The Fernandes/Ulmen case has sparked a broad discussion in recent weeks about digital violence, identity misuse, and the question of how well our law actually protects those affected.
In the German discussion, one repeatedly hears in this context that Switzerland belongs to the few countries that expressly criminalize the abuse of a foreign identity. This is correct: Since 1 September 2023, Swiss criminal law, under Art. 179decies StGB, has its own offense to protect against identity misuse. However, the practical shortcomings of this provision are less discussed.
As a law firm focusing on personality rights, we often deal with the penal provision referenced in the German discussion, with AI fakes, and with cyberbullying.
Where do the problems lie?
The wording of the offense. Identity theft is only punishable if the perpetrator uses the identity of another person to harm that person or to obtain an unlawful advantage for himself or a third party. This limitation reflects a conscious legislative decision of the parliament. The use of a foreign identity «zum Selbstzweck» is not to be punishable, because otherwise the limits of criminal law would be expanded too far, according to the argumentation in the message accompanying the draft law. And this is precisely where many criminal proceedings fail. Especially in cases of cyberbullying, it is claimed – if the perpetrator can be identified – that it was a «Scherz» or a «Provokation». The consequence: behaviors that are massively burdensome for victims – such as fake profiles, orders in another’s name or communication under a false identity – are only partially covered by criminal law, even though the violation of personality is obvious. From a legal perspective, a central practical problem emerges: the criminal assessment and the actual burden on victims often diverge. For victims it is hardly understandable why a serious intrusion into their identity should, under certain circumstances, not be punishable.
Civil law often not an alternative. Theoretically, the civil law route über the personality injury according to Art. 28 ZGB. In practice, however, this route is not a genuine alternative for many affected persons. Civil proceedings are costly, take a long time and are associated with significant cost risks. At the same time, the burden of proof largely lies with the victims, who often cannot even know who is behind the attacks or which concrete actions can be proven. This factually leads to the risks of legal enforcement shifting onto the victims, while the perpetrators benefit from the anonymity of the Internet. Or, to put it bluntly: Those who become victims of identity misuse often bear a greater procedural risk than the perpetrator today. This cannot be the claim of an effective personality protection.
ÜOverburdened law enforcement agencies, lack of seriousness. In my experience, Strafverfolgungsbehörden often find it difficult to investigate identity theft. It is still sometimes unterschätzt or dismissed as «Kavaliersdelikt». At the same time, the Staatsanwaltschaften überlastet, which often affects the prioritization of such cases. Furthermore, Identitätsmissbrauch für many remains an abstract danger. Those not personally affected can often hardly imagine the concrete burden associated with it. For victims, Identitätsmissbrauch often means a permanent loss of control über one's own life. The constant uncertainty. Daily the trip to the (digital) mailbox and the question of what new demand, notice or reminder awaits this time. Orders that were never placed. Registrations on platforms never visited. Mail from erotic shops. Legal notices (!), collection letters. For many victims, life becomes a hell, a continuous burden that can last for months or years.
Narrow penalty framework. Offenders have little to fear in terms of consequences. Criminally, identity theft is an offense punishable by up to one year of imprisonment or a fine. In practice, custodial sentences are rarely imposed. The rule is – if a perpetrator can be identified at all – a conditional fine. For many victims this prospect is hard to bear. Not only because of the act itself, but also due to the emotional burden that accompanies such proceedings. Especially burdensome is the shame that many victims face. On the one hand because of the act itself. On the other hand because of the investigations, during which they often early on get the impression that their case is not being treated with the necessary seriousness. Its significance appears too small compared to other, supposedly more important proceedings. For many, the realistic assessment that perpetrators are identified and convicted in only the fewest cases is also crushing.
The Täter remain anonymous. Each criminal provision is only as good as the investigative successes of the Strafverfolgungsbehörden. If the Täter cannot be identified, the criminal law remains a dead letter. Exactly here lies one of the central practical problems. Identity theft today occurs predominantly on the internet, in an environment that provides Tätern anonymity. Chats under a false name, sending genuine or manipulated images, orders from online shops, fake profiles on dating platforms or registration on sex portals. In most Fällen the Täter remains invisible to the victims and barely tangible for law enforcement. A significant reason for this lies with the Big-Tech companies. The large platforms hide in foreign jurisdictions and often do not disclose information über their users even to law enforcement agencies. The consequence: criminal proceedings are suspended until the acts become time‑barred.
No perpetrator assignment despite IP. An additional practical problem arises from the technical assignment of IP addresses. Since large providers often do not even log the source ports necessary for a clear identification, even with known IP addresses the assignment to a specific person remains often impossible in many cases. When it comes to penalties in Switzerland, federalism often stands in the way of consistent enforcement.
What is needed to better protect victims?
- More responsibility for Big Tech. Anyone offering social media services in Switzerland must also be legally tangible and liable here. Platforms have taken over functions of traditional media and should accordingly bear comparable responsibilities. In Switzerland, media companies must name the natural persons responsible for the content. These persons are liable for the content they are responsible for.
- Obligation of social media to provide effective tools for the swift removal of infringing content, so that affected persons do not have to fight digital personality violations for months. The usual, often hard-to-find and complicated online forms currently in use are insufficient for this, as affected persons can submit reports but ultimately have neither a right to an examination nor a binding decision.
- Introduction of a stalking offense to better capture systematic digital harassment. In addition, the provision on identity misuse must be adapted to close current gaps.
The introduction of an offense to protect against identity misuse is an important step. Practice, however, shows: such an offense often protects those affected only inadequately, because the legal framework for enforcement is lacking.
30.03.2026
