Take-Aways (AI)
- The EU GDPR affects practically all Swiss companies with EU customers and causes considerable bureaucratic implementation issues.
- It remains unclear which body is the point of contact for Swiss companies (FDPIC, EU authority or both) and who receives reports.
- It remains to be seen whether investigations, sanctions or double prosecutions by Swiss and EU authorities are possible and how they will be coordinated.
- Questions regarding the recognition of Swiss certifications, participation in standards and the role of Swiss law remain unresolved; Federal Council to initiate negotiations.
Interpellation Fiala (17.4088): Implementation issues regarding the EU General Data Protection Regulation [Cf. also Motion Fiala 16.3752 and Question Fiala 17.5528]
Submitted text
There is hardly a Swiss company that is not affected by the EU’s new General Data Protection Regulation (GDPR), which will become applicable in the EU on May 25, 2018. The regulation is forcing all companies that have customers in the EU to undergo massive bureaucratic efforts. However, many questions regarding the concrete implementation are still open and should be answered by the Federal Council:
- Will the EU continue to recognize the equivalence of Swiss data protection legislation?
- Who is the Contact for Swiss companies (e.g. for notification obligations) regarding the GDPR and e‑DSG? Is this the FDPIC, a body in the EU or even both?
- Become Investigations and possible sanctions carried out vis-à-vis Swiss companies by a Swiss body? How and by whom?
- Can companies for the same case sanctioned by Switzerland as well as by the EU. become?
- Can companies From the EU or their member states are sanctioned even though they comply with Swiss law?
- Become Swiss certifications and certification bodies recognized by the EU?
- Is Switzerland in the Development of standards involved?
- The GDPR refers in many places to the Law of the member states. What role does Swiss law play in this?
- These questions show that there is a great need for coordination even before the revision of the DPA is discussed in parliament. For this reason, the Federal Council was instructed by the motion 16.3752, which was passed, to seek a corresponding agreement with the EU. According to the answer to my Question 17.5528 During question time on December 4, the Federal Council stated that it did not want to contact the European Commission before the parliamentary consultation. However, the above-mentioned questions will already arise for many Swiss companies in May 2018. Furthermore, these implementation questions are also very valuable, especially for the consultation of the Swiss DPA. What steps does the Federal Council intend to take in order to regulate this need for coordination as quickly as possible under state treaty law?