Lugano, April 30, 2026

Author: Lawyer Enrico Germano

On March 21, 2025, the Swiss Parliament approved the Passenger Name Records Act in a final vote. Given that the referendum deadline expired unused, the law and the related ordinance are expected to enter into force at the end of 2026.

The new Passenger Name Records Act (PNRA) in Switzerland requires airlines to transmit Passenger Name Records (PNRs) data to the authorities to fight terrorism and crime. Names, contact details, itineraries, and payments will be collected, excluding sensitive data. Management is entrusted to the new Passenger Information Unit (PNR) of the Federal Office of Police (fedpol).

In recent years, the fight against terrorism and organized crime has led states to strengthen their control and surveillance tools. In Switzerland, too, the introduction of measures requiring airlines to transmit passenger data to the authorities raises a central question in contemporary law: to what extent is it legitimate to restrict citizens’ privacy to ensure public safety?

The aim of the new law is to identify dangerous or wanted passengers before they enter or leave the country. The transmitted data (PNRs) will include booking information such as name, surname, itinerary, payment method, and travel agency. Sensitive data such as racial or ethnic origin, political opinions, religion, or health will be excluded.

Although essential for security, the measure entails mass surveillance of all passengers, raising debates about privacy protections, despite its compliance with Swiss data protection regulations.

On the one hand, invoking security concerns, the state has a fundamental duty to protect the community. Collecting passenger data (such as identities, itineraries, and contact information) allows authorities to prevent terrorist attacks, identify international criminal networks, and intervene quickly and effectively.

In a globalized world, where threats easily cross borders, preventive surveillance tools can be indispensable.

On the other hand, these measures pose serious challenges to the protection of fundamental rights. The protection of personal data is guaranteed in Switzerland at the constitutional level and is a cornerstone of the rule of law. Unfortunately, however, serious risks remain, such as excessive data collection (even from non-suspect individuals), misuse or abuse of information, and widespread surveillance, which can restrict individual freedom. The danger is that of sliding toward a society in which every citizen is constantly monitored.

Article 13 of the Federal Constitution of the Swiss Confederation guarantees the fundamental right to the protection of personal data and privacy, protecting against the misuse of data:

Article 13 Right to Privacy:

1 Every person has the right to privacy in their private and family life and in their home, and in relation to their mail and telecommunications.
2 Every person has the right to be protected against the misuse of their personal data.

This constitutional basis is implemented by the new Federal Act on Data Protection (nFADP), in force since September 1, 2023, which regulates the processing of personal data. Correspondingly, the new Ordinance on Data Protection (DPO) and the new Ordinance on Data Protection Certification (DPCO) also entered into force on September 1, 2023.

The balance between public safety and the protection of personal data represents one of the most complex challenges of modern law, including in Switzerland. Surveillance measures can only be justified if they strictly comply with the principles of the rule of law, particularly the principle of proportionality.

Ultimately, a truly secure society is not one that controls everything, but one that manages to protect citizens without compromising their fundamental freedoms.

To resolve this conflict, Swiss law is based on the principle of proportionality: every measure must be necessary, appropriate, and limited to what is strictly necessary. This means that security cannot justify any form of control, but only those that are truly useful and respect individual rights.

In conclusion, the transmission of passenger data can be an effective tool for ensuring security, but it must be accompanied by rigorous legal guarantees. Only by maintaining a balance between control and freedom can we protect both the community and the rights of individual citizens.