Take-Aways (AI)
- Council of States confirms blanket classification of all genetic data as personal data worthy of special protection; National Council’s pre-categorization rejected.
- Council of States adopts Commission proposal for “high-risk profiling” – definition includes data links to assess key aspects of personality.
- Three of four points of difference unresolved; it is unclear whether it will be enough to settle the differences or whether a settlement conference will be necessary.
Today, June 2, 2020, the Council of States has continued, but not completed, the resolution of differences:
- Art. 4 lit. c No. 3 (genetic data as personal data requiring special protection): Approval of the Commission’s proposal and thus of the Federal Council’s original draft: as personal data requiring special protection, all “genetic data”; the clarification requested by the National Council, according to which “only” such genetic data are considered to be particularly worthy of protection “.that uniquely identify a natural person”, was not followed.
- Art. 4 lit. fbis (Profiling with high risk): Agreement with the Commission’s proposal, i.e. orientation towards today’s personality profile – the definition would thus be as follows: “profiling which involves a high risk to the personality or fundamental rights of the data subject by leading to the combination of data allowing an assessment of essential aspects of the personality of a natural person”; no cleanup followed here either.
- Art. 17 par. 2 lit. d and e (Scope of the duty to inform regarding “list of their rights” and “where applicable, the controller’s intention to process personal data for the purpose of checking the creditworthiness of the data subject and to disclose it to third parties”): Consent to the National Council (Differenzbereinigung), deletion of these two points.
- Art. 27 Para. 2 lit. c No. 3 (Maximum age of raw data for credit checks): Approval of the Commission’s proposal and thus of the Federal Council’s original draft; an overriding interest of the data controller in the sense of a justification reason thus only exists if the raw data are not older than 5 years. The National Council was not followed here either.
The updated flag is here retrievable.
Thus, there is still no agreement between the two chambers on three of the four points mentioned. It therefore remains to be seen whether the remaining points can be settled in the procedure for settling differences or whether there will ultimately be a settlement conference (after three rounds of settlement; consisting of representatives of both chambers).