Which needs to follow a mandate of properly handling user data (Switzerland has a law that's very close to GDPR) and properly respecting privacy as written in the proposal.

Not doing so is something the citizens can sue the government for - as opposed to US "private company can collect whatever, whenever and do whatever" (see credit ratings).