Facts

On 22 April 2015, a Belgian journalist filed a criminal complaint in Switzerland against an unknown person for statements made on a Facebook account under the pseudonym “D.” The Central Public Prosecutor’s Office of the canton of Vaud opened an investigation for slander, defamation and insult (art. 173, 174 and 177 SCC).

On 29 June 2015, the Public Prosecutor’s Office sent to Facebook Switzerland Sàrl (hereinafter: Facebook Switzerland) an order for the production of evidence requiring:

  • The identity of the account holder;
  • The IP addresses used to create the profile;
  • The connection logs and associated IP addresses;
  • The private content of the account.

This order was accompanied by a threat of penalty under art. 292 SCC (disobedience to authority). Facebook Switzerland responded that the platform was managed by Facebook Ireland Ltd and that the order should be addressed through the channel of international mutual legal assistance. On 11 November 2015, the Public Prosecutor’s Office reiterated its request by means of an order for the production of evidence, addressed to Facebook Switzerland as well as to its managing partners [A.] and B. The recipients filed an appeal with the Criminal Appeals Chamber of the Vaud Cantonal Court, which dismissed their appeals in March 2016.

Facebook Switzerland, [A.] and B. filed three separate appeals with the Federal Supreme Court, seeking the annulment of the Public Prosecutor’s order and an award of costs. The Federal Supreme Court allowed the appeals.

Considerations

The Federal Supreme Court examined whether the order for the production of evidence addressed to Facebook Switzerland was valid under the provisions of the Swiss Criminal Procedure Code (CrimPC) and the Budapest Convention on Cybercrime (CCC). It first recalled that art. 265 CrimPC allows the investigating authority to obtain objects or values held by their holders without resorting to coercive measures. However, this article does not apply to Internet service providers, such as social networks, which do not themselves provide Internet access within the meaning of the Act on the Monitoring of Postal and Telecommunications Traffic (SPTA). Arts. 269 et seq. CrimPC, relating to the monitoring of correspondence, also do not cover such services, in the absence of legislative amendment.

The Federal Supreme Court then analysed the Budapest Convention, which broadens the notion of “service provider” to any entity offering communication services or processing computer data. However, this convention is based on the principle of territoriality: a State may not take investigative measures on the territory of another State without recourse to international mutual legal assistance. Thus, even though Facebook Switzerland is present in Switzerland, it does not hold the requested data, which are controlled by Facebook Ireland Ltd. The production order cannot therefore be addressed to Facebook Switzerland but must be transmitted through the channel of international mutual legal assistance to the Irish authorities.

The Federal Supreme Court also rejected the argument that Facebook Switzerland carried out concrete activities in Switzerland justifying its submission to criminal injunctions. No evidence shows…