Judgment A-5373/2020 of the Bundesverwaltungsgericht of 13 October 2021 draws a line that has held for five years: ProtonMail is a provider of derived communication services under Art. 2(c) BÜPF (SR 780.1), not a telecommunications service provider under Art. 2(b) BÜPF. The proportionality test determines which surveillance obligations providers of this type must bear. The EJPD’s revision of the VÜPF (SR 780.11) failed in public consultation on 6 May 2025 and has since been rewritten under this proportionality argument. Contractual clauses that presuppose suspicionless retention obligations for providers of derived communication services are subject to the proportionality constraint anchored in Art. 5(2) of the Federal Constitution (SR 101).

The Federal Supreme Court (Bundesgericht) had already drawn that line in April 2021, in the Threema judgment 2C_544/2020: a provider that neither grants direct nor indirect internet access nor assumes responsibility for the transmission of information is not a telecommunications service provider under Art. 2(b) BÜPF. The Bundesverwaltungsgericht confirmed this line in A-5373/2020 for ProtonMail, classified it as a provider of derived communication services under Art. 2(c) BÜPF, and remitted the matter for reassessment — the status of ProtonVPN and the precise scope of obligations for such providers remained open. For providers of derived communication services, Art. 27 BÜPF (SR 780.1) applies instead of Art. 26 BÜPF: suspicionless real-time content surveillance and blanket data retention fall away; targeted disclosure and surveillance obligations remain. Anyone seeking to shift the boundary between telecommunications service providers and providers of derived communication services must pass the proportionality test.

The EJPD draft of January 2025 sought to plough up precisely that line. It would have subjected providers of derived communication services with more than 5,000 users to an identification obligation and required providers with over one million users or CHF 100 million in annual turnover to retain metadata for six months. The administration’s argument was operational: authorities needed reliable identifiers because encrypted services were eroding their investigative capacity. The public consultation responded unanimously — every party that submitted a position, the industry association Swico, Digitale Gesellschaft, more than 15,000 petition signatures, and nineteen international civil liberties organisations, coordinated by EDRi and signed by Statewatch and Amnesty International Switzerland, found the draft disproportionate. Proton CEO Andy Yen announced the relocation of infrastructure out of Switzerland, and parts of the server infrastructure have since moved to Germany and Norway; Threema did not threaten to relocate abroad but warned of a citizens’ initiative.

The legal basis for the rejection is not new: Art. 5(2) of the Federal Constitution (SR 101) requires proportionality for every state action; Art. 13 of the Federal Constitution protects the confidentiality of communications. Art. 8 ECHR and the case law of the ECtHR (Big Brother Watch v. UK and Centrum för Rättvisa v. Sweden, both of 25 May 2021) require that any general data retention be clearly circumscribed, subject to judicial oversight, and accompanied by procedural safeguards. The CJEU declared suspicionless bulk data retention incompatible with EU law in Tele2 Sverige (2016) and La Quadrature du Net (2020), and has since required targeted, case-by-case storage. Switzerland is not an EU member but is bound by the ECHR — its supervisory practice has aligned itself with the Luxembourg doctrine for years.

Digitale Gesellschaft responded in May 2026 to a new EJPD draft of the VÜPF published by Republik. It raises the thresholds for identification and retention obligations and restricts the heaviest obligations to providers with a large market share. Data-lean business models remain in the crosshairs, however, because the structural orientation towards mass identification is unchanged. Reading the draft against the May 2025 consultation reveals an admission: the proportional threshold has shifted; the surveillance appetite has not.

Three consequences are operationally relevant this week. First: anyone deploying providers from the derived communication services segment — e-mail, messaging, VPN — should document the classification under Art. 2(c) BÜPF in the data-processing agreement with a reference to A-5373/2020, rather than leaving it as an open risk item. Second: the assumption that a future VÜPF revision will impose retention obligations without a proportionality review is no longer tenable; that review belongs in the contractual clauses governing compliance costs and data-location guarantees. Third: group-level encryption policies can be built on the current state of the law without hedging against an imminent retention regime. Anyone who documents the next supplier review properly will be able to sustain that position even if the second VÜPF draft enters the consultation process.

Art. 27 BÜPF (SR 780.1), as interpreted by the Bundesverwaltungsgericht in A-5373/2020, requires the authority to positively establish the telecommunications service provider qualification under Art. 2(b) BÜPF before it can demand full surveillance obligations. Anyone seeking to impose retention obligations must justify them proportionately rather than asserting them as a given. Proton did not obtain a special exemption in these proceedings. The judgment confirms a simpler fact: the Swiss surveillance state owes the same proportionality test as any other state action. Those still fighting in May 2026 over what the constitution settled long ago are fighting the wrong battle — and are likely to lose it in the end.