I'm not inherently trying to defend Proton here, but the question to ask here is -- did they have a choice? I'm asking seriously, and not rhetorically. Did they willingly hand over the data, or were they legally required to, by Swiss law?

Legal requests, which they were legally obligated to comply with. Every single country in the world will have some avenue to require data to be released to authorities.

That’s why strong privacy at every layer is so important. E2EE, for instance, means Proton cannot turn over any data that was transferred to and from customers. Private payments mean the company can’t turn over data on who is paying for accounts. DoH means the company can’t turn over data on what sites customers visited. Etc…

do you think any company in any country can refuse to do that?