Liechtenstein

Liechtenstein did not adopt a first-generation data protection legislation.

Liechtenstein adopted data Data Protection Act 2002 (and the associated Data Protection Ordinance 2002).

 

The Liechtenstein law set out very limited explicit derogations in favour of journalism, particularly the periodically published media. As regards the reactive transparency (subject access), the law set out allowed for a refusal, restriction or deferral of information provisions if the ‘personal data provides information as to its source’, ‘access to drafts of publications would have to be granted’, ‘the public’s freedom to form an opinion would be compromise’ or if the file ‘is being used exclusively as a personal work aid’ by an individual journalist as opposed to a wider group within a media organization (Data Protection Act 2002, art. 13).No specific exemptions at all were set out for other forms of special expression such as literature and art.However, the law did set out an overarching disproportionate effort limitation on the proactive transparency rules which, in contrast to Directive 95/46, was in principle applicable even where information was directly collected from data subjects (Ibid, art. 5(4)).The Data Protection Ordinance set out an exemption from the requirement to notify the DPA of processing where “files are used exclusively for publication in the editorially-controlled section of a periodically-published media organ and their data is not disclosed to third parties without the knowledge of the data subjects” or “such files are being used by journalists exclusively as a personal work aid” (Data Protection Ordinance 2002, art. 4).The Ordinance also explicitly stated that if data was made available to the general public on the territory of the EEA “by way of automated information and communication services with the purpose of informing the public, this shall not be considered to a cross-border data flow” (Ibid, art. 5).

 

No specific provisions were adopted (although see above as regards the gloss on the meaning of cross-border data flow in the Data Protection Ordinance).

 

The law provided for an exemption for data that was processed by a natural person exclusively for personal data but with the explicit requirement that no data was disclosed to a third party (Ibid, art. 2(3)(a)).

 

No exemption was provided from the transparency rules (although as noted above the disproportionate effort limitation was generally extended also to direct collection from the data subject), the sensitive data regime or the requirement to notify processing with the DPA.The private sector was not absolved from having to comply with any of data quality principles. Public authorities, in contrast, were exempted from the compatibility principle and the requirement of an ordinary legal basis for processing where personal data was processed for ‘the purposes of research, planning, and statistics’, provided that (i) such data were anonymized as soon as the objective of data processing allowed it; (ii) the recipient only passed on the data to a third party with the consent of the controller; and (iii) the results of the data processing were published in a form that did not allow the identification of the data subject (Data Protection Act 2002, art. 26(1)).No general exemption was set out from the legitimating ground condition. However, art. 17(2)(e) of the Act provided that ordinary personal data could be processed for ‘non-personal purposes, and in particular in the context of research, planning or statistics, and publishes the results in such a manner that the identity or the data subjects cannot be established’. No exemption from provided from general criteria restricting the transfer of personal data outside the EEA (Ibid, art. 8).However, whilst DPA authorisation was generally required unless the legislation offering adequate protection remained applicable, the Ordinance lifted this requirement ‘for the transmission of files for purposes not relating to the data subjects, in particular for the purposes of research, planning, and statistics, provided that the form in which the results are published do not allow the identification of the data subject’ (Data Protection Ordinance 2002, art. 8(1)).

Liechtenstein adopted Data Protection Act and Data Protection Ordinance.

 

Liechtenstein only sets out a journalistic derogation in relation to subject access. This enables ‘media professionals’ to limit or refuse access when the data is ‘used exclusively as a personal working tool’ or as regards the ‘editorial part of a periodical medium’. Also where the data would provide information as to its source, access to drafts of publication would have to be granted to avoid compromising the public’s freedom to form an opinion. This results in a permissive public interest derogation from this one provision. Otherwise, the default GDPR is set out to apply in full. Importantly, only ‘media professionals’ benefit from this statutory special expression derogation (Data Protection Act, art. 25).  Highly unusually in a third-generation instrument, the Liechtenstein special expression derogation is less permissive than the Knowledge Facilitation Framework.

 

No specific provisions were adopted.

 

Personal Exemption – see GDPR, art. 2(2)(c)
Article 28 permits the processing of personal data without consent where required for personal, family or genealogical research and the maintenance and publication of family chronicles and biographies including sensitive data specified in Article 9 GDPR so long as the interests of the controller outweigh those of the data subject are and the controller takes appropriate and specific measures to safeguard these latter interests.  Reference is given to an indicative listing of such measures in article 21(2).

 

Liechtenstein sets out derogations from the sensitive personal data rules and subject access, and various data subject rights for both scientific or historical research and for statistical purposes (art. 27) and for archival purposes in the public interest (art. 29). Therefore, uniquely amongst those States that have legislated in both areas, Liechtenstein appears to treat special expression such as journalism less favourably than ordinary knowledge facilitation purposes such as scientific research.  The sensitive data derogation is subject to the requirement that the interests of controllers outweigh that of the data subject, that the processing is necessary and if (i) the data are publicly accessible, (ii) the data are pseudonmymised and the controller cannot lawfully identify any data subject or (iii) getting consent is impossible or involves disproportionate effort due to a lack of reachability (art. 27(1)-(2); art. 29(1)-(2))).  The access and subject control rights derogations generally  depends on these rights rendering impossible or at least seriously impairing the purposes and such limits being necessary (art. 27(4); art. 29(6).  In the case of subject access it is further stated that exemption can apply if compliance would be a disproportionate effort (art. 27(4); art. 29(4))  Special provisions apply to archiving and the right to rectification which is entirely excluded but subject to the requirement that the data subject has a right to add their version to files if they dispute the accuracy of personal data (art. 29(5).  In the research and statistics area, an overarching requirement stipulates that data must be (pseudo)anonymised as soon as the research purposes allow unless this conflicts with the legitimate interests of the subject, that attribution information is stored separately and only combined to the extent required by the purpose and that publication of personal data only take place with consent or if indispensable for the presentation of research findings (art. 27(5)-(6)).  This largely mirrors the requirements set down in article 89(1) GDPR itself.