Take-Aways (AI)
- Dispute over classification of particularly sensitive data: Minority wants to protect all genetic data, majority only clearly identifying genetic data.
- Disagreement on “high-risk profiling”: Minority II wants to classify any profiling with particularly sensitive data as high-risk.
- Discussion about explicit consent: Two minority motions call for explicit consent also for high-risk profiling, not only for particularly sensitive data.
- Minority demands complete abolition of group privilege as an exception to information obligations and justification.
In the spring session, the upper house of parliament has now discussed the differences regarding the draft revision of the DPA. A comprehensive overview can be found in the flag Spring Session 2020 of the National Council. However, the main differences concern the following points:
- The minority proposes to follow the proposal of the Council of States and the Federal Council, respectively, with regard to the classification of data requiring special protection in terms of definition, according to which all genetic data should be considered as requiring special protection. The majority still wants to adhere to the restriction whereby only those genetic data that clearly identify a natural person should also qualify as data worthy of special protection. Where the demarcation should take place according to such a definition is unclear and is likely to lead to difficulties in practice.
- In addition, the Grand Chamber continues to disagree on the concept of high-risk profiling. According to a minority II, any profiling that leads to particularly sensitive personal data should now be considered high-risk profiling. This qualification seems unconvincing, since the risk for a person in a profiling does not only result from the type of data, but above all from the concrete processing method of the profiling.
- In addition, two minority motions advocate an expansion of the requirement for express consent. While the majority wanted to anchor this only for the processing of particularly sensitive personal data in deviation from the current law, the minority motions demand expressiveness also for high-risk profiling (both by a private person and by a federal body).
- The minority also wants to delete the group privilege in its entirety (as an exception to the obligation to provide information; as a justification).
The deal is expected to go before the Council of States in the summer. However, against the current backdrop, it seems unlikely that it will come into force this year.