Text of the
DSV from 31 August 2022, without the Annex 2 (amendments to other decrees). The text has been converted automatically – thank you for pointing out errors.
The articles are each accompanied by the corresponding text of the
Explanatory Report assigned, this without indication of page numbers and general remarks of the report.
Chapter 1: General provisions
Section 1: Data security
Explanatory report
The guard rails for ensuring data security are already standardized in the law. According to Article 8 (1) nDSG, the controller and the order processor are obliged to ensure data security appropriate to the risk by means of suitable technical and organizational measures. According to paragraph 2, these measures must make it possible to avoid breaches of data security. Paragraph 3 instructs the Federal Council to specify the minimum data security requirements at ordinance level.
With the provisions on data security, the Federal Council fulfills the legal mandate under Article 8 paragraph 3 nDSG. The penal provision in Article 61 letter c nDSG is also linked to these minimum requirements. The degree of security that must be complied with in order for the criminal standard not to be violated is determined in accordance with the principles and criteria of this section. Pursuant to Article 61 letter c nDSG, criminal liability exists only in the case of intentional commission. This requires that the responsible party knowingly and willfully fails to comply with the minimum data security requirements. For example, someone who fails to install anti-virus software even though he knows (or at least accepts) that he is taking insufficient measures to comply with the minimum data security requirements would be liable to prosecution.
Since the law already follows the approach of risk-based data security and no generally applicable minimum requirements can be defined for any industry, a rigid regime of minimum requirements was dispensed with in the Art. Instead, the approach of the Art. is based on the fact that it is primarily the responsibility of the responsible party to determine and take the measures necessary in each individual case. These measures must be determined on a case-by-case basis, depending on the risk involved. For example, in a hospital, where particularly sensitive personal data is regularly processed, there are generally more stringent requirements compared to the processing of customer or supplier data in a bakery or butcher’s shop. The Art. therefore includes, in particular, the guidelines for determining the measures to be taken (Art. 1, 2 and 3 Art.). In this way, the flexibility necessary in view of the variety of possible case constellations can be ensured and overregulation, especially for businesses with minor and low-risk data processing, can be prevented.
Unlike the GDPR, Swiss law does not have a general accountability obligation. However, Swiss law already contains measures in the applicable law with which the accountability obligation can be fulfilled: logging (Art. 4) and the processing regulations (Art. 5, 6). Both measures are adopted in the Art. They are crucial to ensure that Swiss law can provide an adequate level of protection compared to EU law. In addition, Directive (EU) 2016/680 requires logging. Both measures represent minimum data security requirements within the meaning of Article 8 (3) nDSG. Here, too, the Federal Council follows a risk-based approach: the higher the threat to the personal rights and fundamental rights of the individual, the higher the requirements.
Under current law, the minimum requirements for data security are set out in Articles 8 – 12 and Articles 20 – 21 of the Federal Data Protection Act. The Federal Council has decided to follow the current data security standard. The substantive requirements are therefore adopted in principle as they are. Adjustments will only be made where this seems appropriate due to digitalization or technical progress, the requirements in the revised law or Directive (EU) 2016/680, which is relevant for Switzerland, namely its Articles 25 and 29. In addition, the Federal Council has also taken Regulation (EU) 2016/679 as a guideline so that Swiss companies operating in the EU and ensuring data security that complies with the GDPR can also assume that they meet the minimum requirements in Switzerland.
From a systematic point of view, data security is now standardized in a dedicated section. In the current VDSG, data security is regulated separately for private and federal bodies; for reasons of clarity and better readability, the provisions are now combined. Where different requirements apply to private and federal bodies, these are regulated in separate articles or paragraphs.
Art. 1 Principles
1 In order to ensure adequate data security, the controller and the processor must determine the need for protection of the personal data and specify the technical and organizational measures that are appropriate in view of the risk
2 The need for protection of personal data is assessed according to the following criteria:
a. Type of data processed;
b. The purpose, nature, scope and circumstances of the processing.
3 The risk to the personality or fundamental rights of the data subject shall be assessed according to the following criteria:
a. Causes of risk;
b. main hazards;
c. measures taken or planned to reduce the risk;
d. The likelihood and severity of a data breach despite the measures taken or provided for.
4 The following criteria are also taken into account when determining the technical and organizational measures:
a. State of the art;
b. Implementation costs.
5 The need for protection of personal data, the risk and the technical and organizational measures must be reviewed over the entire processing period. The measures must be adapted if necessary.
Explanatory report
Article 1 Art. regulates the principles to be observed when determining the measures. It essentially adopts the regulatory concept of Article 8(2) and (3) of the Data Protection Act, with certain aspects being regulated more precisely. On the other hand, Article 8(1) of the FADP has been deleted, as the objectives for ensuring data security are now located at the level of the law. Article 8(2) nDSG specifically states that data security measures must make it possible to avoid data security breaches. According to Article 5 letter h nDSG, a breach of data security occurs when personal data is unintentionally or unlawfully lost, deleted, destroyed or modified, or disclosed or made accessible to unauthorized persons. The conventional IT protection goals of confidentiality, integrity, availability and traceability can be derived from this.
According to Article 8 (1) nDSG, the controller and the processor must ensure data security appropriate to the risk. In Article 1 Art. this protection goal is included in a new paragraph 1. In addition, various criteria for assessing the need for protection (para. 2) and for assessing the risk to the personality or fundamental rights of the data subject (para. 3) are specified. Paragraph 4 specifies that further criteria may be taken into account when determining the technical and organizational measures required to ensure adequate data security (para. 4). The list of criteria is based on current law.
Article 1(2) Art. adopts Article 8(2)(a) and (b) of the FADP in terms of content and supplements it to regulate the protection needs analysis. The need for protection is assessed on the basis of the type of data processed and the purpose, nature, scope and circumstances of the data processing. In particular, this involves the level of protection that must be ensured in view of the risk to the personal and fundamental rights of the data subjects. The higher the need for protection, the stricter the requirements for the measures. The following criteria should be taken into account when assessing the need for protection:
The type of data processed (a): For example, it is decisive whether personal data requiring special protection (Art. 5 let. c nDSG) is processed.
Purpose, nature, scope and circumstances of the data processing (lit. b): The purpose relates to the purpose of the processing and, in particular, to the examination of whether the purpose of the processing entails an increased risk to personal rights and fundamental rights; in the case of the nature of the processing, it is of interest how the data are processed. The need for protection may be higher, for example, in the case of a fully automated decision (use of artificial intelligence); the scope of the processing is related in particular to the number of persons affected by the processing (e.g., if extensive data is processed or extensive public areas are systematically monitored). When using a cloud, the need for protection may be higher than when data is stored on an internal server without external access. Letter b has been supplemented in accordance with Article 22(2) nDSG with the expression of the “circumstances” of the data processing. These are aspects that may be of particular importance in individual cases because they have an impact on the other criteria. Thus, criteria can be included that would not fit into the definition of the criteria already mentioned.
Article 1(3) Art. incorporates and clarifies Article 8(2)(c) of the Data Protection Act. The provision introduces the assessment of the risk of violation of personality or fundamental rights of the data subject. As in the previous paragraph, a set of criteria is established. The paragraph is reworded to make it clear that the causes of the risk (subparagraph (a)), the main dangers (subparagraph (b)), the measures taken or envisaged to reduce the risk (subparagraph (c)) and the likelihood and severity of a data breach (subparagraph (d)) are decisive. This is an assessment according to a cascade system: the result of the assessment according to one criterion is decisive for the further risk assessment. More detailed information on the individual points can be found here:
The causes of the risk (a): It must be possible to determine which persons (e.g., an IT officer, a user, a competitor) or events (e.g., fire, computer virus) could underlie the risk.
The main threats (point b): This criterion can be used to elicit threats that could lead to data security breaches (lost, damaged, altered, improperly or fraudulently used data, etc.).
The measures taken or that may be taken to reduce the risk (subparagraph (c)): the various technical and organizational measures that may be provided or taken to reduce the risk are specified in Article 3 Art.
The likelihood and severity of a data breach despite the measures taken or envisaged (subparagraph (d)): the potential impact on data subjects must be identified if, for example, individuals unlawfully access (and disclose), modify (leading to incorrect information about the data subject) or delete (running the risk of losing necessary data; for example, consider a patient dossier where some data has been destroyed, preventing appropriate medical treatment). Here, the more likely the occurrence of a data breach and the greater the impact on the affected individuals, the higher the requirements for the measures. It should be noted at this point that not every breach of data security within the meaning of Article 5 letter h nDSG also constitutes a breach of the minimum requirements within the meaning of Article 8 paragraph 3 nDSG and thus a breach of the due diligence obligations pursuant to Article 61 letter c nDSG. Absolute security cannot and should not be required. In particular, it is conceivable that the controller has taken all reasonable measures, but a data security breach nevertheless occurs, namely because the residual risk has materialized. This cannot be blamed on the responsible party. Rather, within the framework of the minimum requirements, it must be examined whether the controller and the processor have taken the appropriate measures to ensure data security in view of the specific situation, regardless of whether a data breach occurs.
Following Article 8(2)(d) of the Data Protection Act, Article 1(4) Art. introduces still further criteria that may be taken into account when determining the technical and organizational measures to ensure adequate data security. The term “determination” includes the “assessment” and the “decision” (the French version uses the term “détermination”). The criteria are as follows: the state of the art (subparagraph (a)) and the implementation costs (subparagraph (b)). These criteria only indirectly indicate whether measures must be taken and whether the measures to be taken are appropriate.
State of the art (a): The measures are to be determined taking into account the state of the art (technical and scientific knowledge) and adapted if necessary. The state of the art means the consideration of the current state of the art. It is therefore sufficient to take measures that are already available and have proven themselves accordingly. On the other hand, it cannot be demanded that brand-new unexplored techniques or those that are still in the development process be used.
Implementation costs (b): The term “costs” is to be understood in a broad sense. It is not limited to financial costs, but also includes the necessary human and time resources. This terminology corresponds to that of European law (Directive [EU] 2016/680 and GDPR). The implementation costs are – as can be seen from the “Commentary of the Federal Office of Justice on the Enforcement Ordinance of June 14, 1993 (as of January 1, 2008) on the Federal Act on Data Protection (VDSG, SR 235.11)” (No. 6.1.1) – also a criterion under current law when assessing the adequacy of the measures. However, the primary focus must be on which technical and organizational measures are required in light of the criteria in letters a‑c. In particular, data controllers and processors cannot exempt themselves from the obligation of adequate data security on the grounds that this would entail excessive costs; rather, they must in any case be in a position to ensure adequate data security. Nor can it be argued that if there is no concept during development, the implementation costs for implementing data security after going live will prove to be too high. Rather, for legacy applications, the planned time to replacement must be included (lifecycle). However, the criterion of cost may mean that, if there are several measures available to ensure an appropriate level of data protection at all times, the less expensive variant may be preferred.
Various measures can be taken to ensure data security. Three measures are mentioned here as examples:
the anonymization, pseudonymization and encryption of personal data: Anonymization contributes in particular to reducing any negative effects for the data subjects that may result, for example, from the unauthorized disclosure of personal data. If anonymization exists, the FADP does not apply at all in accordance with its scope of application.
Procedures for identifying, assessing and evaluating risks and reviewing the appropriateness of the measures taken: Above a certain level of risk, it will in many cases make sense or even be necessary to implement standardized procedures and processes that not only regularly review the risks and the appropriateness of the measures taken, but also assess and evaluate them. Such measures are particularly important for automated systems. They help to ensure that data security is permanently guaranteed and that it is also easier to prove.
training and advice for the persons entrusted with implementation: This measure is significant in the view of the Federal Council because the implementation and effectiveness of data security also depends in particular on whether the persons involved apply the specified measures. Thus, a lack of training and guidance can lead to a data breach. For example, employees should be made aware of the risk of opening malware.
Ultimately, it goes without saying that the circumstances of the individual case remain decisive in determining the measures to be taken.
In accordance with Article 1 (5), the measures are to be reviewed on an ongoing basis as under current law and adjusted if necessary. In particular, it must be checked whether the measures are still appropriate to the risk and effective. Instead of “periodically”, the review must now take place “over the entire processing period”. The need for review depends in particular on the level of risk to the personal rights and fundamental rights of those affected: the higher it is, the more frequently the measures must be reviewed on a regular basis. The new formulation moves in the direction of a constant review. However, it leaves the person in charge and the order processor a great deal of discretion. A review may also be necessary if there has been a breach of data security or if the processing of personal data has been adapted. Article 1(5) further clarifies that not only the technical and organizational measures must be reviewed during the entire duration of the processing, i.e. during the entire “lifecycle” of the personal data, but also the need for protection and the risks. By reviewing the need for protection and the risks, it is also (indirectly) checked whether the technical and organizational measures are suitable.
Art. 2 Goals
The data controller and the processor must take technical and organizational measures to ensure that the processed data are handled in accordance with their protection requirements:
a. are only accessible to authorized persons (confidentiality);
b. are available when they are needed (availability);
c. not be changed unauthorized or unintentionally (integrity);
d. are processed in a comprehensible manner (traceability).
Explanatory report
Article 2 Art. supplements Article 1 nDSG in terms of the purpose of the law and specifies the objectives for ensuring adequate data security, which are now set out in Article 8(2) nDSG. According to this provision, the measures must make it possible to avoid a breach of data security. Absolute security is an unattainable ideal. The risk-based approach is intended to identify the risks (Art. 1 Art.) so that the measures are aligned with the objectives and selected accordingly. The responsible party and the order processor must determine the objectives and the scope of protection.
In doctrine and practice, four protection objectives are generally recorded, known in French by the acronym (C.A.I.D.): confidentiality (confidentialité), authenticity (authentification), integrity (intégrité) and availability (disponibilité) of the data. In line with Article 32 of the GDPR and with a view to harmonization with the Federal Act on Information Security at the Confederation , which is to enter into force shortly, Article 2 is to regulate confidentiality (subpara. a), availability (subpara. b), integrity (subpara. c) and traceability (subpara. d).
Confidentiality (a): Personal data may only be accessible to authorized persons. The circle of authorized persons is determined by the context of the task area and the content and importance of the data. It can be very broad or extremely narrow. Confidentiality also includes authentication, related methods, and systems for managing and restricting access to ensure data security. Finally, the confidentiality of the system and the data should be guaranteed.
Availability (b): According to this purpose, the data controller ensures that the data can be viewed at any time. This requirement is even higher if the information must be constantly available for the fulfillment of essential or even legal tasks.
Integrity (c): This objective ensures the accuracy of the data. It is particularly important if the data are intended for the public or are to be reused. Integrity is understood to mean the authenticity, imputability and non-repudiation of the data. These terms are also used in practice or in teaching instead of integrity.
Traceability (subparagraph d): Based on this objective, unauthorized access or even misuse can be identified. In addition, the cause of an incident can be determined. The responsible party ensures that events and data traces are recorded and that they cannot be changed. Traceability of processing can be important to the process (evidence) and facilitates controls and monitoring. Attributability and non-repudiation of data are also talked about in practice in connection with traceability mechanisms.
Based on these objectives, procedures are to be developed to regularly monitor, analyze and evaluate the effectiveness of the measures taken (Art. 1 para. 5 and Art. 3 Art.).
Art. 3 Technical and organizational measures
1 To ensure confidentiality, the controller and the processor must take appropriate measures so that:
a. authorized persons have access only to the personal data they need to perform their tasks (access control);
b. only authorized persons have access to the premises and facilities where personal data is processed (access control);
c. unauthorized persons cannot use automated data processing systems by means of data transmission equipment (user control).
2 To ensure availability and integrity, the controller and the processor must take appropriate measures to ensure that:
a. unauthorized persons cannot read, copy, modify, move, delete or destroy data carriers (data carrier control);
b. unauthorized persons cannot store, read, modify, delete or destroy personal data in the memory (memory control);
c. unauthorized persons cannot read, copy, modify, delete or destroy personal data when disclosing personal data or transporting data carriers (transport control);
d. the availability of and access to personal data can be quickly restored in the event of a physical or technical incident (recovery);
e. all functions of the automated data processing system are available (availability), malfunctions are reported (reliability) and stored personal data cannot be damaged by malfunctions of the system (data integrity);
f. Operating systems and application software are always kept up to date with the latest security standards and known critical gaps are closed (system security).
3 To ensure traceability, the controller and the processor must take appropriate measures so that:
a. it is possible to check which personal data is entered or modified in the automated data processing system, at what time and by which person (input control);
b. it is possible to verify to whom personal data is disclosed using data transmission equipment (disclosure control);
c. Data security breaches can be detected quickly (detection) and measures can be taken to mitigate or eliminate the consequences (elimination).
Explanatory report
Article 8(1) nDSG requires that adequate security of personal data be ensured. Taking into account the results of the consultation, Article 3 provides that organizational and technical measures must be taken to achieve the objectives of Article 2. In application of proportionality, the organizational and technical measures of the individual case are to be determined on this basis. The responsible parties and order processors must therefore examine which suitable measures they can use to achieve the protection goals. It is quite conceivable that not every protection goal is relevant in every case. However, if a protection goal is not relevant in a case, the responsible party and order processor must be able to justify why this is the case. The “suitability” of the measures depends on the circumstances. The article shows the responsible person and the order processor, in a didactic manner, a series of measures with which they can achieve the objectives under Article 2. A measure may, moreover, contribute to the achievement of various objectives.
The article is largely a takeover of Article 9 of the Data Protection Act: The regulation is now under the title “Technical and organizational measures”. With Article 3 Art. Switzerland also implements the requirements of Article 29 of Directive (EU) 2016/680.
According to Article 1(3)(c) Art. the controller is obliged to take technical and organizational measures to reduce the risk. In the text of the regulation, several technical and organizational measures refer to “authorized” persons. This does not necessarily require direct action by a person. This can also include cases in which personal data is processed in applications or in an automated information system.
Article 3(1) Art. concretizes Article 2(1)(a) Art. and specifies measures for confidentiality; i.e., measures to ensure access control (subpara. a), access control (subpara. b), and user control (subpara. c).
In the first place, letter a now standardizes access control. The protection objective has been taken over from Article 9 (1) (g) of the Data Protection Act. It is mainly a matter of determining the access authorizations that regulate the type and scope of access. Care must be taken to ensure that authorized persons only have access to the personal data for which they are authorized. The measures to be taken are of an organizational and technical nature.
Letter b standardizes the access control anchored in Article 9 paragraph 1 letter a of the Federal Data Protection Act. Accordingly, unauthorized persons must be denied access to the premises and facilities in which personal data are processed. The protection objective now also includes the term “facilities”. This is intended to express in particular that access to mobile processing systems must also be prevented. The term is very broadly defined and includes all devices for processing personal data, from fixed server systems and computers to cell phones and tablets. Due to technological advances, “facility” can refer to facilities of both a physical and virtual nature. Possible measures include alarm systems and lockable server cabinets.
Letter c contains the user control regulated in Article 9 (1) (f) of the Data Protection Act. This is designed to prevent the use of automated data processing systems by means of data transmission equipment by unauthorized persons. The measures ensure that data cannot be used or passed on without authorization. Possible measures include, for example, regular checks of authorizations (e.g., blocking authorizations due to personnel changes or new task assignments) and the use of software against viruses or spyware, or raising staff awareness of phishing methods.
With regard to availability and integrity, the Article 3(2) Art. takes over the objectives of Article 2(1)(b) and (c) Art. The measures in this regard are to ensure control of the data carriers (subpara. a), storage (subpara. b), transport (subpara. c) and recovery (subpara. d). The measures must be suitable to ensure availability, reliability and integrity (subparagraph e). Finally, the security of the system must be kept up to date (subpara. f).
Letter a regulates data carrier control, which is currently standardized in Article 9 (1) letter b VDSG. This means that unauthorized persons are prevented from reading, copying, modifying, moving, deleting or destroying data carriers. In particular, personal data must be prevented from being transferred to data carriers (e.g. hard drives, USB sticks) in an uncontrolled manner. Data carriers are not only physical carriers, but also cloud services, for example. Possible measures include, for example, encryption and the proper destruction of data carriers. The letter corresponds to the requirement of Article 29(2)(b) of Directive (EU) 2016/680.
Letter b corresponds to Article 9 (1) (e) of the Data Protection Act and standardizes storage control. According to the measure, unauthorized persons may not store, view, modify, delete or destroy personal data in the memory. It must be made impossible for unauthorized persons to access, view, modify or delete the contents of the data store. Possible measures include, for example, defining differentiated access authorizations for data, applications and operating systems and logging access to applications. The letter corresponds to the requirement of Article 29(2)(c) of Directive (EU) 2016/680.
Letter c standardizes transport control, which is currently regulated in Article 9 (1) (c) of the Data Protection Act. Accordingly, when personal data is disclosed and data carriers are transported, it must be prevented that the data can be read, copied, modified, deleted or destroyed without authorization. The person responsible and the processor must ensure that the designated recipient receives the data in its original form and that no third party can intercept the data without authorization. Particularly in the case of personal data requiring special protection, there are increased requirements for the measures to be taken. For example, the encryption of data or data carriers may be considered.
Letter d is about the possibility of restoring the availability of and access to the personal data after a physical or technical incident. It has been newly included in the catalog based on Article 32(1)(c) of Regulation (EU) 2016/679 and corresponds to the requirement in Article 29(2)(i) of Directive (EU) 2016/680. One possible measure is the preparation and application of a backup concept.
Letter e determines that all functions of the automated data processing system are available (availability), any malfunctions that occur are reported (reliability), and stored personal data cannot be damaged by malfunctions of the system (data integrity). It was newly included in the catalog based on Article 32(1)(b) of Regulation (EU) 2016/679 and corresponds to the requirement in Article 29(2)(j) of Directive (EU) 2016/680. Here, the focus is in particular on ensuring that the stability or resilience of the systems used is permanently guaranteed. The notification of malfunctions is to be made by the system itself, so that the person responsible or the order processor is automatically made aware that a malfunction has occurred. If a malfunction is reported, this does not automatically mean that the functions are reliable; rather, the malfunction must also be corrected for this.
Letter f is concerned with ensuring the security of operating systems and application software used in the processing of personal data. Since the processing of personal data is based on systems and various applications running on them, it is necessary that these are kept up to date with the latest security standards and that critical gaps are closed promptly. Letter f thus supplements the requirements in letters d and e, with the aim of ensuring holistic security. It is not required that every system and application update be installed immediately, but that a process for updating be in place (so-called vulnerability and patch management). The corresponding security update can be implemented in a time-phased manner, taking into account the criticality levels (high, medium, low). However, until vulnerabilities are remedied, measures must be taken to ensure that data security is still guaranteed. In contrast to Article 3 (3) (c), (f) is not about reactive measures, but proactive remediation of vulnerabilities for which no data security breach has been identified in the system to date.
Paragraph 3 lists the traceability measures (Art. 2(1)(d) Art.), i.e. measures intended to ensure control of the entry (subparagraph (a)) and disclosure (subparagraph (b)), as well as measures for detection and elimination (subparagraph (c)).
Letter a now regulates input control. This requires – in accordance with Article 9 (2) (h) of the Data Protection Act – that it be possible to subsequently verify which personal data was entered or modified in the automated data processing system, at what time and by which person. The protection goal has been adapted in such a way that it is now explicitly stated that it must also be possible to subsequently verify the modification of personal data. Logging is a possible measure that can be considered in particular.
Letter b concerns the disclosure control. It has been taken over from Article 9 (1) (d) of the Data Protection Act and the wording has been slightly adapted. According to the new letter b, it is possible to check to whom personal data has been disclosed using data transmission equipment. In particular, the measures should make it possible to identify the data recipients. In this context, it may be sufficient that the institution as such is known, without the natural person having to be identifiable in every case. If necessary, it must be possible to determine, e.g. by means of protocols, which personal data was disclosed to whom.
Letter c requires that the controller and the processor can quickly identify breaches of data security within the meaning of Article 5 letter h nDSG and initiate measures to mitigate or eliminate their consequences. In contrast to paragraph 2 letter e, this relates in particular to reactive measures taken by the controller and the processor.
Article 9(2) of the FADP has been deleted, as the Federal Council no longer considers it necessary. The grounds for refusing, restricting or deferring a request for information are defined at the level of the law (cf. Art. 26 nDSG). Thus, the data controllers and order processors are already obliged by virtue of the nDSG to ensure that the data subjects can effectively exercise their rights, and this irrespective of the specific technologies used to process the personal data.
Art. 4 Logging
1 If personal data requiring special protection is processed automatically on a large scale or if high-risk profiling is carried out and preventive measures cannot guarantee data protection, the private controller and his private processor must at least log the storage, modification, reading, disclosure, deletion and destruction of the data. Logging must be carried out in particular if it cannot otherwise be determined retrospectively whether the data was processed for the purposes for which it was obtained or disclosed.
2 In the case of automated processing of personal data, the federal body responsible and its processor shall at least record the storage, modification, reading, disclosure, deletion and destruction of the data.
3 In the case of personal data that is generally accessible to the public, at least the storage, modification, deletion and destruction of the data must be logged.
4 The log must provide information on the identity of the person who carried out the processing, the type, date and time of the processing and, if applicable, the identity of the recipient of the data.
5 The logs must be kept for at least one year separately from the system in which the personal data are processed. They must be accessible only to the bodies and persons responsible for verifying the application of the data protection provisions or for maintaining or restoring the confidentiality, integrity, availability and traceability of the data, and may be used only for this purpose.
Explanatory report
Logging is governed by Article 10 of the VDSG, which also applies to federal bodies due to the reference in the first sentence of Article 20(1) of the VDSG. Article 4 adopts this regulation in amended form. Logging constitutes a measure within the meaning of Article 3 Art. This takes into account the fact that Swiss law, unlike the GDPR, does not provide for a general “accountability obligation”. Moreover, logging is also recommended by certain European data protection authorities. Furthermore, logging is a classic, preventive means of ensuring cybersecurity.
The purpose of logging is to ensure that the processing of personal data can be verified retrospectively, so that it can be determined whether data has been lost or deleted, destroyed, modified or disclosed. In addition, it is also a question of ensuring conformity with the purpose of the data and appropriate data security. Logging can also provide information as to whether personal data has been processed in accordance with its purpose. Furthermore, logging can also serve to uncover and clarify breaches of data security. However, logging is not intended to monitor the users who process personal data. Logging is an automated process. Nowadays, there is hardly any information system or automated data processing system in which data processing is not logged.
Article 4(1) Art. requires logging for the private controller and its private processor in the case of large-scale automated processing of data requiring special protection or high-risk profiling, if the preventive measures cannot guarantee data protection and if, without this measure, it cannot be determined retrospectively whether the data were processed for the purposes for which they were obtained or disclosed. At least the processes of storing, modifying, reading, disclosing, deleting and destroying data must be logged. The process of “reading” is to be understood as access without “modification”; it is therefore sufficient if the access to personal data and the modification of this data are logged. The logging of “reading” is thus satisfied. The phrase “preventive measures cannot guarantee data protection” has been taken over from current law. In practice, it is of secondary importance, since the preventive measures only rarely guarantee data protection.
According to paragraph 2, the federal body responsible and its commissioned processor must log at least the storage, modification, reading, disclosure, deletion and destruction of data during the automated processing of personal data. These are the same processing operations that the private controller must also log, but for federal bodies, logging must take place in a larger number of cases (for each automated processing operation). This takes into account the requirements of Article 25 of Directive (EU) 2016/680 applicable in the context of Schengen cooperation in the area of criminal law. As stated above, with regard to “reading”, it is sufficient if the accesses to personal data and the modification of these data are logged. For the implementation of the logging obligation, a transitional period of three years is provided for in Article 46(1) for data processing operations that do not fall within the scope of Directive (EU) 2016/680.
Paragraph 3 now states that in the case of personal data that is generally accessible to the public, at least the storage, modification, deletion and destruction of the data must be logged. This means, for example, that the consultation of the state calendar, which is generally publicly accessible, does not necessarily have to be logged.
The regulation was supplemented with a new paragraph 4, where the contents of the logging are specified. The log must provide information about the identity of the person who carried out the processing, the type, date and time of the processing and, if applicable, the identity of the recipient of the data.
In paragraph 5, Article 10 paragraph 2 VDSG is taken over in a slightly modified form. The logs must be kept for at least one year separately from the system in which the personal data is processed. However, this does not mean that the logs may be kept for a disproportionately long period. The retention period must be proportionate to the goal of adequate data security. Moreover, the special legal provisions remain reserved for federal bodies in any case. In particular, the Ordinance of 22 February 2012 on the Processing of Personal Data Arising from the Use of the Electronic Infrastructure of the Confederation provides in Article 4(1)(b) that data relating to the use of the electronic infrastructure may be retained for a maximum of two years. Separate storage from the system is necessary because otherwise the log itself could also be manipulated or encrypted in the event of cyber attacks. The logs are accessible only to the bodies or persons responsible for verifying the application of data protection regulations or for maintaining or restoring the confidentiality, integrity, availability and traceability of the data, and may be used only for this purpose. With the latter addition, the text of the ordinance now expresses that the logs should also be accessible to security officers so that they can restore the confidentiality, integrity, availability and traceability of the data. The term “preservation” is also intended to ensure that system administrators also have access to the logs generated in the system if they suspect that a security vulnerability exists. Consequently, this data may not be used for the purpose of monitoring users, especially their professional activities. This is, of course, without prejudice to use for purposes provided for in special legislation, such as possible use in criminal proceedings.
The third sentence of Article 10(1) of the FADP has been deleted. It would be contrary to the system if the FDPIC could make recommendations in the area of data security, which is subject to criminal liability under Article 61(c). In addition, the FDPIC can order logging in any case in the context of an investigation under Article 51 nDSG in accordance with his general power of disposal.
Art. 5 Processing regulations of private persons
1 The private controller and its private processor must draw up regulations for automated processing operations if they:
a. process personal data requiring special protection on a large scale; or
b. perform high-risk profiling.
2 The regulations must in particular contain details of the internal organization, the data processing and control procedure and the measures to ensure data security.
3 The private controller and its private commissioned processor must update the regulations regularly. If a data protection advisor has been appointed, the regulations must be made available to him or her.
Explanatory report
Processing regulations had to be drawn up by the “controller of an automated data file subject to notification” under Article 11a (3) FADP, who was not exempt from the obligation to notify his data files on the basis of Article 11a (5) letters b‑d FADP (Art. 11 (1) FADP). Since the notification obligation for private data controllers (Art. 11a FADP) no longer exists in the nDSG, Article 11 FADP cannot be adopted unchanged. According to the principle of accountability provided for in the GDPR, the controller must be able to demonstrate compliance with the data processing principles (Art. 5(2) GDPR). Swiss law does not have a general accountability obligation, but the obligation to draw up processing regulations serves the same purpose.
The duty to draw up processing regulations is incumbent on the person responsible and his or her processor. Private order processors acting on behalf of federal bodies fall under Article 6. If, exceptionally, a federal body acts as an order processor of a private person in charge, it does not fall under Article 5, where only private order processors are covered, but under the stricter Article 6. This is justified by the special position and responsibility resulting from the legal nature of the federal body. The processing regulations must be drawn up separately.
In accordance with the risk-based approach of the data security requirement, processing regulations should always be drawn up if there is an increased risk. Thus, private data controllers must draw up processing regulations for automated processing if they process personal data requiring special protection on a large scale (subparagraph a) or carry out high-risk profiling (subparagraph b). Letter a corresponds to the requirement in Article 22 paragraph 2 letter a nDSG and refers to the processing of particularly sensitive personal data on a large scale. This excludes cases in which persons requiring special protection are only processed on an isolated basis. Many companies, especially “traditional” SMEs, do not carry out such processing. They are therefore not affected by this provision.
Paragraph 2 contains a list of the contents which must at least be specified in the processing regulations. The contents have been taken over and supplemented from Article 11 (1) and Article 21 (2) VDSG in a slightly adapted form. As before, the processing regulations are to be designed as documentation or a manual and should also serve as such for the person responsible.
As before, the private responsible party and order processor must describe the internal organization in the processing regulations. This also includes the description of the architecture and the functioning of the systems.
Paragraph 2 specifies that the data processing procedures, i.e. in particular the procedures for storing, correcting, disclosing, retaining, archiving, pseudonymizing, anonymizing, deleting or destroying the data, must be contained in the processing regulations. This also includes measures for data minimization. The principle of data minimization is a central principle of data protection and, as can be seen from the dispatch DPA of September 15, 2017 , implicitly follows from the principle of proportionality pursuant to Article 6(2) nDSG. In particular, it should be specified which data processing procedures are to be undertaken and how they are to be carried out. The regulations must also contain the procedure for exercising the right of access and the right to issue or transfer data. The control procedures must make it possible to determine the access authorizations, the type and scope of access. Finally, it is essential that the processing regulations also include the technical and organizational measures to ensure appropriate data security. For example, it must be stated which measures are used to take account of the protection objectives pursuant to Article 2. The information should also provide information on the configuration of the IT resources, since this is a technical measure. The previous Article 21(2)(h) of the Data Protection Act, which still explicitly mentions the configuration of the IT resources, was therefore not adopted. It is sufficient that the most important basic configurations of the IT resources are explained in the processing regulations. However, they do not have to be elaborated down to the technical details.
Paragraph 3 represents an adoption of Article 11 paragraph 2 VDSG. Compared to the current law, the addition that the processing regulations must be made available to the advisor in a form that he or she can understand has been dispensed with. Since the advisor himself or herself is involved in the preparation of the regulations, they are generally comprehensible to him or her. The obligation that the processing regulations must also be made available to the agent upon request has been deleted. However, as with the list of processing activities, the FDPIC can request this as part of an investigation (Art. 50 para. 1 let. a nDSG).
Art. 6 Processing regulations of federal bodies
1 The responsible federal body and its commissioned processor shall draw up processing regulations for automated processing operations if they:
a. process personal data requiring special protection;
b. carry out profiling;
c. process personal data in accordance with Article 34 paragraph 2 letter c FADP;
d. make personal data accessible to cantons, foreign authorities, international organizations or private persons;
e. Link data files together; or
f. operate an information system or manage data resources together with other federal bodies.
2 The regulations must in particular contain information on the internal organization, the data processing and control procedure and the measures to ensure data security
3 The federal body responsible and its commissioned processor must regularly update the regulations and make them available to the data protection advisor
Explanatory report
Article 6 corresponds, with some modifications, to Article 21 VDSG.
The obligation to draw up processing regulations is incumbent on the responsible federal body as well as its order processor. As mentioned above, Article 6 concerns both private order processors and federal bodies that act as order processors by way of exception. The processing regulations must be drawn up separately.
In the introductory sentence of paragraph 1, the term “data collections” occurring in Article 21(1) introductory sentence of the FADP is replaced by “processing operations” because it is no longer used in the nDSG. This provision now stipulates that the responsible federal bodies must draw up processing regulations in the cases referred to in paragraph 1 letters a‑f.
The nDSG abolishes the term “personality profile” and introduces the term “profiling”. Accordingly, Article 21(1)(a) FADP must be amended and Article 6(1) Art. must provide that the federal body responsible and its commissioned processor must draw up processing regulations if it processes personal data requiring special protection (subparagraph a), carries out profiling in accordance with Article 5(f) nDSG (subparagraph b) or processes data in accordance with Article 34(2)(c) nDSG (subparagraph c). The case under letter a corresponds to the previous right under the FADP. Letters b and c are new. They replace Article 21(1)(a) FADP, which requires the federal body responsible to draw up processing regulations for all automated data collections that contain personality profiles.
Article 6(1)(d) Art. undergoes only a few editorial changes compared to Article 21(1)(c) of the GDPR.
In Article 6(1)(e), the term “data collections” used in the corresponding Article 21(1)(d) of the Data Protection Act is replaced by “data files”.
Based on Article 6 paragraph 1 letter f Art. a processing regulation must also be drawn up if the federal body responsible operates an information system or manages data files together with other federal bodies. This provision replaces Article 21 paragraph 1 letter b VDSG, according to which such an obligation exists if an automated data collection is used by several federal bodies.
Paragraph 2 corresponds to the content of the processing regulations for private persons according to Article 5 Paragraph 2 Art. Reference should therefore be made at this point to the explanations given above.
Paragraph 3 has been taken over in slightly adapted form from Article 21(3) VDSG. As in Article 5(3) Art. the provision in intelligible form has also been deleted here. The term “supervisory bodies” is replaced by “data protection advisor”. The mention of the FDPIC has been omitted for the reasons mentioned above in connection with Article 5(3) Art.
Section 2: Processing by Order Processors
Art. 7
1 The prior authorization of the controller allowing the processor to entrust the data processing to a third party may be of a specific or general nature
2 In the case of a general authorization, the Order Processor shall inform the Responsible Party of any intended change regarding the involvement or substitution of other third parties. The person responsible may object to this change
Explanatory report
Article 7 Art. regulates the type of prior authorization by which a controller may authorize a processor to transfer data processing to a third party. This provision is based on Article 22(2) of Directive (EU) 2016/680 or Article 28(2) of the GDPR. For reasons of legal certainty, it explicitly states what the Federal Council has already stated in the Dispatch on the Total Revision of the Data Protection Act regarding the authorization of subcontracted processing (see BBl 2017 6941, 7032). The prior authorization of the controller may be of a specific or general nature (Art. 7(1) Art.). In the case of a general authorization, the order processor must inform the responsible person of any intended change regarding the addition or replacement of another suborder processor. The controller may object to this change (Art. 7 par. 2 Art.).
Section 3: Disclosure of personal data abroad
Explanatory report
In accordance with the system of the Act, the provisions on the disclosure of personal data abroad have been placed among the general provisions in Chapter 1. Several terms related to the disclosure of data abroad need to be clarified. In the Art. this is done in five different articles: A first article specifies the criteria that the Federal Council must take into account when assessing whether a state, a territory, a specific sector in a state, or an international organization ensures adequate data protection; a second article sets out what the data protection clauses in a treaty and the specific safeguards to ensure adequate data protection must regulate; a third article deals with standard data protection clauses; a fourth article focuses on binding internal company data protection rules; based on the competence assigned to the Federal Council in Article 16(3) nDSG, a final provision provides for further appropriate safeguards.
Art. 8 Assessment of the adequacy of data protection of a State, a territory, a specific sector in a State or an international body.
1 The States, territories, specific sectors in a State and international bodies with adequate data protection are listed in Annex 1.
2 In assessing whether a State, a territory, a specific sector in a State or an international body ensures adequate data protection, the following criteria in particular shall be taken into account:
a. the international obligations of the state or international body, especially in the field of data protection;
b. the rule of law and respect for human rights;
c. the applicable legislation, in particular on data protection, as well as its implementation and the relevant case law;
d. the effective guarantee of the rights of data subjects and legal protection;
e. the effective functioning of one or more independent authorities responsible for data protection in the State concerned or to which an international body is answerable and which have sufficient powers and competences.
3 The Federal Data Protection and Information Commissioner (FDPIC) shall be consulted on any assessment. The assessments of international bodies or foreign authorities responsible for data protection may be taken into account.
4 The adequacy of data protection shall be reassessed periodically.
5 The assessments are published.
6 If the assessment under paragraph 4 or other information shows that adequate data protection is no longer guaranteed, Annex 1 shall be amended; this shall have no effect on the data disclosures already made.
Explanatory report
If certain criteria are met, the Federal Council may assess that a state or territory, a specific sector in a state or an international body guarantees adequate protection. According to Article 7 paragraph 1 letter d of the Organization Ordinance of 17 November 1999 for the Federal Department of Justice and Police (OV-FJPD), the task of ensuring adequate data protection of a state, a territory, a specific sector in a state or an international body falls within the competence of the Federal Office of Justice.
According to Article 8(1) DPA, the states, territories, specific sectors in a state and international bodies whose data protection has been deemed adequate are listed in the Annex to the Regulation. As explained in the message, this is a “positive list”. If a state is not included, this does not necessarily mean that it does not have data protection legislation that ensures adequate data protection; rather, it is conceivable that the state has not (yet) been assessed by the Federal Council. Only states that are included in the list in the Annex can therefore be considered to ensure adequate data protection. This approach differs somewhat from the approach of the FDPIC. Indeed, the FDPIC has so far indicated for each state whether it ensures adequate protection, adequate protection under certain conditions, or insufficient protection. It should also be noted that the FDPIC’s list is not binding and, in particular, does not bind the courts in the event of a dispute. Before discussing in detail the factors that the Federal Council must take into account in its assessment, it should first be clarified what is meant by a “territory” or a “specific sector in a State”. The term “territory” refers to cases where the country is not subject to a single legislation. This concerns namely the case of federal states, namely when the legislation of the central state does not ensure adequate protection, while a federal state has adequate data protection legislation, but this only applies on its own territory. Regarding the notion of “specific sector in a state”, for example, the list of the FDPIC can be cited, which takes into account, under Canada, that on the basis of a specific data protection law for the private sector, an adequate level of protection can only be recognized for this sector. Until July 2020, this also applied to the USA due to the Privacy Shield CH-US, which only allowed the free transfer of data to companies that had committed to comply with the binding principles of the Privacy Shield. Other specific sectors such as the financial or insurance sector or data processing by order processors should be mentioned. The term international body was clarified in the message on the Data Protection Act. It refers to “all international institutions, be they organizations or courts” (BBl 2017 6941, 7038) .
When deciding whether a state, a territory, a specific sector in a state or an international body ensures adequate data protection, the following criteria, among others, must be taken into account (Art. 8 para. 2 DPA):
The international obligations of the state or international body concerned, in particular in the area of data protection (para. 2 let. a): This refers in particular to the revised ETS 108 Convention. However, not only agreements in the area of data protection are relevant, which is why the term “in particular” is used (see also the explanation to let. c). For example, agreements regulating the exchange of information may also play a role.
The rule of law and respect for human rights (para. 2(b)): In subparagraph (b), the term “human rights” is used in order to use the same terminology as in the ECHR and UN Covenant II. The Federal Council has the necessary discretion to determine whether a state ensures adequate data protection even if it does not fully comply with internationally recognized human rights. What is important here is that protection against disproportionate interference with private life is guaranteed, even if the state does not, for example, meet the requirements of the ECHR in all respects.
The applicable legislation, in particular on data protection, as well as its implementation and the relevant case law (para. 2 let. c): Due to the term “in particular”, sectoral legislation is also meant. These often contain (direct and/or indirect) regulations on data protection. This applies, for example, to states that do not have a framework law on data protection, but only a civil code. In some cases, these states have sectoral laws that contain data protection provisions. It is important that the applicable laws apply. Therefore, the focus will be on the relevant general and specific legislation of the state, including those on public security, defense, national security, criminal law, and access to personal data by public authorities.
The effective guarantee of the rights of the data subjects and legal protection (para. 2 let. d): It is not only a matter of checking whether the rights of the data subjects are contained in legal bases, but also of ensuring that these rights are actually implemented.
The effective functioning of one or more independent authorities in charge of data protection in the state concerned or to which an international body is subordinate and which have sufficient powers and competences. In this sense, the minimum requirements of the revised convention ETS 108 must be met (para. 2 let. e).
The third paragraph stipulates that the FDPIC is consulted in any adequacy assessment. Its opinion is not binding on the Federal Council, but must be taken into account, especially in the context of the office consultation. The FDPIC may also publish its opinion. The Federal Council may also take into account an assessment of the level of protection made by a foreign authority responsible for data protection (and belonging to a state with an adequate level of protection) or by an international body. An international body within the meaning of this paragraph may be, inter alia, the Committee of the Parties established by the revised Convention ETS 108. Assessments made by the European Commission may also serve as a source of information.
The fourth paragraph provides for periodic reassessment of the level of protection in the State or institution concerned.
Based on the various comments received during the consultation procedure, a new paragraph 5 provides that the assessments carried out by the Federal Office of Justice are to be published. The term assessment includes both the assessment and the reassessment of states, territories, specific sectors in a state or international bodies that are already on the list and are being reassessed. A new transitional provision (Art. 46 para. 2) clarifies that assessments carried out before the entry into force of the DSV will not be published.
The Regulation introduces a new requirement to carry out a balancing of interests, which makes it possible to act in urgent cases when it can be concluded that adequacy can no longer be guaranteed. According to paragraph 6, Annex 1 shall be amended if it is determined that data protection can no longer be guaranteed in a State, a territory, a specific sector in a State or an international body. In the case of the U.S., for example, the July 2020 “Schrems II” ruling by the ECJ caused the FDPIC to reconsider its assessment and amend its list. If information suggests that a state concerned no longer ensures adequate data protection (e.g. due to a state crisis), the Federal Council may urgently amend the list without having carried out a formal and complete examination. This is because urgent publications are possible under Article 7(3) PublG. However, this only applies in the case of a deletion from the list. In the case of an addition to the list, the assessment procedure must be followed (paras. 1 and 2). The amendment has no effect on data disclosures that have already been made.
Art. 9 Data protection clauses and specific safeguards
1 The data protection clauses in a contract under Article 16(2)(b) FADP and the specific guarantees under Article 16(2)(c) FADP must contain at least the following points:
a. the application of the principles of legality, good faith, proportionality, transparency, purpose limitation and accuracy;
b. the categories of personal data disclosed and the persons concerned;
c. the nature and purpose of the disclosure of personal data;
d. where applicable, the names of the states or international bodies to which or to which personal data are disclosed and the requirements for disclosure;
e. the requirements for the retention, deletion and destruction of personal data;
f. the recipients or categories of recipients;
g. the measures to ensure data security;
h. the obligation to report breaches of data security;
i. if the recipients are data controllers: the obligation to inform the data subjects about the processing;
j. the rights of the data subject, in particular:
1. the right of access and the right to issue or transfer data,
2. the right to object to the disclosure of data,
3. the right to rectification, erasure or destruction of their data,
4. the right to seek legal protection from an independent authority.
2 The controller and, in the case of data protection clauses in a contract, the processor must take reasonable measures to ensure that the recipient complies with these clauses or the specific safeguards
3 If the FDPIC has been informed of the data protection clauses in a contract or of the specific safeguards, the information obligation shall be deemed to have been fulfilled for all further disclosures that:
a. take place under the same data protection clauses or safeguards, provided that the categories of recipients, the purpose of the processing and the categories of data remain substantially unchanged; or
b. take place within the same legal entity or company or between companies belonging to the same group.
Explanatory report
According to Article 16 (2) nDSG, personal data may be disclosed to a state that is not listed in Annex 1 of the Ordinance – i.e. without the Federal Council having recognized the adequacy of data protection as appropriate – if appropriate data protection is guaranteed. In the private sector, this may be guaranteed by a data protection clause in a contract between the controller or processor and its contractual partner (Art. 16 para. 2 let. b nDSG), and in the public sector by specific guarantees drawn up by the competent federal body (Art. 16 para. 2 let. c nDSG).
Unlike the other instruments mentioned in paragraph 2 of Article 16 nDSG, data controllers and processors do not need to have these safeguards approved by the FDPIC, but only to notify him of them before disclosing data abroad. There is a certain risk that the data controllers and the data processors will assess the level of protection to be achieved by these safeguards differently, this being true for the private sector as well as for the public sector.
The Federal Council therefore considers it appropriate to lay down certain data protection standards and specifies in Article 9(1) Art. what these data protection clauses or specific guarantees must regulate as a minimum.
These are as follows:
The application of the principles of legality, good faith, proportionality, transparency, purpose limitation, and accuracy (subparagraph (a)).
The categories of personal data disclosed and the data subjects (let. b).
The nature and purpose of the disclosure of personal data (subparagraph c).
Where applicable, the names of the States or international bodies to which or to which personal data are disclosed and the requirements for disclosure (subparagraph (d)): the expression “where applicable” provides the possibility of adapting to the circumstances of a treaty. In certain very narrowly defined contracts, this subparagraph does not qualify. For example, if no data are disclosed to an international body under the contract, such a reference would obviously be superfluous.
The requirements for retention, deletion and destruction of personal data (subparagraph e).
The recipients or categories of recipients (subparagraph (f)): The categories of recipients may be useful, albeit in a generic form, as necessary (e.g..: Representatives and agents, order processors, co-responsible parties, treating physicians, municipalities, external partner organizations, etc.).
The measures to ensure data security (subparagraph g).
The obligation to report data security breaches (subparagraph (h)).
If the recipients are responsible parties: the obligation to inform the data subjects about the processing (subparagraph (i)): The recipient as processor cannot be responsible and comply with this obligation.
The rights of the data subject (point j), in particular: the right of access and the right to have data disclosed or transferred (point 1), the right to object to the disclosure of data (point 2), the right to have their data corrected, deleted or destroyed (point 3) and the right to seek legal protection from an independent authority (data protection authority or court) (point 4).
All of these points correspond to the fundamentals of the nDSG. Paragraph 2 also clarifies that if personal data is disclosed abroad, the controller must take appropriate measures to ensure that the recipient complies with the data protection clauses in a contract or the specific safeguards; the processor must also ensure this in the case of data protection clauses in a contract (contract processing is not applicable to the specific safeguards). Thus, this paragraph (which essentially adopts Art. 6(2) and (4) of the FADP) can be used to ensure that the recipient of the disclosed data complies with the data protection framework applicable in Switzerland.
A third paragraph takes over Article 6(2) of the Data Protection Act on the controller’s duty to inform. It is only editorially adapted (e.g. the term “maître du fichier” is replaced in the French version) by deleting the second sub-sentence in Article 6(2)(b) DDPA. In any case, disclosure abroad is only permitted if the data protection clauses or safeguards ensure appropriate protection, namely by meeting the requirements of Article 9(1) Art. It is therefore not necessary to mention this again in Article 9(3)(b) Art.
Art. 10 Standard data protection clauses
1 If the controller or processor discloses personal data abroad by means of standard data protection clauses in accordance with Article 16 paragraph 2 letter d FADP, it shall take appropriate measures to ensure that the recipient complies with these
2 The FDPIC shall publish a list of standard data protection clauses which he has approved, issued or recognized. It shall communicate the result of the examination of the standard data protection clauses submitted to it within 90 days
Explanatory report
As in the case of data disclosure abroad, which is based on data protection clauses in a contract and on specific guarantees, Swiss data protection regulations must also be complied with in the case of data disclosure by means of standard data protection clauses (Art. 16 para. 2 let. d nDSG). Thus, Article 10(1) Art. which corresponds in principle to Article 6(4) nDSG specifies that the controller or processor must take appropriate measures to ensure that the recipient actually complies with the standard clauses. In the Federal Office of Justice’s commentary on the VDSG, this duty of care is specified as follows: “The appropriateness of the required measures depends on the circumstances in the specific case and the state of the art. If it is a matter of particularly sensitive personal data or personality profiles, the requirements are higher than if it is a matter of simple personal data.” Although the term “personality profiles” is no longer used in the nDSG, the explanation is still relevant for understanding that the measures must be adapted to the specific circumstances. This is a duty of care and the controller or processor must ensure that the measures are taken and monitor their implementation.
Paragraph 2 concerns the approval by the FDPIC of standard data protection clauses drawn up by a private person or a federal body. The FDPIC issues an opinion and publishes on its website a list of standard data protection clauses that it has approved, issued or recognized. The standard clauses must comply with Swiss data protection requirements and be capable of being interpreted in accordance with Swiss data protection law. The FDPIC “shall communicate the result of the review of the standard data protection clauses submitted to it within 90 days”.
Art. 11 Binding corporate data protection regulations
1 Binding corporate data protection regulations pursuant to Article 16 paragraph 2 letter e FADP apply to all companies belonging to the same group of companies
2 They shall include at least the items referred to in Article 9(1) and the following information:
a. the organization and contact details of the Group and its companies;
b. the measures taken within the Group to comply with binding internal corporate data protection regulations.
3 The FDPIC shall communicate the result of the review of the binding corporate data protection rules submitted to it within 90 days
Explanatory report
Binding corporate data protection regulations apply to all companies belonging to the same corporate group and must be complied with by them. These regulations must include not only the items mentioned in Article 9 (1) Art. but also information on the organization and contact details of the group and each of its entities (para. 2 let. a) as well as information on the measures taken within the group to ensure compliance with the corporate internal regulations (para. 2 let. b).
These binding internal company regulations must also be submitted to the FDPIC in accordance with Article 16 paragraph 2 letter e nDSG.
Article 11 Art. includes a new paragraph 3, according to which the FDPIC “shall communicate the result of the review of the binding corporate data protection rules submitted to it within 90 days”.
Art. 12 Codes of conduct and certifications
1 Personal data may be disclosed abroad if a code of conduct or certification ensures appropriate data protection
2 The code of conduct must be submitted in advance to the FDPIC for approval.
3 The code of conduct or certification must be accompanied by a binding and enforceable commitment by the controller or processor in the third country to apply the measures contained therein
Explanatory report
According to Article 16(3) nDSG, the Federal Council may provide for other suitable safeguards that allow data to be disclosed abroad. For example, appropriate data protection can also be guaranteed by a code of conduct or certification (para. 1).
With this new measure, companies are given an incentive to introduce such a code or to have their systems, products or services certified. As in the case of standard data protection clauses and binding internal company regulations, for reasons of consistency it is also stipulated that codes of conduct must be approved by the FDPIC (para. 2). This is because these instruments must be examined for their suitability. For its examination, the FDPIC may be guided by the criteria of Article 9(1) Art. The approval of the codes of conduct by the FDPIC does not contradict Article 11 nDSG, which provides in general terms that the FDPIC shall give an opinion on the codes of conduct submitted to him, but shall not approve them. In the specific case where a controller relies on its code of conduct when disclosing data abroad, it is appropriate, as in the case of standard data protection clauses and binding corporate rules, for the FDPIC to approve this instrument. According to the ordinance of 28 September 2007 on data protection certifications, only foreign certifications must be recognized by the FDPIC. This is maintained in this way with the totally revised ordinance. However, this does not mean that the certification does not have to meet the requirements of the Ordinance on Data Protection Certifications.
In addition, the controller or processor located in a third country must make a binding and enforceable commitment to apply the measures contained in the code of conduct or certification (para. 3).
Repeal of Articles 5 and 7 VDSG
Articles 5 and 7 VDSG are not taken over. The former provision was inserted into the nDSG (Art. 18). The second, which assigned the FDPIC the competence to draw up a list of countries with an adequate level of data protection, is obsolete because the Federal Council now has this competence (Art. 16 para. 1 nDSG).
Chapter 2: Obligations of the responsible person
Art. 13 Modalities of the information obligation
The data controller must provide the data subject with the information on the acquisition of personal data in a precise, transparent, comprehensible and easily accessible form.
Explanatory report
The duty of the data controller to provide information is enshrined in Article 19 nDSG. Exceptions and limitations are set out in Article 20 nDSG. Article 19(1) nDSG provides that the data subject must be provided with “adequate” information. This means that, as far as possible, the information is communicated in a precise, transparent, comprehensible and easily accessible form.
In other words, when choosing the form of information, the controller must ensure that the data subject always receives the most important information at the first level of communication when obtaining his or her personal data. If the communication takes place via a website, for example, a good practice may be that all essential information is available at a glance, e.g. in the form of an organized overview. To obtain further information, the data subject can then click on this information displayed first, whereupon a window opens with more detailed information. It should be noted, however, that communication via a website is not always sufficient: The data subject must know that he or she will find the information on a specific website. In the case of a telephone conversation, the information can also be communicated orally and, if necessary, supplemented by a link to a website. In the case of recorded information, the data subject must have the opportunity to listen to more detailed information. In the event that the person is filmed using a video surveillance system or a drone, he or she must be made aware of this, for example, by means of a sign or as part of an information campaign.
In accordance with Article 19 (1) nDSG, Article 13 Art. is addressed solely to the controller and not to the processor. However, it should be noted at this point that the information provided to the data controller in accordance with Article 19 (2) (c) nDSG must also contain details of the recipients or categories of recipients. According to the explanations in the Dispatch on the Data Protection Act, the commissioned processor is also one of the recipients within the meaning of Article 19(2)(c) nDSG (BBl 2017 6941, 7051). When obtaining personal data, the controller must therefore also inform the data subject that the data will be disclosed to a commissioned processor.
Art. 14 Retention of the data protection impact assessment
The controller must keep the data protection impact assessment for at least two years after the end of data processing.
Explanatory report
The standard specifies the retention period for the data protection impact assessment within the meaning of Article 22 nDSG. It must be retained for at least 2 years. The reason for retaining the data protection impact assessment beyond the time the data processing is carried out is that it represents a central instrument under data protection law. It can be of particular importance when clarifying breaches of data security or assessing the punishability of conduct. Thus, the data protection impact assessment provides information on how the risks to personality or fundamental rights have been assessed and what measures have been taken. In the case of federal bodies, which in principle can only process data on the basis of legal foundations, it may be the case that a data protection impact assessment must be retained for a very long period of time due to the permanence of certain legal foundations.<
In the case of federal bodies, it will also be necessary to regulate how the data protection impact assessment is to be coordinated with the legislative process for creating the legal basis for data processing. It is to be stipulated that the federal bodies must attach the data protection impact assessment to the application to the Federal Council together with the draft enactments and that they must record the results of the data protection impact assessment in the Federal Council’s message. However, since the regulation is only of a directive nature within the federal administration, it is not to be regulated at ordinance level. It is planned to implement the regulation in the guidelines for Federal Council business (“red folder”) and in the embassy guide.
For the implementation of the data protection impact assessment, the FDPIC may make use of his competence to develop working instruments as recommendations of good practice for the attention of data controllers within the meaning of Article 58(1)(g) nDSG. In doing so, it has a certain degree of discretion.
Art. 15 Notification of data security breaches
1 The notification of a data breach to the FDPIC must contain the following information:
a. the nature of the injury;
b. as far as possible, the time and duration;
c. as far as possible, the categories and approximate number of personal data concerned;
d. as far as possible, the categories and approximate number of persons concerned;
e. the consequences, including any risks, for the persons concerned;
f. what measures have been taken or are planned to remedy the defect and mitigate the consequences, including any risks;
g. the name and contact details of a contact person.
2 If it is not possible for the person responsible to report all the information at the same time, he or she shall provide the missing information as quickly as possible
3 If the controller is obliged to inform the data subject, he shall inform him in plain and intelligible language of at least the information referred to in paragraph 1 letters a and e‑g
4 The person responsible must document the violations. The documentation must contain the facts relating to the incidents, their effects and the measures taken. It must be kept for at least two years from the time of notification in accordance with paragraph 1
Explanatory report
Article 24(2) nDSG contains the minimum requirements for a notification of data security breaches by the data controller to the FDPIC: this includes the nature of the data security breach, its consequences and the measures taken or envisaged. The content of this notification to the FDPIC is specified in Art. 15 para. 1 Art. (former Art. 19 para. 1 Electronic Data Protection Act) is further specified. It should be noted that, according to Article 24(1) nDSG, notification to the FDPIC is limited to data security breaches that are likely to result in a high risk to the personality or fundamental rights of the data subject. Only notifiable breaches must be reported.
Paragraph 1 contains the following catalog of information: In addition to the type of data breach already mentioned in the law (subparagraph a), it is further provided that, to the extent possible, the time and duration of the data breach must also be notified (subparagraph b). Further, to the extent possible, the categories and approximate number of personal data affected by the data breach (subparagraph (c)) must also be reported, as well as the categories and approximate number of individuals affected (subparagraph (d)). This information is of fundamental importance so that the extent of the breach can be assessed. In particular, it is necessary to know which categories of personal data are affected by the breach (e.g. addresses, credit card information, health data) so that the explanations of the consequences, risks and measures can be understood at all. In connection with the notification of consequences and risks for the data subjects (subparagraph (e)) and the measures taken by the data controller (subparagraph (f)), the data controller must, when informing the data subject, also specify, among other things, which categories of personal data are affected by the breach in his or her case. This allows the data subject to take concrete measures himself (e.g. immediate password change if login data has been stolen or credit card blocking). Finally, the responsible party must notify the name and contact details of a contact person (g) who will act as a point of contact for communication with the FDPIC as well as the data subjects.
Paragraph 2 enables the data controller to provide the FDPIC with the information step by step if it is not possible for the data controller to provide all of the information pursuant to paragraph 1 at the same time as the data breach is discovered. Since the data controller must submit the notification “as soon as possible” pursuant to Article 24(1) nDSG, the problem will regularly arise in practice, particularly with regard to the information pursuant to paragraph 1 letters b‑d, that this information is often not even available immediately after the data security breach is discovered. Therefore, the responsible party is enabled to provide only the basic information known to it in a first step upon discovery of the breach. For the subsequent notification, it applies – as according to Article 24 paragraph 1 nDSG – that the responsible party must report the remaining information “as soon as possible”. As soon as the missing information is available, the responsible party must provide it to the FDPIC with a subsequent notification. If the information still has to be obtained, he must take care of it without delay.
Paragraph 3 specifies the information that must be provided to the data subject if information is to be provided to him or her pursuant to Article 24 paragraph 4 nDSG. Furthermore, this information must be provided in the simplest and most comprehensible language possible – in comparison to the notification to the Commissioner – as it cannot be assumed that an average data subject is familiar with the technical jargon of this technical subject matter. The content of the notification to the FDPIC is somewhat broader than that of the information to the data subjects, since the former must be able to obtain an idea of the extent of a data security breach.
Paragraph 4 provides that the facts related to the reported data breach, its effects and the measures taken must be documented. The documentation must be retained for at least two years from the date of notification of the data breach.
In connection with the practical implementation of the notification obligation under Article 24 nDSG, it should be noted that a large number of annual notifications can be expected based on the experience of foreign supervisory authorities in implementing the similarly structured notification obligation in Article 33 of Regulation (EU) 2016/679. For example, the exchange with the Bavarian State Office for Data Protection Supervision, whose figures can be roughly projected to Switzerland, has shown that around 6000 notifications could be received per year. In order to offer those responsible a structured reporting option and to process the mass of reports as efficiently as possible, the FDPIC is currently working on the development of a web-based reporting interface, probably in the form of an interactive form. As part of this project, the FDPIC is also currently examining the possibility of a joint reporting portal together with other federal bodies that provide for similar reporting obligations or possibilities in the area of data security (e.g., for critical infrastructure reporting). Such a reporting portal would reduce the workload for the person responsible if he or she has to submit reports to several federal agencies.
Chapter 3: Rights of the data subject
Explanatory report
The chapter on the rights of the data subject in the e‑DSG only included the right of access and its restrictions. Parliament has added a right to data issuance and transfer. Accordingly, the regulation specifies these two types of data subject rights in separate sections.
Section 1 deals with the right to information. After consultation with the Federal Department of Foreign Affairs and the Federal Department of Defense, Civil Protection and Sport, the content of Article 14 of the Federal Data Protection Act was not included in the Art. because it is no longer up to date. Therefore, the right to information for both sectors, private and public, is now regulated in the same chapter. This follows the systematics of the nDSG and connects to the provisions on the duties of the data controller.
The various aspects of the right to information are now spread over several articles. A first article focuses on the modalities of the right to information, in particular the form in which information is to be provided. A second article regulates the right of access when several data controllers jointly process personal data or when data is processed by a processor. A third article specifies the time limits, and a fourth article regulates the exceptions to the right of access being free of charge.
The 2nd section deals with the right to issue or transfer data. It includes the following articles: Article 20 Art. deals with the scope of the right, Article 21 Art. with the technical requirements for implementation, and Article 22 Art. (former Art. 24 E‑VDSG) specifies under time limit, modalities and competence to what extent the provisions on the right to information are applicable to the right to data surrender or transfer.
Section 1: Right to information
Art. 16 Modalities
1 Anyone who requests information from the person responsible as to whether personal data relating to him or her is being processed must do so in writing. If the person responsible agrees, the request may also be made orally.
2 The information shall be provided in writing or in the form in which the data is available. With the agreement of the data controller, the data subject may inspect his or her data on site. The information may be provided orally if the data subject agrees to
3 The request for information and the provision of information may be made by electronic means
4 The information must be provided to the data subject in an intelligible form
5 The person responsible must take appropriate measures to identify the data subject. This person is obliged to cooperate
Explanatory report
This provision specifies the modalities of the right to information provided for in Article 25 nDSG. It partially incorporates Article 8(5) FADP and Article 1(1 – 3) FADP.
Para. 1
Article 16 Art. (former Art. 20 E‑DPA) focuses in paragraph 1 on the form of the request for information. “In writing” within the meaning of Article 16(1) Art. includes any form that enables proof by text. Not meant, however, is the so-called simple written form according to Articles 13 – 15 of the Code of Obligations . This requires a hand signature or a qualified electronic signature linked with a qualified time stamp in accordance with the Federal Act of 18 March 2016 on Electronic Signatures. Article 16 para. 1 Art. on the other hand only requires the presence of a written text. Art. 16 para. 1 Art. essentially adopts the content of Art. 1 para. 1 VDSG, according to which the person must “as a rule, apply for his right to information in writing”. The commentary on the FADP by the Federal Office of Justice already specifies that in certain cases and subject to the consent of the owner of the data collection (now the data controller), the oral form is sufficient. For the sake of increased clarity, Article 16 Art. has been reworded accordingly. In addition, Article 1 (1) of the Data Protection Act has been editorially adapted.
Para. 2
Compared to the current law, Article 16 (2) Art. (former Art. 20 para. 2 E‑Data Protection Act) now explicitly states that information may be provided not only in writing but also in the form in which the data is available. As a rule, this is personal data in written form. If, on the other hand, the data is available in the form of visual or audio recordings, for example, the data subject will receive the data in this form. As explained above, “in writing” in the present context is to be understood as requiring the existence of a written text.
As provided for in Article 1(3) of the FADP, personal data may also be inspected on the spot, in particular if they are distributed among various files or are particularly voluminous or if the information requested requires explanation. In contrast to Article 1 (3) of the Data Protection Act, the passage according to which on-site inspection takes place at the suggestion of the person responsible has been deleted. On-site inspection always requires the consent of the data controller and the data subject. On whose proposal the on-site inspection takes place, however, is not decisive. In the case of on-site inspection, the data subject must nevertheless have the possibility to request a photocopy of certain files in his or her dossier. As the Federal Supreme Court stated in BGE 119 III 141, the handing over of written (including electronic) documents can be extremely significant for the person concerned. The oral communication of information, for example on the telephone, is also possible, provided the data subject has consented. Information in summarized (“aggregated”) form is not permitted.
Para. 3
Paragraph 3 adopts Article 1(2) of the Data Protection Act in an adapted form. It specifically regulates the form of transmission of the request for information and the provision of information. Thus, the request for information and the provision of information may also be made electronically. The data subject may submit his or her request, for example, by e‑mail or via an online platform of a company (e.g. the widespread customer accounts). According to the general rules, the sender bears the burden of proof that his or her message has reached the recipient. Since electronic transmission is also permitted without a legal basis, paragraph 3 is a declaratory provision.
Para. 4
If personal data are provided in a technical form, for example in a non-standard file format, that is not readable and/or understandable by the data subject, the data controller must be able to provide him or her with supplementary explanations, for example verbally.
Par. 5
The controller must take appropriate measures to ensure the identification of the data subject. The data subject must therefore cooperate in their identification. In order for the controller to be able to ensure the identification of the data subject, he needs the necessary information from the data subject. In the case of oral information, the person responsible shall ensure in advance (e.g. by providing the AHV no.) that he/she is providing the information to the correct person. Article 16 para. 5 Art. (former Art. 20 para. 4 E‑VDSG) replaces the requirement under Art. 1 para. 1 VDSG that the data subject must prove his identity.
Other aspects
Paragraph 4 of Article 1 FADP, which concerns the time limit for providing information, is converted into a stand-alone article (see Art. 18 Art., ex-Art. 22 Draft FADP below). The same applies to Article 1(5) and (6) of the FADP (see Art. 17 Art., former Art. 21 Draft FADP below).
Art. 17 Competence
1 If several data controllers process personal data jointly, the data subject may assert his or her right of access with each data controller
2 If the request relates to data processed by a processor, the processor shall assist the controller in providing the information, unless the controller is responding to the request on behalf of the controller.
Explanatory report
A separate article has been provided to clarify the responsibility in cases where several data controllers jointly process personal data.
Para. 1
Paragraph 1 takes over paragraph 5 of Article 1 of the Data Protection Act in an adapted form. From a terminological point of view, the term “data controller” has been replaced by “data processor”. The exception to the possibility of asserting the right of access with any data controller has been removed. Thus, the data subject may now always assert his or her right of access with any data controller. In contrast to Article 1(5) of the FADP, Article 17(1) no longer obliges data controllers to forward the requests; rather, they must provide information in any case. The paragraph corresponds to Article 21(2) of Directive (EU) 2016/680 and Article 26(3) GDPR.
Para. 2
Paragraph 2 adopts Article 1(6) of the FADP in an adapted form. The term “order processor” introduced in the nDSG (Art. 5 let. k nDSG) is adopted and the term “data controller” is replaced by “data controller”. According to Article 25(4) nDSG, the controller remains obliged to provide information even if he has the personal data processed by a commissioned processor. The processor is therefore not required by law to respond to requests for information himself. Therefore, in contrast to the VDSG, Article 17(2) Art. now provides that the order processor shall assist the controller in responding, provided that he does not respond to the request on behalf of the controller. This means that the processor must provide the data to the controller if the controller does not have it himself.
Art. 18 Time limit
1 The information must be provided within 30 days of receipt of the request
2 If the information cannot be provided within 30 days, the controller must inform the data subject thereof and indicate the period within which the information will be provided
3 If the person responsible refuses, restricts or postpones the information, he or she must notify the following within the same time limit
Explanatory report
Article 18 Art. (former Art. 22 E‑DPA) takes over the fourth paragraph of Art. 1 FADP without any significant change. It clarifies the paragraph 7 inserted by Parliament in Article 25 nDSG, which sets the 30-day period previously provided for in the ordinance at the level of the law. The specification that the decision on the restriction of the right of access must be justified has been deleted, as this provision has already been included in Article 26(4) nDSG. Furthermore, the term “applicant” is replaced by “data subject” so that the terminology is consistent with the nDSG.
In essence, the provision means that the data controller must provide the data subject with the requested information within 30 days or notify him or her within this period that he or she is refusing, restricting or deferring the information. In the public sector, the provision of information as well as the refusal, restriction or deferral of information is an order within the meaning of Article 5 VwVG . Paragraph 2 is only applicable if the data controller is unable to provide the information within 30 days of receipt of the request (and not in the case where he restricts the right to information within the meaning of Art. 26 nDSG): In that case, the responsible party must communicate in a timely manner, i.e. without unreasonable delay, the period within which the information will be provided.
Art. 19 Exception from free of charge
1 If the provision of the information involves a disproportionate effort, the controller may require the data subject to make a reasonable contribution to the costs incurred
2 The participation amounts to a maximum of 300 Swiss francs
3 The data controller must inform the data subject of the amount of the participation before providing the information. If the data subject does not confirm the request within ten days, it shall be deemed to have been withdrawn without incurring any costs. The time limit in accordance with Article 18 paragraph 1 begins to run after expiry of the ten-day cooling-off period
Explanatory report
The title of the provision is editorially changed compared to Article 2 of the Data Protection Act.
Para. 1
Article 2(1)(a) of the FADP, which concerns querulous requests for information, is repealed. Such cases are now regulated in the nDSG, which provides in Article 26(1)(c) that the controller may refuse, restrict or postpone the information if the request for information is obviously querulous.
Article 2(1)(b) and (2) of the Data Protection Act are taken over in a slightly adapted form. The term “exceptionally” is deleted, as the title of the article already refers to “exception”; the term “applicant” (new paragraph 3) is replaced by “data subject” for reasons of terminological consistency with the nDSG. The term “particularly heavy workload” is replaced by “disproportionate effort” so that the wording is consistent with the changes made by the National Council in Article 25(6) nDSG. For example, it does not constitute a disproportionate effort if the controller has to grant access to a large number of personal data if its interest is precisely to collect as much data as possible. The same applies if the workload is large because the data controller is not organized in a sufficiently structured manner (disregard of the principle of “privacy by design”; because according to this principle, data controllers or processors must have a system that allows easy access to the processed data).
Para. 2
The amount of 300 francs remains unchanged. According to the national consumer price index, the amount has changed only slightly since its introduction in the ordinance. Moreover, it is not intended to have a deterrent effect on the person concerned.
Para. 3
The person responsible must inform the data subject of the amount of the participation before providing the information. If the applicant does not confirm the request within ten days, it shall be deemed to have been withdrawn without incurring any costs. The time limit pursuant to Art. 18 para. (former Art. 22 para. 1 E‑VDSG) begins to run after the 10-day cooling-off period has expired.
Section 2: Right to issue or transfer data
Explanatory report
These articles specify which various requirements apply to the right to data surrender or transfer as introduced in Article 28 nDSG. In light of the fact that it was the legislator’s goal to create a similar regulation as in European law, the rules applicable in Article 20 GDPR on the right to data portability are taken into account.
On the one hand, the right to data disclosure or data transfer gives the data subjects the right, under certain conditions, to demand that the data subject discloses the personal data he or she has provided to the data controller in a form that can be reused.
The requested personal data can be used for various purposes: for example, for purely personal use (e.g., to store the data on a personal storage space), to forward it to another online service provider, or to change the platform.
The right to request the transfer of their personal data, on the other hand, gives data subjects the right to request that the data controller transfer that personal data directly to another data controller (e.g., so that a new online service provider can expand that personal data or offer new services to the data subject, or to maintain its own “history” in the event of a change of provider), provided that this does not require a disproportionate effort.
The right to disclosure or transfer of data must be distinguished from the right to information under Article 25 nDSG. The right of access entitles the data subject to request information from the controller as to what personal data the controller is processing about him or her. This enables the data subject to request the correction or deletion of his/her personal data in the event of unlawful data processing.
In contrast, the new right to data release or data transfer aims to strengthen the control of the data subjects over their personal data and over its further use. It thus allows them to dispose of the issued or transferred personal data themselves, to reuse it or to pass it on to other data controllers. In addition, this new right also makes it easier for the data subjects to switch between different offers, which also promotes competition and innovation.
For the responsible parties, this new requirement creates the obligation to make the requested personal data available in aggregated form within a reasonable time and to enable it to be embedded in a new system without disproportionate effort. This requires that they use common file formats and implement common, standardized data management systems so that the data can continue to be used.
The data controllers must take into account the principles of data protection law and their obligations under data protection law both when issuing the requested personal data and when transferring it.
Art. 20 Scope of the claim
1 Personal data that the data subject has disclosed to the data controller shall be deemed to be:
a. Data that it knowingly and willingly makes available to it;
b. Data collected by the data controller about the data subject and his or her behavior in the course of using a service or device.
2 Personal data generated by the data controller through its own evaluation of the personal data provided or observed shall not be deemed to be personal data that the data subject has disclosed to the data controller
Explanatory report
Para. 1
This provision specifies which personal data are covered by the entitlement to data surrender or transfer. The entitlement includes personal data relating to the data subject himself and processed automatically and on the basis of consent or in connection with a contract (Art. 28 para. 1 nDSG).
First and foremost, personal data that is stored in paper form is excluded from the claim.
The claim does not apply to data controllers who process personal data in the performance of a public task or in the public interest. This is in line with the provisions of Article 20(3) of the GDPR and the primarily economic purpose of the right to disclosure or transfer of data. Federal bodies that process personal data within the scope of their legal duties and on the basis of a legal foundation are therefore in principle not affected by the right to data surrender or transfer. However, if federal bodies process personal data in competition with private individuals, for example, it is conceivable that this personal data may be covered by the claim. In any case, it is up to the data controller to determine to which personal data it processes the claim could apply and which are excluded.
Furthermore, anonymized personal data or data that does not concern the data subject is not covered by the claim. Pseudonymized personal data that can be unambiguously linked to the data subject, on the other hand, are covered by Article 20(1). In practice, information that includes the personal data of several persons is likely to be affected in many cases, such as the account history of a customer or data on telephone calls or messages that contain information about third parties. In the context of a request for surrender or transfer of personal data, the applicant should also be provided with these records. However, the personal data of third parties may not be processed for purposes that affect their rights and freedoms. This would be the case if the new controller used the transferred personal data of third parties for its own purposes, for example, to offer its own services to them. On the other hand, there would be no interference if, in the case of a transfer of account information to a new bank account at the account holder’s request, the contact address in the account history of his bank account continues to be used for the same purpose, i.e. as a contact address and for his personal use.
Furthermore, only personal data that the data subject actively makes available to a data controller is covered by Article 20(1). According to letter a, this relates on the one hand to personal data that the data subject directly and knowingly provides to the data controller, such as his or her contact details via an online form or by making “likes”. According to letter b, the claim also includes personal data that the data subject generates indirectly, i.e. through his or her activities when using a service or device (knowingly or unknowingly), and which are observed by the data controller (so-called usage data or “observed” data, such as search queries, activity logs, website usage history).
The fact that these personal data are covered by the right to surrender and transfer is in line with the European regulation and the purpose of the standard in Article 28 nDSG, according to which the data subject should be able to demand the surrender and further use of the personal data he or she has made available to a data controller.
Para. 2
Paragraph 2 describes which personal data is not to be regarded as personal data disclosed by the data subject within the meaning of Article 28(1) nDSG. This regulation thus specifies the scope of the right to data disclosure or transfer. Accordingly, the claim does not cover personal data which a data controller derives from inferences from the personal data provided or observed by the data subject within the meaning of Article 20 (1) (a) and (b) itself or which is generated by its own analyses of such personal data. One can think, for example, of the assessment of a user’s state of health, user or risk profiles, credit risk analyses, etc. In contrast to the provided personal data, the services and investments of the controller here relate to the analysis and evaluation of the provided data and not to the collection and processing of the personal data.
The exemption of such personal data from the right to data surrender or transfer corresponds to the regulation in European law. Since the aim of this claim is to enable the data subject to make further use of his or her personal data, it seems justified to provide for an exception for such personal data which a controller generates by evaluating and using its own resources (own efforts, own investment, in-house algorithms and analysis procedures). In contrast to the personal data “provided” by the data subject pursuant to paragraph 1, in the case of personal data generated by the data controller, the data controller’s interest in protecting its own performance and investment must be given greater weight. Such personal data therefore do not fall within the scope of the right to disclosure or transfer.
However, within the framework of the right to information pursuant to Article 25 nDSG and the associated provisions of the Regulation (Art. 16 – 19 Art.), the data subject has the possibility to obtain information from the controller about this personal data, its processing purpose, its storage period and, in the case of automated individual decisions, about the logic on which this decision is based.
It is important to note that the provision in Article 20(2) should not be understood as a restriction from the right to data disclosure or transfer introduced in Article 28 nDSG, but rather serves to interpret the statutory provision by specifying the scope of the right.
Rather, based on the reference in Article 29(1) nDSG to Article 26(1) and (2) nDSG, the reasons provided for the restriction of the right of access also apply mutatis mutandis to the refusal, restriction or postponement of disclosure or transfer of personal data, for example to protect overriding interests of the controller (e.g. in the case of trade secrets or intellectual property) or to protect overriding interests of third parties. However, this should not lead to a refusal to disclose any information to the data subject. Rather, it must be determined on a case-by-case basis, as part of a proportionality test and weighing of interests, whether and which personal data is to be released to the data subject or transferred to another data controller.
If the controller refuses or restricts the surrender or transfer of personal data or postpones this, he is obliged to provide the data subject with reasons in accordance with Article 29 paragraph 2 nDSG.
Art. 21 Technical requirements for implementation
1 Common electronic formats are those that enable the personal data to be transferred with a reasonable effort and to be further used by the data subject or another controller
2 The right to issue or transfer data does not create an obligation for the data controller to adopt or maintain technically compatible data processing systems
3 A disproportionate effort for the transfer of personal data to another controller exists if the transfer is technically not possible
Explanatory report
Para. 1
This provision specifies what is to be regarded as a common electronic format within the meaning of Article 28(1) nDSG. These are namely those formats that enable the personal data to be transferred with a proportionate effort and to be further used by the data subject or another data controller.
Where personal data is not in a commonly readable format (especially proprietary or low-use formats), it must be converted by the data controller into a commonly used electronic format. The data formats should allow the data subject to upload their data in a standard computer-readable format directly from their personal account or area. Therefore, data formats that are appropriate for the type of data in question should be chosen. Preference should be given to open and interoperable formats such as XML and JSON for more comprehensive solutions, as well as CSV, ODT, ODS, etc., which in many cases are suitable for data output and transfer because they can be adopted by other responsible parties without significant compatibility issues. Data delivered in a format that is difficult to process (e.g., an image or PDF) or in a proprietary format, the use of which requires the purchase of software or a paid license, do not constitute a suitable format a priori.
Furthermore, the content of the transferred information should be precisely described with suitable and comprehensible metadata so that it can be meaningfully transferred to a new system. The data subjects and the responsible parties who take over the data as part of a data transfer must understand what type of data is involved. This metadata should be extensive enough to allow the data to be used and reused without disclosing trade secrets.
Para. 2
In accordance with European law, this provision specifies that the right of the data subject to request that personal data relating to him or her be transferred by the controller to another controller does not create an obligation for the controller to adopt or maintain technically compatible data processing systems.
Although the introduction of standards for data formats would be possible in principle, the most suitable format in each case is likely to differ depending on the industry and sector. Therefore, it seems sufficient to provide for the use of common formats without specifying these formats in more detail or even conclusively. From a technical point of view, it is necessary that the responsible parties create the conditions to be able to exchange personal data. In addition, it must be possible for the personal data exchanged to be used by the data subject or the new data controller. To this end, the data controller must make the personal data available in interoperable formats and describe them in a way that is comprehensible to the data subject and the new data controller by means of suitable metadata in order to enable their further use.
Para. 3
Paragraph 3 specifies when, within the meaning of Article 28(3) nDSG, a transfer requires a disproportionate effort and the controller is not obliged to transfer personal data to another controller at the request of the data subject. Again in line with European law, a proportionate effort for a transfer is to be assumed if it is technically possible and feasible.
Accordingly, the controller is obliged to transfer the personal data directly and in an interoperable format to another controller upon request of the data subject. Even if the other controller does not support this format, a direct data transfer can also take place if communication between two systems is possible in a secure manner and the receiving system is technically capable of receiving the incoming data. Whether a transmission is technically feasible must be checked on a case-by-case basis. It would also be conceivable for the controller to provide a secure application program interface (API) to enable the other controller to automatically retrieve the personal data. However, if direct data transfer is not possible due to technical obstacles, the controller must inform the data subject of these obstacles (Art. 29 para. 2 nDSG).
However, the data controller must not unjustifiably impede the transfer of the personal data by providing technical barriers that slow down or prevent data access, data transfer, or data reuse by the data subject or another data controller. This would be the case, for example, if data interoperability is not provided or access to a data format, programming interface, or format provided is not provided, if excessive delays occur or retrieval of the full data set is too complicated, if data is intentionally obfuscated, or if specific or unjustified sector-specific standardization or accreditation requirements are imposed.
Art. 22 Time limit, modalities and competence
Articles 16(1) and (5) and 17 – 19 shall apply mutatis mutandis to the right to issue or transfer data.
Explanatory report
As far as the modalities of the right to surrender or transfer data are concerned, various provisions on the right to information apply mutatis mutandis. This concerns the form in which the data subject may request the surrender or transfer of his or her personal data (Art. 16 para. 1 Art., formerly Art. 20 para. 1 E‑Data Protection Act), as well as the reasonable measures that must be taken to ensure the identification of the data subject (Art. 16 para. 5 Art., formerly Art. 20 para. 4 E‑Data Protection Act).
The provisions regulating responsibilities in the case of requests for information from several data controllers (Art. 17 para. 1 Art., formerly Art. 21 para. 1 E‑Data Protection Act) or in the case of data processing by a data processor (Art. 17 para. 2 Art., formerly Art. 21 para. 2 E‑Data Protection Act) also apply mutatis mutandis. It should be noted that personal data processed by commissioned processors are also subject to the right to data surrender or transfer. In this case, it is the responsibility of the data controller to create the technical and organizational solutions with which this right can be enforced. The commissioned processor must support the controller in fulfilling its obligations with regard to the right to data surrender or transfer (Art. 17 para. 2 Art., former Art. 21 para. 2 E‑Data Protection Act).
Finally, the provisions on time limits (Art. 18 Art., formerly Art. 22 Electronic Data Protection Act) and the exceptions to free of charge (Art. 19 Art., formerly Art. 23 Electronic Data Protection Act) in the case of requests for information also apply mutatis mutandis to the right to issue or transfer data.
Chapter 4: Special provisions on data processing by private persons
Art. 23 Data protection advisor
The responsible party must notify the data protection advisor:
a. Provide the necessary resources;
b. Grant access to all information, documents, records of processing activities and personal data required by the consultant to perform his or her duties;
c. grant the right to inform the highest management or administrative body in important cases.
Explanatory report
Article 10(2) nDSG regulates in a non-exhaustive manner two areas of responsibility of the data protection advisor of a private controller: He or she trains and advises the private controller on data protection issues (subparagraph (a)) and assists in the enforcement of data protection regulations (subparagraph (b)). Since these areas of responsibility are sufficiently specific from the law, they will not be defined again in the ordinance in the future, contrary to the consultation draft.
Letters a and b
These provisions correspond in substance to Article 12b(2)(b) and (c) of the Data Protection Act.
The list of documents to which the data protection advisor must have access has been adapted to the terminology in the nDSG. Access is not unrestricted, but only to those documents that the data protection advisor actually needs to fulfill his or her duties. In particular, access to personal data must only be granted if it is required for the performance of the task. If, for example, the data protection advisor is conducting a general review of internal data protection regulations or data processing processes, he or she will generally not need to have access to personal data.
On the other hand, Article 12b (2) (a) of the Federal Data Protection Act is not adopted because the requirement mentioned therein is newly provided for in the Act (Art. 10 (3) (a) of the Federal Data Protection Act).
Let. c
The data controller must grant the data protection advisor the right to inform the highest management or administrative body in important cases. This refers to the top management of the private controller, i.e., the body that is also responsible for compliance with data protection regulations. The provision establishes a right of escalation for the data protection advisor. This is necessary so that the data protection advisor, in the case of internal company audits of compliance with data protection rules, must not only trust the documents available to him or her, but can also enforce the procurement of additional information and documents. In addition, this ensures that the data protection advisor can report to the highest bodies of the controller or the commissioned processor in the event of complex circumstances and particularly serious violations and bring about a decision.
Repeal of Article 12a VDSG
This provision is repealed as its content has been newly included in the law (Art. 10 para. 3 let. b and c nDSG).
Art. 24 Exemption from the obligation to keep a register of processing activities
Companies and other organizations under private law that employ fewer than 250 employees on January 1 of any year, as well as natural persons, are exempt from the obligation to keep a register of processing activities, unless one of the following conditions is met:
a. Personal data requiring special protection is processed on a large scale.
b. High risk profiling is performed.
Explanatory report
Based on Article 12 nDSG, data controllers and data processors must each keep a register of their processing activities. This must contain some minimum information. For the directory of the controller, these are: the identity of the controller, the purpose of the processing, a description of the categories of data subjects and the categories of personal data processed, the categories of recipients, if possible the retention period of the personal data or the criteria for determining this period, as well as a general description of the measures to ensure data security in accordance with Article 8 nDSG, and, if the data are disclosed abroad, the indication of the state as well as the guarantees in accordance with Article 16 paragraph 2 nDSG (Article 12 paragraph 2 nDSG).
For some SMEs, keeping such a register may involve a disproportionate administrative burden compared to the potential risks that data processing entails for the personality of the data subjects. Since Article 12(5) nDSG requires the Federal Council to provide for exceptions for companies, including sole proprietorships, it is accordingly also authorized to apply these exceptions to natural persons and other legal entities such as associations and foundations. This seems appropriate because keeping the register could impose a disproportionate burden on them, as it does on SMEs.
Article 24 Art. (former Art. 26 E‑VDSG) thus concretizes Art. 12(5) nDSG by determining to whom these exemptions apply and in which cases the risks of personality violations within the meaning of this provision are low (see Dispatch, BBl 2017 7037). It provides that companies and other organizations under private law with fewer than 250 employees on January 1 of a year (regardless of the degree of employment), as well as natural persons, are exempt from the obligation to keep a register of processing activities. However, this only applies if personal data requiring special protection is not processed on a large scale (subparagraph a) and if no high-risk profiling is carried out (subparagraph b). The requirement of Article 24 letter a Art. thereby corresponds to Article 22 paragraph 2 letter a nDSG. In other words, only SMEs that perform certain high-risk data processing activities are required to keep a register of processing activities. The list of high-risk data processing activities in this provision is exhaustive. For the requirement in letter a, please refer to the explanations on the similarly structured requirement in Article 5 paragraph 1 letter a Art. (formerly Art. 4 para. 1 let. a Draft Data Protection Act) on the obligation of private persons to draw up processing regulations.
Extensive processing of data requiring special protection includes, in particular, data processing involving large quantities of data or a large number of persons.
SMEs that process data within the meaning of Article 24 letters a and b Art. only have to keep a register of processing activities for these data processing activities, but not for other data processing activities. Of course, SMEs that are exempt from the obligation are not prevented from voluntarily keeping a register of processing activities. Especially if a controller regularly processes personal data, it is a useful and simple tool to keep an overview of the processing activities, which can also facilitate the controller’s compliance with other obligations, such as the duty to inform.
Chapter 5: Special Provisions on Data Processing by Federal Bodies
Section 1: Data protection advisor
Explanatory report
Articles 25 – 28 Art. (former Art. 25 – 30 E‑VDSG) replace Art. 23 VDSG, which deals with the data protection advisor of federal bodies.
Art. 25 Appointment
Each federal body shall appoint a data protection advisor. Several federal bodies may jointly appoint a data protection advisor.
Explanatory report
Article 25 Art. implements Article 10(4) nDSG and Article 32 of Directive (EU) 2016/680. The provision whereby several federal bodies may jointly designate a data protection advisor is intended to enable smaller federal bodies or departments with a centralized organizational structure in particular to take advantage of meaningful and resource-saving synergies. On the other hand, larger federal offices, for example, can be expected to have a data protection advisor on their own. Of course, it is also open to the federal bodies to designate several advisors.
Art. 26 Requirements and tasks
1 The privacy consultant must meet the following requirements:
a. She or he has the required expertise.
b. He or she shall exercise his or her function vis-à-vis the federal body in a professionally independent manner and without being bound by instructions.
2 She or he must perform the following duties:
a. She or he shall cooperate in the application of the data protection rules, in particular by:
1. examines the processing of personal data and recommends corrective measures if a breach of data protection regulations is identified,
2. advises the controller on the preparation of the data protection impact assessment and reviews its execution.
b. She or he shall serve as a point of contact for affected individuals.
c. She or he shall train and advise the employees of the federal body on data protection issues.
Explanatory report
Para. 1
Article 26(1) Art. takes over in letter a the requirement of Article 12a(2) last sub-sentence VDSG. In letter b – as previously regulated in Article 12b (2) (a) of the Federal Data Protection Act and analogous to the regulation for private data controllers in Article 10 (3) (a) of the Federal Data Protection Act – it is now mandatory for all federal bodies (previously only those federal bodies had to meet the requirements of Article 12a and Article 12b of the Federal Data Protection Act that wished to be exempt from the obligation to register their data collections, see Article 23 (2) of the Federal Data Protection Act) that the data protection advisor performs his or her function in a professionally independent manner and not bound by instructions. This strengthens and institutionalizes the role of the data protection advisor in the federal bodies, which are usually hierarchical, so that he or she can perform his or her duties effectively. Admittedly, the role of the data protection advisor is merely advisory and supportive, and thus the potential for conflict with the responsible and superior bodies is to be regarded as reduced. Nevertheless, it must be ensured that the data protection advisor is free to make his or her recommendations – even if they are sometimes disagreeable in nature – without having to fear any disadvantages. Independence also implies that in important cases – as is explicitly provided for private individuals in Article 23(c) – the data protection advisor can appeal to the top management of the federal body. The independence of the data protection advisor must be ensured primarily by organizational measures: In particular, it must be prevented that the activity as data protection advisor can have a negative impact on the employee interview.
Para. 2
The tasks of the data protection advisor of the federal body in paragraph 2 have been terminologically aligned with the provision in the case of private data controllers (Article 10(3) nDSG). Paragraph 2(a) states that the data protection advisor, as already stated in Article 10(2)(b) nDSG, shall assist in the application of the data protection provisions. This includes, in particular, that he or she, in accordance with item 1, checks the processing of personal data and recommends corrective measures if a breach of the data protection regulations is identified; and in accordance with item 2, advises the data controller in the preparation of the data protection impact assessment and checks its execution. The involvement of the data protection advisor may help to reduce the burden on the FDPIC. The requirement in point 2. corresponds to Article 7(c) of Directive (EU) 2016/680. The data protection advisor is to be understood as an advisory and supporting body and not as a supervisory body. With regard to the review of processing operations and the recommendation of corrective measures, it should therefore be noted that the aim is not to introduce an active duty to review or to prescribe systematic checks of all data processing operations. Rather, it is sufficient for the data controller to become active if, for example, there are requests from the responsible bodies to check data processing or if he or she receives indications that data protection regulations have been violated. Of course, the data protection advisor is also free to proactively check. Furthermore, in accordance with paragraph 2 letter b, the data protection advisor serves as a point of contact for the data subjects, for example in the event of a request for information pursuant to Article 25 nDSG.
Art. 27 Duties of the federal body
1 The federal body has the following obligations towards the data protection advisor:
a. It shall grant him or her access to all information, documents, lists of processing activities and personal data that he or she requires to perform his or her duties.
b. It ensures that she or he is notified of a data breach.
2 It shall publish the contact details of the data protection advisor on the Internet and notify the FDPIC of these details.
Explanatory report
Article 27(1)(a) Art. (former Art. 29 para. 1 E‑DPA) is identical to the regulation for private data controllers in Article 22 letter b Art. (former Art. 25 para. 2 let. b Draft Data Protection Act). Here, therefore, reference can be made mutatis mutandis to the explanations there. If special legal bases prevent the data protection advisor from accessing certain information, in particular personal data, these take precedence in accordance with the general principle of lex specialis. If necessary, the personal data must be blacked out if the data protection advisor requires access to information containing personal data for the performance of his or her duties. According to Article 27(1)(b) Art. the federal body is now obliged to ensure that the advisor is informed about breaches of data security. This obligation can be ensured, for example, by the federal body obliging employees by means of instructions to inform the consultant in the event of a data security breach. The obligation does not only concern breaches that must be reported to the FDPIC on the basis of Article 24 nDSG, but relates to any data security breach. The data protection advisor advises the data controller on whether the breach is subject to a notification obligation within the meaning of Article 24 nDSG. However, the notification itself is the responsibility of the data controller: He or she decides whether and which breaches are reported to the FDPIC.
Paragraph 2 has been added and provides for an analogous regulation as in Article 10(3)(d) nDSG for private data controllers. This is intended to make it easier for data subjects to exercise their rights by making it possible to locate at least one professional contact person directly. It is not necessary to publish the name of the data protection advisor. It is sufficient, for example, to provide an e‑mail address of the technically responsible office. Furthermore, the contact details of the data protection advisor must also be communicated to the FDPIC.
Art. 28 Contact point of the FDPIC
The data protection advisor serves as a point of contact for the FDPIC for questions relating to the processing of personal data by the federal body concerned.
Explanatory report
Article 28 Art. (former Art. 30 E‑VDSG) takes over the meaning of Art. 23(3) VDSG in a more precise form. The wording has been adapted, however, as it was misunderstood as a restriction on contact. The federal bodies should remain free to communicate with the FDPIC via other bodies as well and not only via the data protection advisor. It is not the opinion that she or he acts as a liaison for the FDPIC, but as a point of contact, since she or he has the necessary expertise and internal knowledge in matters relating to the processing of personal data by the federal body’s own.
Section 2: Information requirements
Art. 29 Duty to provide information when disclosing personal data
The federal body shall inform the recipient of the timeliness, reliability and completeness of the personal data disclosed by it, insofar as this information is not apparent from the data itself or from the circumstances.
Explanatory report
This provision corresponds to Articles 12 and 26 of the FADP and concerns the reliability of the personal data disclosed. In addition to the “timeliness” and “reliability” of the personal data, Article 29 Art. (former Art. 15 E‑VDSG) now mentions “completeness”. To ensure data quality, the data must be up-to-date, reliable and complete (i.e. neither only partially available nor incomplete). The provision is thus aligned with Article 7(2) of Directive (EU) 2016/680. It supplements Article 6(5) nDSG.
Art. 30 Duty to provide information in the case of systematic acquisition of personal data
If the data subject is not obliged to provide information, the federal body responsible shall draw his or her attention to this fact in the event of a systematic acquisition of personal data.
Explanatory report
The regulation corresponds to the current Article 24 FADP: If the data subject is not obliged to provide information, the federal body responsible must point out to him that his provision of information is voluntary. In accordance with the provision of Article 24 FADP, this obligation also applies only to the systematic acquisition of personal data. It applies in particular to the area of statistics and research.
Section 3: Notification of projects for the automated processing of personal data to the FDPIC
Art. 31
1 The responsible federal body shall notify the FDPIC of the planned automated processing activities at the time of the decision to develop or approve the project
2 The notification must contain the information in accordance with Article 12 paragraph 2 letters a‑d FADP and the expected date of commencement of the processing activities
3 The FDPIC shall include this notification in the register of processing activities
4 The responsible federal body shall update the notification upon transition to productive operation or upon project termination
Explanatory report
Article 31(1) Art. stipulates that the responsible federal body must notify the FDPIC of the planned automated processing activities at the time of the project approval or the decision to develop. Compared to the subsidiary notification to the FDPIC under Article 20(2) of the FDPIC, which aims to examine the content of projects, the present notification, on the other hand, serves the purpose of providing the FDPIC with a mere overview of planned projects in which personal data are to be processed by automated means. First and foremost, the notification is intended to enable the FDPIC to obtain an overall picture of the planned projects and thus also to be able to optimize its resource planning in the area of advisory activities and monitoring of legislative projects. Secondarily, of course, this notification also serves the protection of privacy.
Since the projects are still at an early stage at the time of notification, the content of the notification under paragraph 2 is limited to a subset of the information required under Article 12(2) nDSG, namely letters a‑d. As with the notification of lists of existing processing activities under Article 12 nDSG, the FDPIC also includes notifications of planned processing activities in the register of processing activities under Article 56 nDSG. However, the information on the notification of planned processing activities is not published (see Art. 42 para. 2 Art.). The federal body responsible updates the entry in accordance with paragraph 4 when the project is successfully completed, i.e. when it goes into productive operation (or transfers the entry to a notification in accordance with Art. 12 para. 4 nDSG), or when the project is discontinued (i.e. the entry is deleted). The notification is therefore only “visible” to the FDPIC at the time of the project release or the decision to develop the project.
Section 4: Pilot testing
Art. 32 Indispensability of the pilot test
A pilot test is indispensable if one of the following conditions is met:
a. The fulfillment of a task requires technical innovations, the effects of which must first be evaluated.
b. The fulfillment of a task requires significant organizational or technical measures, the effectiveness of which must first be examined, especially in the case of cooperation between federal and cantonal bodies.
c. The fulfillment of a task requires that the personal data be accessible in the retrieval procedure.
Explanatory report
Based on Article 35 paragraph 1 nDSG, the Federal Council may authorize the automated processing of personal data requiring special protection or other data processing pursuant to Article 34 paragraph 2 letters b and c nDSG prior to the entry into force of a law in the formal sense if certain prerequisites are cumulatively met. One of these prerequisites is that a test phase prior to entry into force is indispensable for the practical implementation of the data processing, in particular for technical reasons. In order to reduce the regulatory density in Article 35 nDSG, the Federal Council has moved these clarifications from Article 17a paragraph 2 FADP to the ordinance.
Article 32 Art. determines in which cases a test phase is to be considered indispensable. It takes over Article 17a(2) FADP with some editorial changes. For example, the term “technical innovations” is to be understood as before: On the one hand, this includes the use of new technologies, but also the use of already known technology in a new environment or when implementing new solutions. The SwissCovid app can be taken as an example of this: Although it is based on already known technologies such as Bluetooth, these have never been used in a comparable solution. Only letter c is adapted: The wording now covers all retrieval procedures and no longer only those that create access for cantonal authorities. This restrictive wording was due to historical reasons, but it cannot be decisive who the addressees of the retrieval procedure are, but rather the technical aspect is in the foreground for the assumption of indispensability (cf. Art. 35 para. 1 let. c nDSG).
At least one condition according to letters a‑c must be fulfilled, which means in particular that a pilot test must not be used purely for reasons of time.
Art. 33 Procedure for the approval of the pilot test
1 Prior to consulting the interested administrative units, the federal body responsible for the pilot scheme shall set out how compliance with the requirements under Article 35 FADP is to be met and shall invite the FDPIC to submit its comments
2 The FDPIC issues an opinion on whether the licensing requirements under Article 35 FADP have been met. The federal body shall provide him with all documents necessary for this purpose, in particular:
a. a general description of the pilot test;
b. a report proving that the fulfillment of the tasks provided for by law requires processing in accordance with Article 34 paragraph 2 FADP and that a test phase is indispensable in the formal sense before the law comes into force;
c. a description of the internal organization and the data processing and control procedures;
d. a description of the security and data protection measures;
e. the draft of an ordinance regulating the details of processing, or the concept of an ordinance;
f. the planning of the various phases of the pilot test.
3 The FDPIC may request further documents and carry out additional investigations
4 The federal body shall inform the FDPIC of any important change affecting compliance with the requirements under Article 35 FADP. The FDPIC shall comment again if necessary
5 The opinion of the FDPIC must be attached to the application to the Federal Council
6 Automated data processing is governed by an ordinance
Explanatory report
This provision adopts Article 27 of the FADP with some editorial adjustments. The references are adapted to the nDSG where necessary. A new paragraph 6 has been added, in which it is stated – similar to the current Article 17a (3) FADP – that automated data processing will be regulated in an ordinance. This ensures the transparency of the pilot tests.
Art. 34 Evaluation report
1 The competent federal body shall submit the draft evaluation report to the FDPIC for comment to the Federal Council
2 It shall submit the evaluation report with the opinion of the FDPIC to the Federal Council.
Explanatory report
This provision takes over Article 27a of the VDSG.
Pursuant to Article 34 Art. the competent federal body shall submit the draft evaluation report to the FDPIC for its opinion. If it deems it necessary, the competent federal body shall adapt the evaluation report.
Section 5: Data processing for non-personal purposes
Art. 35
If personal data are processed for non-personal purposes, in particular research, planning and statistics, and at the same time for another purpose, the exceptions under Article 39 paragraph 2 FADP shall only apply to processing for the non-personal purposes.
Explanatory report
In order to ensure that the application of the exceptions under Article 39(2) nDSG does not go beyond the legal framework, the ordinance specifies that, in the case of data processing for non-personal purposes (e.g. for research, planning or statistics) that simultaneously serves another purpose, these exceptions are only applicable to processing for the purposes specified in Article 39 nDSG.
Chapter 6: Federal Data Protection and Information Commissioner
Art. 36 Headquarters and permanent secretariat
1 The seat of the FDPIC is located in Bern
2 Federal personnel legislation applies to the employment relationships of the employees of the permanent secretariat of the FDPIC. The employees are insured within the framework of the Confederation’s pension scheme with the Pension Fund of the Confederation
Explanatory report
This provision corresponds in principle to Article 30 VDSG.
Article 36 (1) Art. (former Art. 37 Para. 1 Electronic Data Protection Act) remains materially unchanged. However, the previous mention of the secretariat is dispensed with here, since the change in terminology from “Commissioner” to “FDPIC” already indicates that this means the authority as a whole and thus also includes the secretariat.
Article 36 para. 2 Art. (former Art. 37 para. 1 EDPA) regulates the employment relationship of the permanent secretariat of the FDPIC. In terms of content, the provision corresponds to the current Article 30 paragraph 2 FADP. However, compared to the current law, it contains (terminological) adjustments and an addition. Even after the total revision of the FADP, the Commissioner and the permanent secretariat of the FDPIC constitute a decentralised administrative unit without legal personality, which is administratively assigned to the Federal Chancellery (Art. 43 para. 4 second sentence nDSG, Art. 2 para. 1 let. e [BPG] , Art. 2 para. 3 of the Government and Administration Organisation Act of 21 March 1997 [RVOG] as well as Art. 8 para. 1 let. b in. in conjunction with Annex 1 letter A item 2.1.1 of the Government and Administration Organization Ordinance of November 25, 1998 [RVOV]). As before, the second sentence of Article 43(5) nDSG provides that the Commissioner himself/herself hires his/her staff and has certain powers within this framework. For example, the employment contracts of the FDPIC’s staff are signed by the Commissioner. However, the appointee is still not considered by the FDPIC’s secretariat to be an employer under personnel or pension law within the meaning of the CPC. According to Article 3 paragraph 1 letter a BPG, the employer is the Federal Council. The employment relationship of the employees of the permanent secretariat of the FDPIC therefore continues to be governed by federal personnel legislation in accordance with the first sentence of Article 36 paragraph 2 Art. Thus, the Federal Personnel Ordinance of 3 July 2001 (FPL), the FDF Ordinance of 6 December 2001 on the Federal Personnel Ordinance (FPL) and the Ordinance of 22 November 2017 on the Protection of Personal Data of Federal Personnel (FPL) continue to apply. In this regard, the current Article 30 paragraph 2 FADP merely undergoes a terminological adjustment (“employees of the permanent secretariat of the FDPIC” instead of “secretariat of the Commissioner” and “federal personnel legislation” instead of “federal personnel legislation […] as well as […] its enforcement provisions”). In addition, the second sentence of Art. 36(2) clarifies that the employees of the FDPIC’s permanent secretariat are insured under the Confederation’s pension scheme with the Confederation’s pension fund. This addition does not entail any material change, but merely explicitly states the pension law regulation for the permanent secretariat of the FDPIC that already existed (cf. Art. 32a para. 1 and Art. 32d para. 1 BPG). Accordingly, the staff remains insured in accordance with the provisions of the pension regulations of 15 June 2007 for the employees and pension recipients of the Federal Pension Fund (VRAB).
With regard to the employment relationship of the permanent secretariat of the FDPIC, the status quo will therefore be maintained for the time being. This is justified in particular because the administrative assignment to the Federal Chancellery allows the FDPIC to concentrate its resources on operational activities. Cooperation between the Federal Chancellery and the FDPIC is structured in such a way that the independence of the FDPIC remains guaranteed. Nevertheless, the question arises as to whether the Commissioner should have employer powers under personnel and pension law vis-à-vis the employees of the permanent secretariat. This question must be clarified at the earliest opportunity at the formal legal level. The coordinated review and adaptation of the special legal bases for the data of legal persons, which is to take place in the five years following the entry into force of the nDSG (cf. Art. 71 nDSG), could provide an opportunity to do so.
By contrast, the implementing provisions on the employment relationship of the Commissioner are not to be issued by the Federal Council but by the Federal Assembly. This is because the employment relationship of the appointee is now established upon election by the United Federal Assembly (Art. 43 para. 1 nDSG). As part of parliamentary initiative 21.443, the SPK‑N adopted a draft ordinance of the Federal Assembly on 27 January 2022 containing the implementing provisions on the employment relationship of the Commissioner. In addition, individual amendments to the nDSG are planned in this context. Parliament adopted the bills in the final vote on 17 June 2022.
Article 30 paragraph 3 of the FDPCA has not been retained, since the FDPIC now has an independent budget, which is conclusively regulated in Article 45 of the nDPA and in Article 142 paragraphs 2 and 3 of the Parliamentary Act of 13 December 2002 (nParlG).
Art. 37 Communication channel
1 The FDPIC communicates with the Federal Council via the Federal Chancellor. The latter shall forward the proposals, opinions and reports unchanged to the Federal Council
2 The FDPIC submits reports for the attention of the Federal Assembly via the parliamentary services
Explanatory report
Article 37 Art. largely represents an adoption of Article 31(1) and (1bis) of the Data Protection Act. Article 31(2) has not been incorporated into the Art. since it follows from the independence of the FDPIC and the fact that he is not bound by instructions anyway that the FDPIC can communicate directly with other administrative units. The deletion therefore does not lead to any substantive change. Compared to Article 31 of the Federal Data Protection Act, the first paragraph has been amended. The new wording is intended to clarify that the FDPIC can also contact the Federal Council on issues that are not on the agenda of a Federal Council meeting, for example by having opinions forwarded to it. Apart from this, the content of paragraph 1 remains unchanged because the Federal Chancellor must forward all communications to the Federal Council and has no room for maneuver in this regard. This also applies to the co-reporting procedure. In paragraph 2, only the wording has been slightly adapted; the substantive content, however, corresponds to Article 31 paragraph 1bis of the FADP.
Art. 38 Notification of decisions, guidelines and projects
1 The departments and the Federal Chancellery shall notify the FDPIC of their decisions in the area of data protection in anonymous form, as well as their guidelines
2 The federal bodies shall submit to the FDPIC all draft legislation relating to the processing of personal data, data protection and access to official documents.
Explanatory report
This provision corresponds, apart from terminological and systematic adjustments, to Article 32(1) of the FADP.
Paragraph 2: The FDPIC should be involved as early as possible. It must be consulted at the latest within the framework of the office consultation.
Art. 39 Processing of personal data
The FDPIC may process personal data, including personal data requiring special protection, in particular for the following purposes:
a. to carry out its supervisory activities;
b. to carry out its consulting activities;
c. to cooperate with federal, cantonal and foreign authorities;
d. for the performance of tasks within the scope of the penal provisions under the FADP;
e. to conduct conciliation proceedings and to issue recommendations in accordance with the Public Act of 17 December 2004 (Public Act);
f. to conduct evaluations in accordance with the BGÖ;
g. to carry out procedures for access to official documents in accordance with the Federal Law on Civil Procedure;
h. for the information of the parliamentary supervision;
i. for the information of the public;
j. to carry out its training activities.
Explanatory report
Under current law, Article 32(2) FADP states the purposes for which the FDPIC operates an information and documentation system. However, Article 57h RVOG, which was newly inserted as part of the total revision of the FADP, will in future state in general terms that the units of the federal administration operate electronic business management systems to manage their documents. In the future, it will therefore not be necessary to refer to the use of the business management system in the Art.
On the other hand, the purposes for which the FDPIC processes personal data are now regulated in more detail (para. 1). It may process personal data, including personal data requiring special protection, in particular for the following purposes: to carry out its supervisory activities (subpara. a), to carry out its advisory activities (subpara. b), to cooperate with federal, cantonal and foreign authorities (subpara. c), to perform its duties under the penal provisions of the FADP (subpara. d), to conduct conciliation proceedings and issue recommendations under the Federal Act of 17 December 2004 on the Principle of Public Access to Administrative Documents (FOPA) (subpara. e), to conduct evaluations under the FOPA (subpara. f), to conduct procedures for access to official documents under the FOPA (subpara. g), to inform parliamentary oversight (subpara. h), to inform the public (subpara. i), and to carry out its training activities (subpara. j).
Art. 40 Self-regulation
The FDPIC shall establish processing regulations for all automated processing operations; Article 6(1) shall not apply.
Explanatory report
Article 48 nDSG provides that the FDPIC must take appropriate measures to ensure that the data protection provisions within his authority are enforced in accordance with the law. The dispatch on the Data Protection Act specifies that the Federal Council has the task of specifying the measures to be taken by the FDPIC in the ordinance (BBl 2017 6941, 7089).
According to Article 40 Art., the FDPIC is expected to draw up processing regulations for all automated processing carried out by him, and not only in the cases mentioned in Article 6(1) Art. such as the processing of particularly sensitive personal data or profiling. Even if this is not explicitly stated (unlike still in Art. 41 para. 2 of the Electronic Data Protection Act), the FDPIC, like other federal bodies which are obliged to draw up processing regulations (cf. Art. 6 Art.), must provide for internal processes which ensure that its data processing operations are carried out in accordance with the processing regulations, and must verify compliance with the processing regulations.
Art. 41 Cooperation with the NCSC
1 The FDPIC may forward a data breach notification to the National Cyber Security Center (NCSC) for analysis of the incident with the consent of the responsible party subject to the notification. The notification may contain personal data
2 The FDPIC shall invite the NCSC to submit its comments before ordering the federal body to take the precautions pursuant to Article 8 FADP.
Explanatory report
In order for the FDPIC to be able to involve the technical specialists in the analysis of a data security breach which has occurred and which has been reported to him by the data controller on the basis of Article 24 nDSG and Article 15 Art. (former Art. 19 e‑Data Protection Act), the technical specialists of the NCSC can be involved, Article 41 paragraph 1 Art. (former Art. 42 Electronic Data Protection Act) provides that the FDPIC may forward the information on the notification of a data breach to the NCSC. The forwarding may contain any information pursuant to Art. 15(1) Art. but at the same time must be limited to the data necessary for the NCSC to analyze the incident. In this regard, the communication from the FDPIC to the NCSC may also contain personal data. It is a prerequisite that the person responsible, who is obliged to notify the FDPIC, has given his prior consent to the forwarding. Furthermore, the forwarding must not lead to the circumvention of Article 24 paragraph 6 nDSG, according to which the report may only be used in the context of criminal proceedings with the consent of the person obliged to report. Article 41(1) Art. does not allow the FDPIC to systematically forward reports to the NCSC. Rather, the FDPIC may only make use of this possibility in individual cases where the technical expertise of the NCSC is necessary for the clarification of an incident. The provision is to be transferred to the legislative level at the earliest opportunity. For this reason, a new Article 24 paragraph 5bis nDSG is provided for in the annex to the preliminary draft amendment to the Information Security Act of 18 December 2020 (ISG), which the Federal Council sent out for consultation on 12 January 2022. This will also regulate the disclosure by the FDPIC to the NCSC of particularly sensitive personal data relating to administrative and criminal prosecutions or sanctions of the responsible party subject to the reporting obligation. If and when the new Article 24(5bis) nDSG enters into force, Article 41(1) Art. may be repealed again.
Article 41(2) Art. states that the FDPIC and the NCSC shall coordinate in overlapping areas of activity. The standard corresponds in principle to Article 20(3), second sentence, of the Data Protection Act. The FDPIC is required to invite the NCSC to give its opinion before ordering the federal body to take the precautions under Article 8 nDSG. The legal basis for such an order is 51(3)(b) nDSG. The aim is in particular to ensure that the FDPIC and the NCSC do not impose different requirements on federal bodies in the same area. However, the independence of the FDPIC remains guaranteed, since he is only required to obtain the opinion, but not also to take it into account.
Art. 42 Register of processing activities of federal bodies
1 The register of processing activities of federal bodies contains the information provided by federal bodies in accordance with Article 12 paragraph 2 FADP as well as Article 31 paragraph 2 of this Ordinance
2 It shall be published on the internet. The register entries on planned automated processing activities in accordance with Article 31 shall not be published.
Explanatory report
Based on Article 12 paragraph 4 nDSG, the federal bodies must report their lists of processing activities to the FDPIC. The latter, in turn, is required by Article 56 nDSG to keep a register of the processing activities of federal bodies and to publish it.
Article 42(1) Art. specifies what the FDPIC’s register must contain, namely the information that federal bodies must provide pursuant to Article 12(2) nDSG. In addition, the register also contains the information on the planned automated processing activities of the federal bodies pursuant to Article 31(2) Art.
The second paragraph specifies that the register of the FDPIC must be published on the internet. The register entries on the planned automated processing activities of the federal bodies pursuant to Article 31 Art. are not published, as these cannot yet be considered definitive at the time of their registration or could still be subject to changes.
Art. 43 Codes of conduct
If a code of conduct is submitted to the FDPIC, the FDPIC shall state in its opinion whether the code of conduct meets the requirements of Article 22(5)(a) and (b) FADP.
Explanatory report
Based on Article 22(5) nDSG, the private controller may refrain from drawing up a data protection impact assessment if it is certified under Article 13 nDSG or if it complies with a code of conduct under Article 11 nDSG that meets certain requirements. If a code of conduct is submitted to the FDPIC, the FDPIC shall indicate in its opinion whether, in its view, the requirements are met to refrain from preparing a data protection impact assessment. This provision specifies that a controller who wishes to waive a data protection impact assessment must submit its code of conduct to the FDPIC and the latter must have the opportunity to assess the code. It is not a matter of approval, but if a controller, contrary to the opinion of the FDPIC, wishes to make use of the exception under Article 22(5)(a‑c), the FDPIC may, on the basis of Article 51(3)(d) nDSG, order the controller to carry out a data protection impact assessment.
Art. 44 Fees
1 The fees charged by the FDPIC are calculated on the basis of the time spent
2 An hourly rate of 150 to 250 Swiss francs applies, depending on the function of the executing personnel.
3 In the case of services of exceptional scope, particular difficulty or urgency, surcharges of up to 50 percent of the fee in accordance with paragraph 2 may be levied
4 If the service provided by the FDPIC can be further used by the person liable to pay the fee for commercial purposes, surcharges of up to 100 percent of the fee pursuant to paragraph 2 may be levied
5 In all other respects, the General Ordinance on Fees of September 8, 2004 shall apply.
Explanatory report
Based on Article 59 (1) nDSG, the FDPIC must charge fees for certain services it provides to private individuals. These include the opinion on a code of conduct (subpara. a), the approval of standard data protection clauses and binding corporate data protection regulations (subpara. b), the review of the data protection impact assessment (subpara. c), precautionary measures and measures under Article 51 nDSG (subpara. d) and consultations on data protection issues (subpara. e).
Article 59 paragraph 2 nDSG mandates the Federal Council to determine the amount of the fees.
Article 44 para. 1 Art. (former Art. 44 para. 1 E‑VDSG) establishes the principle that the fees are calculated according to the time spent. According to paragraph 2, an hourly rate of 150 – 250 francs applies depending on the function of the executing personnel. The amount is based on the hourly rate of the personnel of the required function to be able to provide the service. The FDPIC thus calculates the fees on the basis of the hours spent by the executing personnel. Any persons who have contributed to the provision of the service must be included in this calculation. Pursuant to paragraph 3, the FDPIC has the option of levying surcharges of up to 50 percent of the fee pursuant to paragraph 2 in the case of a service of exceptional scope, particular difficulty or urgency. The regulation specifies the general requirement of Article 5 paragraph 3 of the General Fees Ordinance of 8 September 2004 (AllgGebV). In the event that the service provided by the FDPIC can be further used by the person liable to pay the fee for commercial purposes, the FDPIC may levy surcharges of up to 100 percent of the fee pursuant to paragraph 2 in accordance with paragraph 4. For example, if the FDPIC assesses a tool that can be resold by the person making the request as a data protection-compliant application, the FDPIC should have the option of increasing the fee so that it roughly corresponds to the hourly wage of a specialized lawyer. The decisive factor here is whether the service is suitable for further use for commercial purposes, regardless of whether this actually happens. The regulation pursuant to paragraph 4 concerns in particular the case of advice within the meaning of Article 59 paragraph 1 letter e nDSG. Nevertheless, it is also conceivable that the FDPIC will assess standard data protection clauses or codes of conduct that can be further used for commercial purposes, e.g. because they can be used as a prototype for other standard data protection clauses or codes of conduct. Paragraph 5, moreover, declares the AllgGebV applicable. For its part, the AllgGebV regulates in particular the principles of charging fees, exemptions from the obligation to charge fees, and the collection procedure.
Chapter 7: Final Provisions
Art. 45 Repeal and amendment of other enactments
The repeal and amendment of other enactments are governed by Annex 2.
Explanatory report
Since the provisions on the repeal and amendment of other enactments together comprise more than one printed page, they are listed in an appendix. The repeal and amendment of other enactments are commented on in section 7.
Art. 46 Transitional provisions
1 For data processing operations that do not fall within the scope of Directive (EU) 2016/680, Article 4(2) shall apply at the latest three years after the entry into force of this Regulation or at the latest at the end of the life cycle of the system. In the meantime, these processing operations shall be subject to Article 4(1)
2 Article 8(5) does not apply to assessments carried out before the entry into force of this Regulation
3 Article 31 does not apply to planned automated processing activities for which project approval or the decision to develop the project has already been made at the time of entry into force of this Ordinance
Explanatory report
Article 4(2) obliges the responsible federal bodies and their commissioned processors to log the automated processing of personal data. For data processing falling within the scope of Directive (EU) 2016/680, the logging obligation has applied since the entry into force of the Schengen Data Protection Act due to the requirement of Article 25 of the said Directive. Various federal bodies have pointed out an additional effort in connection with the implementation of Article 4(2) Art. In order to take account of this additional effort, Article 46(1) provides for a transitional period of three years from the entry into force of the Regulation or, at the latest, after the end of the life cycle of the system, for the remaining data processing operations. During this period, Article 4(1) of the Regulation applies to these data processing operations.
Article 8(5) Art. introduces the obligation to publish appraisals. Article 46(2) specifies that the assessments carried out before the entry into force of the Regulation shall not be published.
According to Article 31 Art., federal bodies must now notify the FDPIC of their planned automated processing activities at the time of the project approval or the decision on project development. Paragraph 3 therefore stipulates by way of transitional law that Article 31 Art. does not apply to planned automated processing activities for which the project approval or the decision on project development has already taken place at the time the ordinance enters into force.
Art. 47 Entry into force
This Ordinance shall enter into force on September 1, 2023.
Attachments
Annex 1 (Art. 8 par. 1)
19.
1 Germany*
2 Andorra***
3 Argentina***
4 Austria*
5 Belgium*
6 Bulgaria***
7 Canada*** Adequate data protection is deemed to be ensured if the Canadian federal law “Loi sur la protection des renseignements personnels et les documents électroniques” of April 13, 2000 applies in the private sector or the law of a Canadian province that largely corresponds to this federal law. The federal law applies to personal information obtained, processed or disclosed in the course of commercial activities, whether by organizations such as associations, partnerships, individuals or unions, or federally regulated entities such as plants, works, enterprises or business activities that fall within the legislative jurisdiction of the Parliament of Canada. The provinces of Québec, British Columbia, and Alberta have enacted legislation that is broadly similar to the federal law; the provinces of Ontario, New Brunswick, Newfoundland and Labrador, and Nova Scotia have enacted legislation that is broadly similar to that law in the area of health information. In all Canadian provinces, the federal law applies to all personal data obtained, processed or disclosed by federally regulated entities, including data about employees of those entities. The federal law also applies to personal data transferred to another province or country in the course of commercial activities
8 Cyprus***
9 Croatia***
10 Denmark*
11 Spain*
12 Estonia*
13 Finland*
14 France*
15 Gibraltar***
16 Greece*
17 Guernsey***
18 Hungary*
19 Isle of Man***
20 Faroe Islands***
21 Ireland***
22 Iceland*
23 Israel***
24 Italy*
25 Jersey***
26 Latvia*
27 Liechtenstein*
28 Lithuania*
29 Luxembourg*
30 Malta*
31 Monaco***
32 Norway*
33 New Zealand***
34 Netherlands*
35 Poland*
36 Portugal*
37 Czech Republic*
38 Romania***
39 United Kingdom**
40 Slovakia*
41 Slovenia*
42 Sweden*
43 Uruguay***
The data protection adequacy assessment includes the disclosure of personal data in accordance with Directive (EU) 2016/680.
* The data protection adequacy assessment includes the disclosure of personal data in accordance with an implementing decision of the European Commission determining data protection adequacy under Directive (EU) 2016/680.
** The assessment of the adequacy of data protection does not include the disclosure of personal data in the context of the cooperation provided for by Directive (EU) 2016/680.
Explanatory report
Based on Article 16 paragraph 1 nDSG, the Federal Council is responsible for this and has the task of assessing which state (or which territory or which specific sector of a state) and which international body guarantees an adequate level of protection for the disclosure of personal data abroad.
A list of states is published in the annex to the regulation. The aim of this list is to create a single space in terms of data protection. The list will be reviewed regularly to take into account, on the one hand, the practice of other states and, on the other hand, developments at the international level, in particular the ratifications of the revised Convention ETS 108. Consequently, the list is not final and could still be modified before the entry into force of the Regulation.
The data protection adequacy assessment includes the disclosure of data for law enforcement purposes only if this is indicated in the Annex. For example, one asterisk means that the adequacy assessment includes the disclosure of personal data in accordance with Directive (EU) 2016/680, while two asterisks means that it includes the disclosure of personal data in accordance with an implementing decision of the European Commission determining the adequacy of data protection in accordance with Directive (EU) 2016/680 (this currently applies to the United Kingdom). Finally, three asterisks mean that the data protection adequacy assessment does not include the disclosure of personal data in the context of the cooperation provided for by Directive (EU) 2016/680.
18. states, territories, specific sectors in a state and international bodies with adequate data protection