Ownership without standing: Swiss Supreme Court limits party rights in criminal MLA proceedings

The Court confirmed the lower court’s application of settled case law: standing in MLA proceedings depends on direct and personal affectedness, which is determined primarily by possession of the relevant data at the time of the measure. In the present case, although the appellant claimed ownership of the data and exclusive remote access, the data was stored on servers operated by the Swiss hosting provider. As a result, it was the hosting provider — as the entity in immediate possession of the data — that was directly affected by the seizure and potential transmission, and thus had exclusive party rights to challenge such measures.

The Court emphasised that extending standing to data owners would risk significantly enlarging the circle of parties and raise complex delineation questions, particularly in cases involving numerous data stakeholders.

It also held that denying standing to the data owner did not create a gap in legal protection as the server provider remained entitled to challenge the MLA measure. It noted that, in the present case, the appellant had already been involved in earlier procedural steps (including access to the file and participation in the data triage), even though it ultimately lacked formal party status.

Contrast to sealing law and practical implications

The Court’s restrictive approach highlights an unresolved tension between standing under MLA proceedings and sealing law. In domestic criminal proceedings, under the revised provisions of the Criminal Procedure Code (“CrimPC” – Art. 248 and 248a), the right to request sealing is not limited to the physical holder but also extends to the “proprietor”. This reflects the recognition that possession alone is not a sufficient proxy for legally protected secrecy interests, particularly in modern data environments where storage and control are often decoupled. In MLA proceedings, however, standing remains more restrictive. Although Art. 9 IMAC refers to the provision of the CrimPC on searching and sealing of records (Art. 246-248 CrimPC), legal scholarship and case law remain divided as to whether the rules on domestic sealing law apply in the MLA context.

The Court’s decision did not directly address or resolve this debate, but its reasoning suggests that it is leaning towards a restrictive MLA approach – i.e., in holding that the appellant could not rely on the revised CrimPC provisions on the search of records as an argument, because the relevant provisions of IMAC and its implementing ordinance had not been amended to loosen the requirements. This suggests that data owners should not assume that the domestic sealing law regime will automatically apply and translate into standing in MLA proceedings.

As the present case illustrates, this can result in situations where the only party entitled to challenge an MLA measure (the hosting provider) has no economic or reputational stake in doing so, while the party most affected (the data owner) lacks standing. This may leave data owners entirely dependent on the hosting provider to protect their interests.

This discrepancy becomes particularly acute where MLA proceedings and domestic sealing proceedings relating to the same data run in parallel, yet the set of entitled parties does not align.

Conclusion

This decision confirms the Federal Supreme Court’s consistent prioritisation, in MLA proceedings, of procedural efficiency and clarity, even where this comes at the expense of a broader conception of effective legal protection.

Against this background, three key takeaways emerge:

• Unresolved tension between standing in MLA proceedings and sealing rights: while domestic sealing law protects persons with legally protected interests regardless of physical possession, the Federal Supreme Court confirms that such broader standing cannot be assumed to apply in MLA proceedings.
• Structural limitation of data owners’ procedural rights in MLA proceedings: companies relying on third‑party hosting infrastructures must recognise that, under Swiss MLA law, ownership and/or access to data does not translate into procedural control. Unless they qualify as the direct possessor, they risk being excluded from MLA proceedings entirely.
• Need for anticipatory risk management in data structuring and contracts: this decision underscores the importance of proactively addressing MLA exposure in data governance frameworks. In particular, data owners should consider:
  • contractual arrangements with hosting providers regarding co-operation and legal challenges to foreign requests;
  • governance mechanisms ensuring alignment of interests in the event of MLA proceedings; and
  • structuring options (where feasible) that preserve a sufficient degree of legal control.

Without such precautions, the use of external hosting solutions may result, in practice, in a loss of procedural control over one’s own data in cross-border criminal investigations.