The Fernandes/Ulmen case has sparked a broad discussion in recent weeks about digital violence, identity misuse, and the question of how well our law actually protects those affected.
In the German discussion, one repeatedly hears in this context that Switzerland belongs to the few countries that expressly criminalize the abuse of a foreign identity. This is correct: Since 1 September 2023, Swiss criminal law, under Art. 179decies StGB, has its own offense to protect against identity misuse. However, the practical shortcomings of this provision are less discussed.
As a law firm focusing on personality rights, we often deal with the penal provision referenced in the German discussion, with AI fakes, and with cyberbullying.
Where do the problems lie?
The formulation of the offense. Identity misuse is only punishable if the perpetrator uses the identity of another person to cause them harm or to obtain an unlawful advantage for himself or a third party. This limitation reflects a conscious legislative decision of Parliament. The use of a foreign identity «for its own purpose» is not to be punishable, otherwise the limits of criminal law would be expanded too far, according to the argument in the message accompanying the draft law. And this is precisely where many criminal proceedings fail. In cases of cyberbullying – when the perpetrator can be identified – it is claimed that it was a «joke» or a «provocation». The consequence: behaviours that are massively burdensome for victims – such as fake profiles, orders placed in another’s name or communication under a false identity – are only partially covered by criminal law, although the violation of personality rights is obvious. From a legal perspective, a central practical problem emerges: the criminal assessment and the actual burden on the victims often diverge. For victims it is hardly understandable why a serious intrusion into their identity may, under certain circumstances, not be punishable.
Zivilrecht oft keine Alternative. Theoretisch bleibt der zivilrechtliche Weg über die Persönlichkeitsverletzung nach Art. 28 ZGB. In der Praxis ist dieser Weg jedoch für viele Betroffene keine echte Alternative. Zivilverfahren sind aufwändig, dauern lange und sind mit erheblichen Kostenrisiken verbunden. Gleichzeitig liegt die Beweislast weitgehend bei den Opfern, die oft gar nicht wissen können, wer hinter den Angriffen steckt oder welche konkreten Handlungen nachweisbar sind. Das führt faktisch dazu, dass sich die Risiken der Rechtsdurchsetzung auf die Opfer verlagern, während die Täter von der Anonymität des Internets profitieren. Oder zugespitzt gesagt: Wer Opfer von Identitätsmissbrauch wird, trägt heute nicht selten das grössere Prozessrisiko als der Täter. Das kann nicht der Anspruch eines wirksamen Persönlichkeitsschutzes sein.
Overburdened law enforcement agencies, lack of seriousness. In my experience, law enforcement agencies often find it difficult to investigate identity misuse. The offense is still sometimes underestimated or dismissed as “minor offense”. At the same time, prosecutors are overburdened, which inevitably affects the prioritisation of such proceedings. Moreover, identity misuse remains an abstract danger for many. Those not personally affected can hardly imagine the concrete burden it entails. For victims, identity misuse often means a permanent loss of control over one’s own life. The constant uncertainty. Daily trips to the (digital) mailbox and the question of what new claim, report or reminder awaits this time. Orders that were never placed. Registrations on platforms never visited. Mail from erotic shops. Enforcement orders (!). Collection letters. For many victims life becomes hell, a continuous burden that can last months or years.
Broad penalty range. Perpetrators have little consequence to fear. In criminal law, identity theft is an offense punishable by up to one year imprisonment or a fine. In practice, imprisonment is rarely imposed. The rule is – provided a perpetrator can even be identified – a conditional fine. For many affected persons this prospect is hard to bear. Not only because of the act itself, but also because of the emotional burden that accompanies such proceedings. Particularly burdensome is the shame many victims face. On the one hand due to the act itself. On the other hand due to the investigations, within which they often early on get the impression that their case is not being treated with the necessary seriousness. Its significance appears too low compared to other, supposedly more important proceedings. For many, the realistic assessment is also crushing that perpetrators are identified and convicted in only the fewest cases.
The perpetrators remain anonymous. Every criminal offense is only as good as the investigative successes of the law enforcement authorities. If the perpetrator cannot be identified, the criminal law remains a dead letter. This is precisely where one of the central practical problems lies. Identity theft today occurs predominantly on the Internet, in an environment that provides anonymity to perpetrators. Chats under a false name, sending genuine or manipulated images, orders from online shops, fake profiles on dating platforms or registration on sex portals. In most cases the perpetrator remains invisible to the victims and barely reachable for law enforcement. A major reason for this lies with the big‑tech companies. The large platforms hide in foreign jurisdictions and often do not provide information about their users even to law enforcement authorities. The result: criminal proceedings are suspended until the acts become time‑barred. An additional practical problem arises from the technical assignment of IP addresses. Since large providers often do not even log the source ports necessary for a definitive identification, even with known IP addresses the assignment to a concrete person is often impossible. Only recently a prosecutor informed me in a concrete case that perpetrator identification was not possible for exactly this reason. When it comes to penalties in Switzerland, federalism often stands in the way of consistent enforcement. The establishment of a criminal offense in 2023 was an important step. Practical experience, however, shows that a law alone does not yet protect those affected. What matters are the framework conditions that make actual enforcement of rights possible at all.
What is needed to better protect victims?
- More responsibility for Big Tech. Anyone offering social media services in Switzerland must also be legally tangible and liable here. Platforms have taken over functions of traditional media and should accordingly bear comparable responsibilities. In Switzerland, media companies must name the natural persons responsible for the content. These persons are liable for the content they are responsible for.
- Obligation of social media to provide effective tools for the swift removal of infringing content, so that affected persons do not have to fight digital personality violations for months. The usual, often hard-to-find and complicated online forms currently in use are insufficient for this, as affected persons can submit reports but ultimately have neither a right to an examination nor a binding decision.
- Introduction of a stalking offense to better capture systematic digital harassment. In addition, the provision on identity misuse must be adapted to close current gaps.
The introduction of an offense to protect against identity misuse is an important step. Practice, however, shows: such an offense often protects those affected only inadequately, because the legal framework for enforcement is lacking.
