It is the most dis­cus­sed inno­va­ti­on of the revi­sed Data Pro­tec­tion Act in data pro­tec­tion cir­cles: the new penal­ty pro­vi­si­ons. The­re is a gre­at deal of uncer­tain­ty, and many com­pa­nies – and their employees invol­ved in data pro­tec­tion – are won­de­ring how the risk of cri­mi­nal lia­bi­li­ty can be “mana­ged” in cor­po­ra­te practice.

As a remin­der, if data pro­tec­tion regu­la­ti­ons are vio­la­ted, under the new Data Pro­tec­tion Act, unli­ke the GDPR, it is not the com­pa­nies that are punis­hed, but the peo­p­le acting on their behalf. With a fine of up to CHF 250,000, under cer­tain cir­cum­stances com­bi­ned with an ent­ry in the cri­mi­nal record (alt­hough this is only visi­ble to the aut­ho­ri­ties). Only deli­be­ra­te action is punis­ha­ble, which inclu­des not only the deli­be­ra­te com­mis­si­on of the act, but also the accep­tance of the act. In most cases, a cri­mi­nal com­plaint by an affec­ted per­son is requi­red for the pro­se­cu­ti­on aut­ho­ri­ties to take action. The request can be made by a data sub­ject, but not by the FDPIC.

Pen­al­ties are impo­sed in par­ti­cu­lar on the obli­ga­ti­ons to pro­vi­de infor­ma­ti­on and dis­clo­sure, to ensu­re appro­pria­te data secu­ri­ty, and to com­ply with the obli­ga­ti­ons when using con­tract pro­ces­sors and when trans­fer­ring data abroad. Vio­la­ti­ons of other obli­ga­ti­ons, on the other hand, go unpu­nis­hed. For exam­p­le, the­re is no penal­ty for fai­ling to report a data breach, fai­ling to main­tain a pro­ce­s­sing direc­to­ry or fai­ling to con­duct a data pro­tec­tion impact assess­ment despi­te high risks. The sel­ec­tion of duties sub­ject to punish­ment is quite ran­dom and at best reflects only in part the wrongful­ness of the breach of duty.

Many stra­te­gies, but no sil­ver bullet

So what pre­cau­ti­ons can be taken with regard to the new cri­mi­nal regime? The best pro­tec­tion against cri­mi­nal pro­ce­e­dings is, of cour­se, com­pli­ance with data pro­tec­tion law. Anyo­ne who com­plies with the law has not­hing to fear. The only thing is that data pro­tec­tion law is now so com­plex and so strict that it is dif­fi­cult to com­ply ful­ly with all the regu­la­ti­ons at all times. Con­side­ra­ti­ons must the­r­e­fo­re go bey­ond efforts to ensu­re com­pli­ance as best as possible.

In prac­ti­ce, the fol­lo­wing stra­te­gies, among others, have emer­ged in deal­ing with the new penal­ty provisions:

  • Insu­rance: Many com­pa­nies alre­a­dy have D&O insu­rance or insu­rance against cyber risks. The idea of exten­ding the insu­rance covera­ge to the new fines under data pro­tec­tion law seems obvious. Howe­ver, the pre­vai­ling view is that the fines under the new data pro­tec­tion law are of a high­ly per­so­nal natu­re as cri­mi­nal sanc­tions and are the­r­e­fo­re not insura­ble. Accor­ding to the wide­spread opi­ni­on, an insurer would even be guil­ty of aiding and abet­ting and would thus its­elf be lia­ble to pro­se­cu­ti­on. Only (but at least) the cri­mi­nal defen­se and pro­ce­du­ral costs are insura­ble, which are alre­a­dy inclu­ded in the scope of covera­ge of many com­mon D&O insu­rance policies.
  • Employer assump­ti­on of fines: In effect, it comes clo­se to an insu­rance poli­cy if the com­pa­ny pro­mi­ses its employees to pay any fines. Some com­pa­nies are appar­ent­ly con­side­ring this step, but most are reluc­tant. Com­pa­nies expect their employees to com­ply with appli­ca­ble laws. Incen­ti­ves should be crea­ted for legal­ly com­pli­ant beha­vi­or, not for vio­la­ti­ons of the law. Moreo­ver, cri­mi­nal lia­bi­li­ty under the new data pro­tec­tion law pre­sup­po­ses intent by defi­ni­ti­on, and what com­pa­ny would want to hold its employees harm­less if they deli­bera­te­ly act unlawful­ly? (In prac­ti­ce, howe­ver, con­tin­gent intent, which is also punis­ha­ble, is clo­ser to negli­gence than to the clas­sic “know­ledge and intent” of the act). In addi­ti­on, the­re is a wide­spread view that the assump­ti­on of the fine fails becau­se of the high­ly per­so­nal natu­re of cri­mi­nal sanctions.
  • Shar­pe­ning decis­i­on paths: The­re is a wide­spread desi­re to shar­pen the orga­nizati­on and crea­te clear decis­i­on-making struc­tures. The goal is to cle­ar­ly defi­ne for ever­yo­ne invol­ved whe­re decis­i­ons are made and who only crea­tes decis­i­on-making bases but does not make decis­i­ons them­sel­ves. This crea­tes cla­ri­ty about respon­si­bi­li­ties. Most com­pa­ny data pro­tec­tion offi­cers will want to make it clear that data pro­tec­tion offi­cers or data pro­tec­tion advi­sors only have an advi­so­ry func­tion, not a decisi­ve one. The­se decis­i­on-making struc­tures should also be reflec­ted in the rele­vant job and func­tion descrip­ti­ons. In addi­ti­on, DPO pro­vi­si­ons and simi­lar flan­king regu­la­ti­ons can fur­ther con­so­li­da­te the defi­ned respon­si­bi­li­ties. – The oppo­si­te stra­tegy, by the way, would be to deli­bera­te­ly crea­te dif­fu­se decis­i­on-making struc­tures and make it as dif­fi­cult as pos­si­ble for law enforce­ment agen­ci­es to iden­ti­fy the per­son respon­si­ble. This would be done in the hope that the law enforce­ment aut­ho­ri­ties would make use of the opti­on pro­vi­ded in the law to punish the busi­ness instead of the natu­ral per­son. Even if this stra­tegy could well lead to the desi­red result, it can­not be serious­ly advi­sed to deli­bera­te­ly con­ce­al responsibilities.
  • Docu­men­ta­ti­on: One pie­ce of advice often heard is to docu­ment as much as pos­si­ble. Risk decis­i­ons in par­ti­cu­lar should be com­pre­hen­si­ve­ly docu­men­ted and thus made com­pre­hen­si­ble. This may not always pre­vent vio­la­ti­ons of data pro­tec­tion regu­la­ti­ons, but it should at least make it dif­fi­cult to con­clude that the actions were inten­tio­nal. On the other hand, docu­men­ta­ti­on also has the poten­ti­al to back­fi­re: if it is docu­men­ted that a data pro­tec­tion vio­la­ti­on was deli­bera­te­ly accept­ed, then it is as good as pro­ven that the action was intentional.
  • Desi­gna­ted Risk Taker: One of the more ori­gi­nal approa­ches is to desi­gna­te a “Desi­gna­ted Risk Taker” to whom the sanc­tion risks are chan­ne­led as much as pos­si­ble. The advan­ta­ge of this approach is that the sanc­tion risk beco­mes “mana­geable” through clear allo­ca­ti­on. The risks can be asses­sed and com­pen­sa­ted. The cons­truct deri­ved from the finan­cial indu­stry is an inte­re­st­ing thought expe­ri­ment, but in prac­ti­ce the approach is hard­ly prac­ti­ca­ble. Cri­mi­nal lia­bi­li­ty is based on actu­al cir­cum­stances and decis­i­on-making struc­tures, not on desi­gned allo­ca­ti­ons. Moreo­ver, one must have a very risk-aver­se dis­po­si­ti­on to make ones­elf available as a “desi­gna­ted risk taker.”

A dis­ser­vice to data protection

The abo­ve over­view shows that the­re is no patent reme­dy for deal­ing with the new cri­mi­nal pro­vi­si­ons. The risk of cri­mi­nal lia­bi­li­ty under the revi­sed Data Pro­tec­tion Act is a rea­li­ty and can neither be insu­red nor “orga­ni­zed away”. Howe­ver, it is wort­hwhile to deal with the penal pro­vi­si­ons and come up with a stra­tegy. Shar­pe­ning the orga­nizati­on and decis­i­on-making struc­tures and con­sist­ent­ly docu­men­ting risk decis­i­ons are cer­tain­ly good start­ing points. The­re is still some time left. It will still be about a year befo­re the revi­si­on comes into force.

Howe­ver, the first effects of the new penal pro­vi­si­ons can alre­a­dy be obser­ved today. Com­pa­nies report that the­re has been a noti­ceable decli­ne in the wil­ling­ness to take on a data pro­tec­tion-rela­ted func­tion in a com­pa­ny. One rea­son is the fear of expo­sing ones­elf to the risk of cri­mi­nal sanc­tions. This is a war­ning sign: Func­tio­ning data pro­tec­tion orga­nizati­ons are built on decen­tra­li­zed data pro­tec­tion func­tions in the busi­ness units. If the­se can­not be staf­fed as desi­red, effec­ti­ve data pro­tec­tion beco­mes dif­fi­cult. The new penal pro­vi­si­ons do a dis­ser­vice to the core con­cerns of data protection.

Mat­thi­as Glatt­haar is Head of Data Pro­tec­tion and Data Pro­tec­tion Offi­cer at the Fede­ra­ti­on of Migros Coope­ra­ti­ves. He gives his per­so­nal opinion.