Liechtenstein Jurisdiction: Prospective Filing System Inclusion

The factor of Prospective Filing System Inclusion is explicitly addressed in Liechtenstein's Data Protection Act (DSG). This factor ensures that the DSG applies to the processing of personal data, even when the processing is done manually, if the data is intended to be part of a filing system.

Text of Relevant Provisions

DCG Art.2(1):

"1) This Act shall apply to the processing of personal data by public bodies. For non-public bodies, this Act shall apply to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system with the exception of processing personal data by a natural person in the course of a purely personal or domestic activity."

Original (German):

"1) Dieses Gesetz gilt für die Verarbeitung personenbezogener Daten durch öffentliche Stellen. Für nichtöffentliche Stellen gilt dieses Gesetz für die ganz oder teilweise automatisierte Verarbeitung personenbezogener Daten und für die nicht automatisierte Verarbeitung personenbezogener Daten, die Teil eines Dateisystems sind oder werden sollen, mit Ausnahme der Verarbeitung personenbezogener Daten durch eine natürliche Person im Rahmen einer ausschließlich persönlichen oder familiären Tätigkeit."

Analysis of Provisions

• DCG Art.2(1) clearly states that the DSG applies not only to automated data processing but also to manual processing if the personal data "form part of a filing system or are intended to form part of a filing system." This inclusion ensures that data processing activities are regulated under the DSG from the moment there is an intention to organize or structure the data into a filing system.
• The phrase "intended to form part of a filing system" plays a crucial role in closing potential loopholes where data could be processed outside the scope of the law by delaying its inclusion in a structured filing system. By covering data intended for filing systems, the DSG ensures that data protection obligations apply as soon as there is a clear plan or intention to structure the data.
• The rationale for including this factor is to maintain robust data protection standards by ensuring that all data processing activities, regardless of the method or timing of organization, are subject to the DSG if there is an intention to structure the data.

Implications

• For businesses operating in Liechtenstein, this means that they must consider the applicability of the DSG to all data processing activities, including those that are manual, if there is an intention to eventually organize the data into a filing system. This ensures that data protection compliance must be considered from the outset of data collection and processing, not just once the data is fully structured.
• This factor is particularly relevant for businesses that may initially handle unstructured data with the plan to organize it later. They must ensure compliance with the DSG from the start, as the intention to include the data in a filing system triggers the law's applicability.
• An example would be a financial firm that collects client data manually with the intention of later digitizing and organizing it into a comprehensive client database. Even before the data is fully digitized and structured, the firm must comply with DSG requirements.