VPNs with servers in Liechtenstein

Retained data are traffic, location and subscriber data created when a subscriber accesses a public network, including logged internet services (art. 3). Providers must also verify and keep subscriber data for the contract term plus six months (art. 66). Whether a VPN operator is a provider within these articles is not established. Failing to store or delete in time is an administrative offence fined up to CHF 50,000 (art. 91).

Article 68 requires retained data to be processed securely, with measures that include a particularly secure encryption method, storage separate from ordinary operations and out of reach from the internet, storage in Liechtenstein, another EEA state or Switzerland, and two authorised persons for any access. Providers must hold a data-protection certification for it.

The Communications Act of 2023 contains no provision requiring providers to block access to content.

Defamation (§ 111 of the Criminal Code) carries up to six months or 360 daily rates, and up to a year or 720 where it reaches a wide public. Insult (§ 115) carries up to a month or 60 daily rates, rising to three months or 180 when done publicly. Discrimination (§ 283), including public incitement to hatred on grounds such as race, religion or sexual orientation, carries up to two years.

Under § 102a of the Code of Criminal Procedure, a court may order a provider to disclose retained data for a crime or a listed offence, which includes § 283 but not §§ 111 or 115, if the account holder or user is urgently suspected or consents in writing. A provider refusing unlawfully can be compelled by a coercive fine of up to CHF 50,000.

The Constitution guarantees the secrecy of letters and writings and allows searches and seizures only in the cases and manner the law fixes (art. 32). Judges are independent in office (art. 95), and the Constitutional Court (Staatsgerichtshof) reviews the constitutionality of laws (art. 104).

The Communications Act has the data-protection authority supervise retained data (art. 68(5)), requires every processing of retained data to be logged and the log produced to it on request (art. 68(2)), and has the courts compile a yearly statistic of retrieval, including those ending in no conviction (art. 69). The order of the rows is the security score, and a server’s location is not a recommendation.