
 
Broad Expression Derogation
No specific provisions were adopted.
 
Personal Exemption – see GDPR, art. 2(2)(c)
Article 28 permits the processing of personal data without consent where required for personal, family or genealogical research and the maintenance and publication of family chronicles and biographies including sensitive data specified in Article 9 GDPR so long as the interests of the controller outweigh those of the data subject are and the controller takes appropriate and specific measures to safeguard these latter interests.  Reference is given to an indicative listing of such measures in article 21(2).
 
Knowledge Facilitation Framework – see also GPDR, art. 5(1)(b) (compatibility), art. 5(1)(e) (time limits) and art. 89(1) (appropriate safeguards)
Liechtenstein sets out derogations from the sensitive personal data rules and subject access, and various data subject rights for both scientific or historical research and for statistical purposes (art. 27) and for archival purposes in the public interest (art. 29). Therefore, uniquely amongst those States that have legislated in both areas, Liechtenstein appears to treat special expression such as journalism less favourably than ordinary knowledge facilitation purposes such as scientific research.  The sensitive data derogation is subject to the requirement that the interests of controllers outweigh that of the data subject, that the processing is necessary and if (i) the data are publicly accessible, (ii) the data are pseudonmymised and the controller cannot lawfully identify any data subject or (iii) getting consent is impossible or involves disproportionate effort due to a lack of reachability (art. 27(1)-(2); art. 29(1)-(2))).  The access and subject control rights derogations generally  depends on these rights rendering impossible or at least seriously impairing the purposes and such limits being necessary (art. 27(4); art. 29(6).  In the case of subject access it is further stated that exemption can apply if compliance would be a disproportionate effort (art. 27(4); art. 29(4))  Special provisions apply to archiving and the right to rectification which is entirely excluded but subject to the requirement that the data subject has a right to add their version to files if they dispute the accuracy of personal data (art. 29(5).  In the research and statistics area, an overarching requirement stipulates that data must be (pseudo)anonymised as soon as the research purposes allow unless this conflicts with the legitimate interests of the subject, that attribution information is stored separately and only combined to the extent required by the purpose and that publication of personal data only take place with consent or if indispensable for the presentation of research findings (art. 27(5)-(6)).  This largely mirrors the requirements set down in article 89(1) GDPR itself.
Parliamentary Debates
Special Expression Derogation
No parliamentary debates recorded. However, in the first reading, Patrick Risch MP asked whether the derogation provided for periodic media would also apply to online news websites.[8] This question was not answered.
 
Broad Expression Derogation
Not applicable.
 
Knowledge Facilitation Framework
No parliamentary debates were recorded. However, Thomas Rehak MP asked whether there were any exemptions to the requirement to conduct an assessment of the consequences of the processing of personal data, including for research and statistical purposes. This question was not answered either.[9]
 

[1] MP Paul Vogt, ‘Datenschutzgesetz (DSG) [Umsetzung der Richtlinie 95/64/EG des Europäischen Parlaments und des Rates vom 24.10.1995 zum Schutz der Natürlichen Personen bei der Verarbeitung Personenbezogener Daten und zum freien Datenverkehr] (Nr. 33/2001), 1. Lesung’ (28 June 2001) https://www.landtag.li/protokolle/default.aspx?lpid=84&id=1261&typ=eintr... (last accessed 11 February 2021).
[2] Ibid.
[3] Ibid.
[4] Ibid.
[5] MP Paul Vogt, ‘Abänderung des Datenschutzgesetzes vom 14. März 2008 (DSG), Nr. 70/2008; 1. Lesung’ (27 June 2008) https://www.landtag.li/protokolle/default.aspx?lpid=247&id=3148&typ=eint... (last accessed 11 February 2021).
[6]MP Paul Vogt, ‘Datenschutzgesetz (DSG) [Umsetzung der Richtlinie 95/64/EG des Europäischen Parlaments und des Rates vom 24.10.1995 zum Schutz der Natürlichen Personen bei der Verarbeitung Personenbezogener Daten und zum freien Datenverkehr] (Nr. 33/2001), 1. Lesung’ (28 June 2001) https://www.landtag.li/protokolle/default.aspx?lpid=84&id=1261&typ=eintr... (last accessed 11 April 2021).
[7] MP Paul Vogt, ‘Abänderung des Datenschutzgesetzes vom 14. März 2008 (DSG), Nr. 70/2008; 1. Lesung’ (27 June 2008) https://www.landtag.li/protokolle/default.aspx?lpid=247&id=3148&typ=eint... (last accessed 11 February 2021).
[8] ‘Totalrevision des Datenschutzgesetzes sowie die Abänderung weiterer Gesetze (Nr. 36/2018); 1. Lesung’ (8 June 2018) https://www.landtag.li/protokolle/default.aspx?lpid=649&backurl=mode%3dl... (last accessed 3 August 2020).
[9] Ibid.