Glossary International law
ProtonMail v UVEK
Also: ProtonMail Federal Administrative Court ruling, Federal Administrative Court A-550/2019
Origin: Bundesverwaltungsgericht, Urteil A-550/2019 vom 22. Oktober 2021 (ProtonMail AG v Eidgenössisches Departement für Umwelt, Verkehr, Energie und Kommunikation).
The 2021 ruling by the Swiss Federal Administrative Court holding that ProtonMail, the encrypted email service, was NOT a 'full' telecommunications service-provider under the BÜPF and was therefore not subject to the broader data-retention and interception duties the statute imposes on telcos. A foundational precedent for the classification of encrypted communications services under Swiss surveillance law.
Reviewed
ProtonMail v UVEK is the 2021 ruling of the Swiss Federal Administrative Court — citation A-550/2019 — in which the court held that ProtonMail AG was not a “full” telecommunications service-provider for the purposes of the BÜPF, the Swiss federal statute on telecommunications surveillance, and was therefore not subject to the broader data-retention and interception duties that the statute imposes on telcos. The case was brought by ProtonMail against the Federal Department for the Environment, Transport, Energy and Communications (UVEK), which had classified the service as a full telecommunications provider in an earlier administrative order.
The court’s reasoning turned on the operational character of the service. ProtonMail does not operate the underlying telecommunications infrastructure — it does not run a physical network, does not assign IP addresses to subscribers, does not operate as a transit between addressable endpoints in the traditional sense. It is an application running on top of telecommunications infrastructure provided by others. Under the BÜPF as revised in 2018, the court held, this places ProtonMail in the category of “derived services” — a thinner duty surface that does not include standing metadata retention and that addresses only specific authorised intercept orders.
The ruling is precedent-significant in two respects. First, it sets a workable test under Swiss law for distinguishing the substrate (which is full-BÜPF) from the application (which is not). Second, it confirms that an end-to-end-encrypted email provider, even one running its own user-facing infrastructure, is not by virtue of that infrastructure a full telecommunications provider; the BÜPF’s heaviest duties attach to whoever operates the network beneath the application.
For an offshore-hosting operator with Swiss presence, ProtonMail v UVEK is the leading authority for the classification question — what does a self-hosted email service, a hosted VPS, or a hosted dedicated server look like under the BÜPF? The publication’s Switzerland jurisdictional dossier cites the ruling as the basis for the operator’s classification.