Dif­fe­rence sett­le­ment pro­ce­du­re: Deli­be­ra­ti­ons in the Natio­nal Council’s Sta­te Poli­cy Com­mit­tee (SPK‑N) completed.

The SPK‑N has exami­ned the dif­fe­ren­ces bet­ween the cham­bers and is now for­war­ding its pro­po­sals to the Natio­nal Council.

• Rejec­ting the Decis­i­on of the Coun­cil of Sta­tes of Decem­ber 18, 2019 the SPK‑N sub­mits the fol­lo­wing pro­po­sals to its Council: 
  • The libe­ral con­cept of pro­fil­ing is to be retai­ned and no distinc­tion made from high-risk pro­fil­ing, for which the Coun­cil of Sta­tes deman­ded addi­tio­nal protection.
  • The data con­trol­ler shall not be sub­ject to any expli­cit duty to pro­vi­de infor­ma­ti­on regar­ding its inten­ti­on to pro­cess and dis­c­lo­se per­so­nal data for the pur­po­se of checking cre­dit­wort­hi­ness. Pro­ce­s­sing for the pur­po­se of checking cre­dit­wort­hi­ness con­sti­tu­tes a justi­fi­ca­ti­on pur­su­ant to Art. 27 E‑DSG (over­ri­ding inte­rest), pro­vi­ded that the per­so­nal data is not older than five years. The decis­i­on of the Natio­nal Coun­cil, accor­ding to which the infor­ma­ti­on may not be older than ten years, was appar­ent­ly not fol­lo­wed. In this con­text, the reso­lu­ti­on of the Coun­cil of Sta­tes regar­ding increa­sed pro­tec­tion of minors was also taken into account, accor­ding to which the data may only be dis­c­lo­sed to third par­ties for the pur­po­se of cre­dit checks if the infor­ma­ti­on is requi­red for the con­clu­si­on of a con­tract and the per­son con­cer­ned is of age.
• In other important points, the SPK‑N fol­lows the small cham­ber and pro­po­ses that the Natio­nal Coun­cil devia­te from its ori­gi­nal decis­i­on as follows: 
  • The con­trol­ler should be able to dis­pen­se with informing the data sub­jects if the per­so­nal data is not dis­c­lo­sed to third par­ties, wher­eby the SPK‑N actual­ly seems to favor a so-cal­led group pri­vi­le­ge in this context;
  • If the data sub­ject makes use of his or her right to infor­ma­ti­on, a mini­mum cata­log and not an exhaus­ti­ve list of the infor­ma­ti­on to be pro­vi­ded should be inclu­ded in the law; all infor­ma­ti­on that is neces­sa­ry for the exer­cise of the data subject’s rights is decisive.
  • The SPK‑N is also in favor of sanc­tions for vio­la­ti­ons of the mini­mum data secu­ri­ty requi­re­ments, which the Natio­nal Coun­cil wan­ted to delete.

The Natio­nal Coun­cil will now dis­cuss the dif­fe­ren­ces and the pro­po­sals of its com­mis­si­on befo­re the draft is refer­red to the small cham­ber again.

At the same time, the SPK‑N has also Pro­to­col amen­ding the Coun­cil of Euro­pe Con­ven­ti­on for the Pro­tec­tion of Indi­vi­du­als with regard to Auto­ma­tic Pro­ce­s­sing of Per­so­nal Data This must now also be con­firm­ed by the Natio­nal Coun­cil so that the Fede­ral Coun­cil can rati­fy the agree­ment, pro­vi­ded that the Coun­cil of Sta­tes also appro­ves it.