Fede­ral Coun­cil deci­des to revi­se the FADP; preli­mi­na­ry draft by the end of August 2016

Bern. The Fede­ral Coun­cil wants to revi­se the Data Pro­tec­tion Act (DPA). It deci­ded this in a deba­te on Wed­nes­day. It has ins­truc­ted the Fede­ral Depart­ment of Justi­ce and Poli­ce (FDJP) to sub­mit a preli­mi­na­ry draft for a revi­si­on of the DPA to it by the end of August 2016 at the latest, taking into account the data pro­tec­tion reforms curr­ent­ly under­way in the EU and the Coun­cil of Europe.

Source: Data pro­tec­tion to be streng­the­ned – FOJ

Fol­lo­wing the eva­lua­ti­on of the FADP in 2010 and 2011, the Fede­ral Coun­cil had ins­truc­ted the FDJP to con­sider legis­la­ti­ve mea­su­res to streng­then data pro­tec­tion. To this end, the FDJP appoin­ted a broad-based working group con­si­sting of repre­sen­ta­ti­ves of the fede­ral admi­ni­stra­ti­on, the can­tons, aca­de­mia and busi­ness and con­su­mer orga­nizati­ons. In its report, which the Fede­ral Coun­cil took note of on Wed­nes­day, it out­lines various vari­ants on how data pro­tec­tion pro­vi­si­ons can be adapt­ed to tech­no­lo­gi­cal and social deve­lo­p­ments and how pro­blems in the appli­ca­ti­on of the FADP can be remedied.
Con­sider reforms at the Euro­pean level

Data pro­tec­tion regu­la­ti­ons are curr­ent­ly being revi­sed in both the EU and the Coun­cil of Euro­pe. The Coun­cil of Euro­pe is fun­da­men­tal­ly revi­sing the “Con­ven­ti­on for the Pro­tec­tion of Indi­vi­du­als with regard to Auto­ma­tic Pro­ce­s­sing of Per­so­nal Data”, which Switz­er­land has rati­fi­ed. The draft for moder­ni­zing the con­ven­ti­on, which ente­red into force in 1985, is expec­ted to be adopted in the cour­se of 2015 or 2016 and sub­mit­ted to the con­trac­ting par­ties for signa­tu­re. In the opi­ni­on of the Fede­ral Coun­cil, fail­ure to rati­fy the moder­ni­zed Coun­cil of Euro­pe Con­ven­ti­on would have a signi­fi­cant nega­ti­ve impact on cross-bor­der data traf­fic for Switzerland.

The EU is also curr­ent­ly working on a revi­si­on of its data pro­tec­tion decrees. The EU data pro­tec­tion reform will pro­ba­b­ly not be com­ple­ted befo­re the end of 2015. Switz­er­land is only bound by the EU data pro­tec­tion decrees to the ext­ent that they repre­sent a fur­ther deve­lo­p­ment of the Schengen/Dublin acquis. Howe­ver, data traf­fic with the EU is fun­da­men­tal­ly sub­ject to the con­di­ti­on that the EU reco­gnizes Switzerland’s level of data pro­tec­tion as ade­qua­te. Switz­er­land the­r­e­fo­re has an inte­rest in streng­thening its data pro­tec­tion regulations.

With the revi­si­on of the FADP, the Fede­ral Coun­cil wants to crea­te the con­di­ti­ons for Switz­er­land to rati­fy the moder­ni­zed Coun­cil of Euro­pe Con­ven­ti­on for the Pro­tec­tion of Indi­vi­du­als with regard to Auto­ma­tic Pro­ce­s­sing of Per­so­nal Data and, to the ext­ent neces­sa­ry in the con­text of the fur­ther deve­lo­p­ment of the Schengen/Dublin acquis, to adopt the EU data pro­tec­tion decrees.

Howe­ver, the Fede­ral Coun­cil intends to press ahead with fur­ther work quick­ly. By set­ting a dead­line for the pre­pa­ra­ti­on of a preli­mi­na­ry draft by the end of August 2016 at the latest, the out­co­me of the­se reforms at Euro­pean level can be ade­qua­te­ly taken into account in the pre­pa­ra­ti­on of the con­sul­ta­ti­on draft.
Streng­thening the rights of data subjects

The eva­lua­ti­on of the FADP show­ed that data sub­jects rare­ly cla­im their rights against data pro­ces­sors. In order to ensu­re that the law can be bet­ter enforced in the future, it will be exami­ned during the pre­pa­ra­ti­on of the con­sul­ta­ti­on draft whe­ther, in addi­ti­on to the com­pe­ten­ces and powers of the FDPIC, the various legal claims of data sub­jects as well as the pro­ce­du­res for enfor­cing the law should be streng­the­ned in cer­tain are­as. This applies in par­ti­cu­lar to tho­se are­as in which the­re are still gaps com­pared to the Coun­cil of Euro­pe reforms.

With the revi­si­on of the FADP, the Fede­ral Coun­cil also wants to impro­ve data con­trol and gover­nan­ce as well as the pro­tec­tion of minors. Final­ly, the pro­mo­ti­on of rules of good prac­ti­ce is inten­ded to ensu­re that data pro­tec­tion takes effect at an ear­lier stage.