Creation of voiceprints requires explicit consent of affected individuals

Since September 2018, PostFinance Ltd has been creating voiceprints of customers who call in, to authenticate them during future calls. If customers do not consent to the creation of their voiceprint, they must take appropriate action on their own initiative. They can prevent their voiceprint from being stored by sending a separate message to the competent customer service representative or by changing the default setting on the PostFinance website. In May 2019, the Federal Data Protection and Information Commissioner (FDPIC) contacted PostFinance Ltd regarding this matter. The contact was followed by several exchanges of correspondence and a meeting.

Express consent required
Since no agreement was reached, the FDPIC ruled on 16 May 2025 that PostFinance Ltd must obtain the explicit consent of the affected individuals for data protection reasons and delete any voiceprints for which consent had not been obtained. On 18 June 2025, PostFinance Ltd filed an appeal against this decision with the Federal Administrative Court (FAC). In March 2026, it informed the FAC that it had been using a new solution to obtain explicit consent for the creation of voiceprints since mid-February 2026.

Retroactive consent by mid-February 2027
The FAC finds that the processing of a voiceprint – which constitutes personal data under special protection – requires the express consent of the affected individual to ensure compliance with data protection regulations. If the affected individual simply continues speaking after being informed that the conversation is being recorded and a voiceprint is being created, he or she does not give express consent. Creating a voiceprint without such consent constitutes an infringement of personal rights. There is no justifiable cause for the practice.

In accordance with the principle of proportionality, the FAC grants PostFinance Ltd time until mid-February 2027 to obtain the express consent of the affected customers for the voiceprints that have already been created. Where PostFinance does not obtain consent, the data must be deleted immediately. It was not within the FAC’s purview to determine whether the new solution introduced by PostFinance Ltd in mid-February 2026 complies with data protection regulations. The Court therefore partially upholds the appeal.

This judgment may be appealed to the Federal Supreme Court.