I. Introduction

Works of art often come with an incom­plete owner­ship history. Provenance research aims to fill these gaps, which is neces­sary both to ensure the legi­ti­macy of the current posses­sion and to allow the resti­tu­tion of unlaw­fully trans­fer­red works. However, recons­ti­tu­ting the owner­ship history of a work of art means collec­ting and disclo­sing infor­ma­tion about indi­vi­duals — former owners, heirs, dealers. This is, in essence, proces­sing of perso­nal data.

Last March, the 2025 edition of the Art & Law collec­tion was publi­shed, featu­ring a contri­bu­tion by Esther Zysset on the inter­sec­tions of data protec­tion and prove­nance research. Her analy­sis maps out the appli­cable legal frame­work under the Federal Act on Data Protection adop­ted on 25 September 2020 (FADP) and raises seve­ral ques­tions that, in our view, deserve further discussions.

The ques­tion Zysset raises is there­fore straight­for­ward : can prove­nance research be conduc­ted in compliance with data protec­tion laws ?

To answer this ques­tion, Zysset dissects the proces­sing of perso­nal data occur­ring in the case of prove­nance research. As the author explains, the disclo­sure of infor­ma­tion regar­ding the owner­ship of a work of art is one such proces­sing (Art. 5 let. e FADP). This argu­ment raises two ques­tions, which will be deve­lo­ped in the follo­wing sections, before delving into the diffe­rence between public and private controllers.

II. Identification

The first ques­tion is whether the infor­ma­tion proces­sed in prove­nance research consti­tutes perso­nal data at all. In many cases, the iden­tity of previous owners is not expli­citly recor­ded : a prove­nance entry may simply read “private French collec­tion” or “acqui­red in Geneva, circa 1942,” without naming anyone. Such frag­ments may appear insuf­fi­cient to iden­tify an individual.

However, as Zysset points out, iden­ti­fi­ca­tion must be asses­sed through both an objec­tive and a subjec­tive component (BSK DSG-Blechta/Dal Molin/Wesiak-Schmidt, Art. 5 DSG n^os 30–31 ; Zysset, p. 103). The deci­sive ques­tion is not whether the entity conduc­ting the research can iden­tify the person, but whether anyone could do so on the basis of the avai­lable infor­ma­tion (e.g. a family member, a specia­list, another market parti­ci­pant). Where this is the case, the infor­ma­tion quali­fies as perso­nal data, and data protec­tion law applies, regard­less of the researcher’s own inabi­lity to iden­tify the individual.

This is parti­cu­larly rele­vant given the growing number of publi­cly acces­sible prove­nance data­bases. Information that may appear non-iden­ti­fying in isola­tion can become iden­ti­fying when cross-refe­ren­ced with other entries or exter­nal sources (cf. Swiss Federal Office of Culture, List of data­bases of confis­ca­ted works, April 2024). While these data­bases are inten­ded to help rights holders locate works, they also provide infor­ma­tion about those poten­tial rights holders ; there­fore, the FADP and the canto­nal data protec­tion law must apply. We mention that, under Art. 2 par. 4 FADP, public regis­ters dealing with private‑law matters are gover­ned by any special fede­ral law that applies to them ; the FADP only steps in when no such law exists. The regis­ter of cultural‑property assets is an excep­tion because it is crea­ted by Art. 3 of the Cultural Property Transfer Act adop­ted on 20 June 2003 (CPTA), so the CPTA – not the FADP – governs that register.

III. Sensitive Personal Data

A second ques­tion concerns the type of perso­nal data proces­sed in prove­nance research. Zysset argues that, in prac­tice, the propor­tio­nate disclo­sure of perso­nal data in the context of prove­nance research will rarely encom­pass sensi­tive perso­nal data (Zysset, p. 110). We agree that in many cases, prove­nance infor­ma­tion is indeed limi­ted to names, dates, and tran­sac­tions, none of which qualify as sensitive.

However, we would suggest that the like­li­hood of proces­sing sensi­tive perso­nal data is higher than this analy­sis implies, parti­cu­larly in the areas where such research matters most.

Indeed, a signi­fi­cant portion of prove­nance research today concerns works that were confis­ca­ted or forci­bly trans­fer­red during the National Socialist era, or, more broadly, works lost in circum­stances linked to the owner’s reli­gious or ethnic iden­tity. In these cases, the prove­nance record does not merely state that person A sold a pain­ting to person B. It reveals (or at least stron­gly implies) that the former owner was perse­cu­ted based on their reli­gion or ethni­city, which consti­tutes sensi­tive perso­nal data within the meaning of Art. 5 let. c FADP. Furthermore, crimi­nal sanc­tions can be part of the acqui­ring of the work of art (Federal Council, Message regar­ding the 1970 UNESCO Convention and the Federal Act on the International Transfer of Cultural Property [CPTA], FF 2002 505, 511 ff. [version in french] and BBl 2002 535, 540 ff. [version in German]). Indeed, the infor­ma­tion that an art dealer obtai­ned works of art through unlaw­ful appro­pria­tion can be consi­de­red as sensi­tive perso­nal data (Art. 5 let. c n^o 5 FADP ; Art. 137 ff Swiss Criminal Code, RS 311.0. However, Art. 5 let. c n^o 5 FADP only covers data rela­ting to crimi­nal or admi­nis­tra­tive procee­dings or penal­ties. Where no procee­dings were initia­ted and no penalty was impo­sed, the data does not qualify as sensi­tive under this provi­sion. The rele­vance of sensi­tive data protec­tion in the context of prove­nance research is confir­med by the amend­ment to Cultural Property Transfer which permits the Swiss Commission for Historically Problematic Cultural Heritage to disclose sensi­tive data (Art. 18a par. 3 CPTA).

IV. Private Controllers

Zysset raises another central aspect of data protec­tion : Who is the control­ler ? The answer will impact the regime appli­cable to the proces­sing. A private entity, such as a broker, must comply with a restric­tive legal frame­work as they must only process data in a lawful manner (Art. 30 par. 1 FADP). Public enti­ties (or private enti­ties carrying out public tasks, cf. Art. 5 let. i FADP), on the other hand, need a legal basis to process data (Art. 34 ff FADP). Both regimes are rele­vant in the context of prove­nance research, as this acti­vity is carried out by private actors (dealers, auction houses) and public insti­tu­tions (museums, the afore­men­tio­ned Commission) alike. This distinc­tion matters in prac­tice : a data protec­tion solu­tion that is valid for one type of actor may not be trans­po­sable to another. In this regard, we consi­der Zysset’s deci­sion to analyse both regimes in detail parti­cu­larly valuable.

Regarding private enti­ties, the author concludes that the disclo­sure of perso­nal data in connec­tion with prove­nance research carried out by private actors does not, in most cases, infringe upon the data subject’s perso­na­lity rights. Where such an infrin­ge­ment does occur, howe­ver, it is often justi­fied by an over­ri­ding public or private inter­est. Zysset points out that data proces­sing based on an over­ri­ding inter­est, as oppo­sed to consent or an expli­cit legal basis, is gene­rally harder to esta­blish in a context of legal uncer­tainty (p. 116, Art. 31 FADP). However, in April 2025, the Federal Office of Culture publi­shed Recommendations expressly stating that, in its view, prove­nance research on cultu­ral property may, a priori, be presu­med to serve an over­ri­ding public inter­est (Recommendations avai­lable in French and in German). This docu­ment does not consti­tute a legal basis or a judi­cial deci­sion ; howe­ver, it may help private control­lers in their argu­ment to esta­blish an over­ri­ding public inter­est. In our view, howe­ver, this presump­tion merely shifts the problem towards the gene­ral prin­ciples of the FADP (Art. 6 FADP), in parti­cu­lar propor­tio­na­lity and purpose limi­ta­tion. Therefore, the ques­tion of how to deter­mine whether a given act of data proces­sing serves an over­ri­ding public inter­est remains open.

V. Public Controllers

Federal bodies, by contrast, rarely face this ques­tion. Since they must rely on a legal basis for their proces­sing (Art. 34 ff. FADP), the assess­ment of any over­ri­ding public inter­est has, in prin­ciple, already been made by the legis­la­ture itself. Zysset, howe­ver, points to an impor­tant quali­fi­ca­tion : absent such a legal basis, justi­fying proces­sing by an over­ri­ding public inter­est remains narrowly constrai­ned, given that data protec­tion stems from a funda­men­tal right. This constraint is consistent with the prin­ciple of lega­lity because, as Zysset high­lights, data protec­tion enjoys the status of a funda­men­tal right. Therefore, excep­tions allo­wing fede­ral bodies to process perso­nal data without a legal basis are few and narrowly circum­scri­bed. This is all the truer given that, as we have argued, prove­nance research is likely to involve the proces­sing of sensi­tive perso­nal data, which requires a more detai­led legal basis.

VI. Conclusion

Zysset’s article provides a valuable contri­bu­tion to the rela­ti­vely unde­rex­plo­red issue of data protec­tion in the context of prove­nance research. As we have argued, sensi­tive perso­nal data are more likely to arise in this context than her analy­sis suggests, in parti­cu­lar where the history of a work of art is linked to perse­cu­tion or unlaw­ful appro­pria­tion. For private actors, legal uncer­tainty remains despite the Federal Office of Culture’s Recommendations. For fede­ral bodies, the exis­ting statu­tory bases may not cover all situa­tions requi­ring the proces­sing of perso­nal data. Addressing these gaps is essen­tial to ensure that prove­nance research can fulfil its purpose in compliance with data protec­tion law.