Question 1

General Information

Accepted Answer

Applicable provisionsAs with most countries, Switzerland regulates the processing of personal data by general legislation and provides for stricter or different rules in sector-specific regulation. Data processing is governed primarily bythe Federal Data Protection Act (FDPA), andits ordinances in their current form, including the Ordinance to the Federal Act on Data Protection (FDPO). The FDPO contains more detailed provisions about transfers abroad and rules about the subject access right. A less relevant ordinance is the Ordinance on Data Protection Certification.In addition, a number of provisions in other laws restrict or permit processing personal data, in particular in the public sector (for example mandatory health insurance or homeland security) and in regulated markets (for example telecommunication or banking and finance). These laws include:the Telecommunication Act, which regulates the use of cookies and other data stored on user devices and restricts the use and disclosure of telecommunication data by telecommunications service providers (including providers of over-the-top (OTT) services), and requires them to take measures to prevent unsolicited e-mail marketing;the Federal Act on the Surveillance of Post and Telecommunications (FSPTA), which includes retention and cooperation obligations for providers of OTT services and may require them to identify their users;the Code of Obligations, which restricts the processing of employee data;the Unfair Competition Act, which governs unsolicited e-mail advertisement and other forms of electronic commercial communications (but not banner ads and other ads displayed for example in a content feed in an app);a number of provisions that protect confidentiality, for example the Federal Act on Banking and Savings Banks, which restricts disclosing client-identifying data by banks, the Federal Act on Financial Institutions with similar secrecy provisions for regulated institutions, or the Criminal Code, which restricts disclosing business secrets (which may or may not include personal data) to recipients abroad.Switzerland is not a member of the European Union or the European Economic Area and has not implemented the former EU Data Protection Directive or the General Data Protection Regulation (GDPR). However, the European Commission has found Switzerland’s data protection legislation to provide an adequate level of data protection. Switzerland’s adequacy finding is currently under review, and the Commission is expected to confirm adequacy in the course of 2024.Revision of the FDPA and the FDPOSwitzerland has gone through a lengthy process of revising the FDPA, and the revised FDPA, together with the revised FDPO, has entered into force on 1 September 2023. The key objective was aligning Swiss law with the revised Council of Europe’s Convention 108 and with the GDPR, also in view of the pending adequacy finding mentioned above.Key points of the revised FDPA can be summarized as follows:Swiss data protection law continues to be based on the basic premise that data processing is lawful so long as it is in keeping with general principles. In other words, where data is processed in a fair, transparent and proportional manner for a specific purpose, it is presumed to be lawful.If processing violates a processing principle (and in some though limited other cases), the controller must either act on the basis of consent or establish prevailing public or private interest as a justification. As a result of this approach, many processing activities (including profiling for marketing purposes based on event data) do not require consent under Swiss law where consent would be required under the GDPR.Certain but not all breaches of the FDPA are liable to a fine. Fines would be imposed on the individuals responsible for the breach, not on the controller or processor. This raises a number of issues, for example with regard to the individuals at risk, to insurability of fines and to liability and indemnity in contracts.Many provisions of the FDPA remain vague, partly because data protection law is generally open to a balance of interest and partly due to the lengthy debate in Parliament and the numerous changes introduced along this process.

Question 2

Scope of application of the FDPA

Accepted Answer

With respect to the territorial application of the FDPA (cf. article 3), slightly different criteria apply depending on the nature of the provision in question:Most of the key provisions are considered to be private law in nature, for example the processing principles (cf. no 38 et seq.) or data subject rights. The application of these provisions is governed by the Federal Private International Law Act (PILA) (cf. article 3(2) FDPA), provided a claim is brought before a Swiss court. Under article 139 PILA, data subjects have the right to opt for the laws at their ordinary residence or for the law applicable to the controller or processor held in breach. However, where a data subject with their residence in the EEA opts for the GDPR to apply to the dispute, then Swiss courts would likely rely on article 3 GDPR to determine whether the GDPR indeed is to apply &#8211; this is a debated issue, however.Some provisions are considered to be public law, for example the obligation to provide information to data subject, the obligation to carry out a data protection impact assessment, breach notification obligations or the right for the Swiss data protection authority to carry out an investigation. The application of these provisions is determined in accordance with the principle of territoriality (article 3(1) FDPA). As a rule, a public-law obligation is subject to the FDPA if the facts giving rise to that obligation have occurred fully or partially in Switzerland. For example, where a Swiss-based user accesses and views information that is kept on a server abroad, the information obligations flowing from this operation will be subject to Swiss law. The same applies to controllers located abroad who process personal data relating to individuals in Switzerland, where it is foreseeable that a sufficient number of Swiss individuals will be affected.Certain breaches are liable to a fine. Under the general principles of Swiss international criminal law, these are subject to Swiss law if the breach has been committed in Switzerland (“Handlungsort”) or has an effect in Switzerland (“Erfolgsort”) (cf. article 3(2) FDPA and articles 3 and 8 of the Criminal Code).For practical purposes companies should assume that they will be subject to the FDPA where they process personal data (i) relating to data subjects with their ordinary residence in Switzerland, and (ii) through a Swiss establishment. In our experience, most companies proceed on the assumption that they are under an obligation to comply with Swiss data protection law where they have a relevant Swiss end customer base and will frequently forego a more detailed analysis, considering that GDPR compliance implies compliance with most obligations under Swiss data protection laws.

Question 3

Governance

Accepted Answer

No accountability principleDifferent from the GDPR, there is no accountability principle under the FDPA. A controller or processor that fails to keep records of their processing activities, relevant events and compliance measures may be unable to demonstrate compliance in case of a complaint or an investigation but is not per se in breach of the FDPA.However, there are some obligations of accountability, for example the obligation to keep records of data protection impact assessments for two years from closure of the project, or to keep logs and maintain processing regulations in certain high-risk scenarios.Data Protection AdvisorThe FDPA has no concept of a DPO as defined in the GDPR, but controllers may opt to appoint a “Data Protection Advisor” (“Datenschutzberater”) under article 10 FDPA. Appointing a Data Protection Advisor is optional, including for controllers whose core processing activities consist of high-risk processing (but it is mandatory for organizations acting as federal bodies, including private entities that perform public tasks). Where a Data Protection Advisor is appointed, they should be independent and have the resources required for them to actively monitor compliance within the organization (article 23 FDPO).Appointing a Data Protection Advisor has only one direct effect under the FDPA: The obligation to consult with the Swiss data protection authority (the Federal Data Protection and Information Commissioner, FDPIC) if a data protection impact assessment confirms high residual risk no longer applies. In practice, however, this is of limited value, considering that most impact assessments will confirm lower-than-high risk.The FDPA does not require Data Protection Advisors to be individuals or based in Switzerland. DPOs appointed under the GDPR may act as Data Protection Advisors as well, provided they meet the requirements.Swiss RepresentativeObligation to appointLike with article 27 GDPR, controllers located abroad may be under an obligation to appoint a “representative” under article 14 FDPA (CH Representative) and publishes its name and address.Controller must appoint a CH Representative where all of the following conditions are met for their processing:The processing is carried out by a controller located outside of Switzerland;the data processed relates to individuals located in Switzerland;it is related to the offering of goods or services in Switzerland or to monitoring the behaviour of persons in Switzerland;it is “extensive” (“umfangreich”) and occurs regularly (“regelmässig”);it involves a high risk for the data subjects.There is no guidance so far on the criteria of “extensive” and “regular”.With regard to high risk, the FDPA does not define high risk generally but refers to high risk in the definition of “profiling with high risk” and the obligation to conduct a data protection impact assessment. Based on the assumption that “high risk” is a consistent notion throughout the FDPA, high risk depends on the nature, scope, circumstances and purpose of the processing and may include (article 22(2) FDPA):“high-risk profiling” (article 5(g) FDPA);extensive processing of sensitive data; andsystematic monitoring of extensive public areas.Examples may include profiling that are based on a wide array of event data, for example data about interactions with posts and news in an online feed over time, in particular where data from diverse sources is combined (for example offline and online event data.Where a controller established outside Switzerland engages in such processing, there will therefore be a de-facto presumption that a CH Representative is to be appointed. However, if these activities indeed carry high risk is to be assessed in a data protection impact assessment. Should the assessment confirm that the (net, mitigated) risk is low, then there is no obligation to appoint a CH Representative.CH Representatives must be established in Switzerland and may include legal entities, for example a law firm.Duties of the representativeUnder article 15 FDPA, the CH Representation mustkeep a register of the controller’s processing activities,on request, provide the register to the FDPIC;on request, provide the data subject with information on how to exercise their rights.Records of processing activitiesControllers and processors are required to collect and maintain records of processing activities (article 12(1) FDPA). The information required to be included in these records are the same as under article 30(1) and (2) GDPR, except that no information is required about the CH Representative and a Data Protection Advisor (if appointed).An exception from the obligation to maintain records of processing activities applies to companies with less than 250 members of staff (on a headcount, not on an FTE-basis), provided there is no large-scale processing of sensitive data and no high-risk profiling (article 24 FDPO).Data protection impact assessmentsLike article 35 GDPR, article 22(1) FDPA requires controllers to carry out a data protection impact assessment (DPIA) where processing “may” lead to a high risk. The factors to be considered when assessing potential high risk are the same as under the GDPR.Like the GDPR, the FDPA sets out particular types of processing that typically &#8211; though not invariably &#8211; require a DPIA (article 22(2) FDPA).DPIAs must be kept on record for at least two years from the date when the processing activity has ended (article 14 FDPO).Data breach notificationSimilar to the GDPR, a “data security breach” means a security breach &#8211; i.e., a breach of confidentiality, integrity or availability &#8211; that leads to an unintentional or unlawful loss, deletion, destruction or modification of personal data or to personal data being disclosed or made accessible to unauthorized persons.Notification by the processor to the controllerProcessors must notify the controller “as soon as possible” of data breaches (article 24(3) FDPA). While this obligation is not a mandatory part of processing agreements, it is usually stated in such agreements, frequently specifying minimum notification content and timing requirements.Notification by the controller to the FDPICThe controller must notify the FDPIC where a data breach “is probable to result in a high risk” for the data subject (article 24(1) FDPA). The FDPA provides no definition of high risk, but again assuming that “high risk” is a consistent notion throughout the FDPA, the severity of the risk depends on the nature, scope, circumstances and purpose of the processing (article 22(2) FDPA). However, so far there is no guidance on the interpretation of high risk in the context of data breaches. It is likely that the practice will refer to the EDPB’s guidelines on data breach notifications, or on the ENISA recommendations.The notification to the FDPIC must made as soon as reasonably possible on becoming aware of the breach, provided that the time allowed before the notification depends on the severity of the risk. It must include, as a minimum, the information set out in article 15 FDPO.On receipt of notification, the FDPIC may open an investigation. However, the information provided to the FDPIC under article 24 FDPA may not be used in criminal proceedings against the controller without the controller’s consent (article 24(6) FDPA).Communication by the controller to the data subjectsIndependently of a notification to the FDPIC, the controller must communicate the breach to the data subjects individually, without undue delay, if this is “necessary for the protection of the data subjects”, in particular where subjects should take mitigating measures (for example change login credentials) or on order by the FDPIC (article 24(4) FDPA. The controller must provide the information that is required for the subjects to understand the breach and its likely effects for them and to take appropriate measures.The controller may restrict, postpone, or waive the communication to the subjects (article 24(5) FDPA):on grounds that this measure is required by prevailing interests of third parties or under a statutory duty of secrecy;where information is impossible or would require disproportionate efforts (for example if contact details of the subjects are unknown, or if a large number of subjects would need to be informed individually and the costs is disproportionate in relation to the gain in information);if the information of the data subject is ensured by a public announcement.Keeping logsAs noted above, controllers and processors must take appropriate security measures in relation of personally identifiable data (article 8 FDPA). On this basis, article 4 FDPO entities controllers as well as processors to keep logs where they engage in large-scale processing of sensitive personal data or highrisk profiling. Stricter obligations apply to federal authorities.Where the obligation applies, the controller or processor must keep logs, at a minimum, of the storage, modification, reading, disclosure, deletion, and destruction of data. These logs must include information about the identity of the person who carried out the processing; the type of processing; date and time of the processing; and if data is disclosed, the identity of data recipi-ents. Logs must be kept for one year.Processing regulationsIn some cases, controllers are required to keep “processing regulations”. As with the logkeeping obligation, this obligation applies only where the controller or processor engages in large-scale processing of sensitive personal data or high-risk profiling.Processing regulations are separate from the records of processing activities &#8211; they are similar to an manual that sets out the internal organization; the data processing procedures for storing, correcting, disclosing, retaining, archiving, pseudonymizing, anonymizing, deleting or destroying personal data, including how data minimization is ensured; the procedure how the access and data portability rights are ensured; and the technical and organizational security measures including information about the configuration of IT resources.

Question 4

Processing principles and justification

Accepted Answer

Processing principlesAs mentioned above, controllers and &#8211; for most principles &#8211; also processors must comply with the processing principles. Failure to comply means that the processing infringes on the personality rights of the data subjects and is unlawful unless it is justified by consent and/or a prevailing interest.The FDPA sets out the following processing principles (article 6-8 and FDPA):Lawfulness: Personal data must be processed lawfully, which does not mean that all processing must be based on legal grounds, but that processing must not be inconsistent with any other laws (i.e., other than the FDPA) that protect the data subjects’ personality rights);good faith: processing must be carried out in good faith (fairness). The fairness principle is somewhat vague but may be used as a generic justification whenever a court or authority feels that a particular type if processing is unacceptable;transparency: the key parameters of the processing principles including the processing purpose(s) must either be transparent (i.e., either be obvious in the circumstances or mentioned expressly);purpose limitation: data may only be collected for a specific purpose and may only be processed in a way that is compatible with the purpose;proportionality: processing must be proportionate to the purpose (data minimization) and must be “destroyed or anonymized” as soon as it is no longer needed with regard to the purpose of the processing;correctness: controllers and processors must take reasonable measures to ascertain that the data is accurate and corrected or “deleted or destroyed“;privacy by design and security: controllers must set up technical and organizational measures in order to meet the data protection requirements (privacy by design) and, in particular, to ensure a level of data security appropriate to the risks (data security);privacy by default: controllers must set pre-defined settings such that the processing is limited to the required minimum (privacy by default);right to object: data must not be processed against the express wishes of the data subjects (which is the Swiss variant of the data subjects’ right to object to processing);disclosure restrictions: sensitive data must not be disclosed to third parties (i.e., other controllers).A breach of the processing principles is unlawful unless justified but is generally not subject to a fine.As an exception, a breach of minimum security requirements may be liable to a fine. The FDPA contains no such minimum requirements, but the FDPO includes provisions that may be considered to be minimum requirements, such as keeping logs for high-risk processing (articles 1 et seq.).JustificationAs mentioned above, processing in breach of one or several processing principles is unlawful only to the extent it is not justified. The following grounds may justify such processing (article 31(1) FDPA):(a) Consent (articles 31(1) and 6(6) and (7) FDPA): Consent is regulated less strictly than under the GDPR. The key requirements for consent are the following:“Informed consent”: the subject must be informed of the key elements of the processing;“freely given consent”: consent is invalid if it is not freely given.According to case law, consent may be invalid if the controller makes it a condition to access goods or services arbitrarily, without objective reasons;“Explicit” consent: Consent must be explicit for the processing of sensitive personal data and for high-risk profiling, provided these processing operations require consent;capacity for judgement: consent is invalid if given by anyone without capacity of judgment. There is no minimum age for children, and the required age depends on the risks and complexity of the processing at stake.Because the FDPA has no accountability principle, it is not a breach if consent is not documented, but the controller has an obvious interest in keeping tracible records of consent.Where consent is invalid or withdrawn, the controller may continue to rely on prevailing interest to justify the processing (provided that an express withdrawal of consent may be construed as an objection, which tends to raise the bar for prevailing interest).(b) Prevailing interest (article 31(1) FDPA):Consent is not necessary where processing in breach of a principle is required to safeguard prevailing interests. Potentially prevailing interests include any interest that is not against the law, including public interest and purely commercial interests of private actors. These interests must prevail over the contrary interest of the data subject. The FDPA does not require a formal “legitimate interest assessment” (“LIA”), but the controller should document the balance of interest in all but obvious cases.Examples of potentially prevailing interest include:Anonymization of personal data for statistical uses;data retention beyond the period required for the processing purposes because data is kept in a backup;keeping personal data despite an objection for documentation or evidentiary purposes.

Question 5

Profiling and automated individual decisions

Accepted Answer

“Profiling”The FDPA regulates both profiling and individual decision-making. With regard to profiling, the applicable provisions are different and in parts slightly stricter than the GDPR.“Profiling” means any automated processing with the purpose of analysing or predicting personal aspects or the behaviour of a subject (article 5(f) FDPA). It remains to be seen if profiling requires full automation or includes profiling with some, but not decisive human interaction. In any event however, profiling does not require the raw data used for the profiling operation to be collected or otherwise processed automatically as long as the profiling operation itself is automated. Examples of profiling include automated evaluation of buying habits in order to determine premiums and incentives, calculating an activity index based on step count data from an app, the analysis of website or app behaviour in order to present targeted online advertising, or automatically selecting news based on user location.Profiling as such triggers no express obligations for controllers (unless they act as a federal body). However, there may be an obligation under the transparency principle to inform the data subjects about profiling, and controllers frequently choose to include a reference to profiling in their privacy notices.“High-risk profiling”“High-risk profiling” has been introduced in the FDPA as a political compromise. It is any form of profiling that, based on a combination of data, leads to an “assessment of essential aspects of the personality” of an individual (article 5(h) FDPA). This definition is based on the concept of “personality profiles” in the current FDPA. Examples of “personality profiles” include end customer profiles based on buying habits, a comprehensive CV, results of a personality test or KYC data. Whenever profiling leads to such a profile, it is likely considered to be “high risk”. It is open, however, if only profiling is high-risk that outputs such a personality profile, or also profiling where the input (source) data amounts to a personality profile.Where a controller engages in high-risk profiling,the controller must carry out a data protection impact assessment;the controller may have to appoint a CH Representative;is likely under an obligation to inform the data subjects about the high-risk profiling, under the transparency principle;consent must be explicit, provided consent is required as a justification.Automated individual decision-makingAutomated individual decision-making means decisions that:are made automatically, without meaningful human intervention,require some level of judgment (excluding simple if/then decisions), andhave an adverse legal effect on the subject or otherwise has a significant negative effect on the subject (article 21(1) FDPA). We expect that the interpretation under the FDPA will follow the concept of automated decision-making under the GDPR.Consistent with the Swiss approach of a presumption of the lawfulness of data processing, automated decision-making is regulated but does not require legal grounds to be permitted. However, the controller must generally inform the subjects of automated decision-making. In addition, the controller must allow the subject, on request, to state their position and request that the decision be reviewed by a human (article 21(2) FDPA).The information and escalation obligations set out above do not apply however (article 21(3) FDPA) where:the decision is directly connected with the conclusion or performance of a contract between the controller and the subject, and the request of the subject is satisfied, orthe data explicitly consented to the decision being taken in an automated manner.Controllers should generally include information about automated decision-making (if applicable) in their privacy notice and, in addition, will inform the subjects about the automation of the decision-making and the escalation rights when they notify the decision to the subject. The FDPA does not expressly require this second information in each case, but we consider it likely that a generic information in the privacy notice alone will not be sufficient.

Question 6

Information Obligation

Accepted Answer

General commentsIn addition to the general transparency principle, and similar to articles 13 and 14 GDPR, the FDPA sets out a general obligation to provide certain information to the data subjects (article 19 FDPA). This obligation applies to all categories of data, subject to exceptions, not only to the collection of sensitive data.For controllers established outside of Switzerland, the obligation to inform applies where the collection of data has sufficient ties to Switzerland, for example where the collection is related to an offer to individuals in Switzerland or is carried out using a server in Switzerland.A breach of the obligation to inform may be liable to a fine.Minimum informationControllers must provide the following information as a minimum:Name and details of the controllerName and details of the representativeCategories of dataProcessing purposesRecipients or categories of recipientsintention to transfer data to a third country or international organization, including the recipient countriesappropriate safeguards or exceptions applicablePrivacy notices that are consistent with the GDPR satisfy most requirements of the FDPA, except that:the FDPA requires controllers to name the countries in the event of a transfer to a third country (including for transfers by processors and subprocessors). In practice, many controllers will indicate a region (such as “the EEA” or “globally”) instead of naming all countries individually, but it remains to be seen if courts or the FDPIC will accept this simplification;references to the GDPR are often replaced by a reference to “applicable law” or similar language in order to avoid the perception that the controller is necessarily subject to the GDPR.Note that additional information obligations may arise in the circumstances:additional information obligation may arise under the general transparency principle, depending on the circumstances;article 19(1) FDPA requires the controller to provide the information set out above, but generally “all information which is required in order for the data subject to assert his rights and ensure transparent processing”. It remains to be seen if courts or authorities require additional information under this clause.Form and time constraintsThe information obligation is triggered by the “collection” (“Beschaffung”) of data. “Collection” requires a premeditated action aimed at obtaining data. Where personal data is obtained unintentionally, it is not collected. However, using existing data &#8211; “collected” or not &#8211; for a new purpose will always be considered to constitute collection, and will trigger an obligation to inform.The minimum information must be provided to the data subjects:before or at the time of collection, if is collected from the data subject (article 19(1) FDPA);one month after collection or, if earlier, when data is disclosed to a third party (excluding a processor), where data is not collected from the subject (article 19(5) FDPA).The FDPA does not require a particular form for the minimum information. Information may be provided in any form including orally, and may also be presented on a website, provided:that the data is collected online or through another electronic channel, orwhere data is collected offline, that the subject is directed to the relevant website where the information is easily accessible. It is open if printed matters referring to a website must include certain information (“base information”), but there is a risk that a court or authority would require indicating at least the identity of the controller, the processing purposes and disclosures to third parties.Exceptions from the obligation to informThere is no obligation to inform in the following scenarios (article 20 FDPA):If, and to the extent that, the subject already has the relevant information;the processing is necessary to comply with Swiss law (for example to comply with KYC obligations, certain obligations under labor law or retention obligations);disclosing information would be in breach of a statutory obligation of secrecy;where data is not collected from the data subject, it is not possible to give the information, or it would require disproportionate efforts.In these cases, the controller is relieved from the obligation to inform, and the FDPA does not require the controller to take mitigating measures such as posting the information on a website.In addition, controllers may restrict, defer or waive the information where:It is required to protect the overriding interests of third parties;providing information would prevent the processing from fulfilling its purpose;it is required for the controller’s overriding interests, provided the controller does not disclose the data to third parties (which excludes processors and affiliated companies).

Question 7

Third Parties

Accepted Answer

Controller/processor relationshipsWhere a controller intends to use a processor, the FDPA requires both parties to enter into a data processing agreement (article 9(1) FDPA). The data processing agreement (DPA) may be entered into in any form, including orally, but should be concluded in text form. The minimum content is lighter than under the GDPR. DPAs must require the processor, as a minimum, toprocess data only as necessary for the processor’s services in accordance with the controller’s instructions,obtain controller’s authorization before using a subprocessor, andensure appropriate data security.In addition, the processor must notify the controller of a data security breach as soon as possible (article 24(3) FDPA), which will usually be restated or specified in the DPA.In general, DPAs drafted in accordance with article 28 GDPR satisfy the requirements under article 9 FDPA. However,DPAs are generally modified to remove references to the GDPR or replace them with a reference to “Applicable Data Protection Law” where the controller and the processor may not be subject to the GDPR;in addition, processors are directly responsible to comply with the processing principles and may therefore ask for an undertaking that the controller ensures compliance of the processing with the FDPA and holds the processor harmless in case of a breach caused by the controller.Joint controller arrangementsAs mentioned above, joint controllers have no express obligation to enter into a joint controller arrangement or to inform the subjects about the allocation of responsibility between them. However, an obligation to agree on the allocation of responsibilities may, depending on the circumstances, be derived from the privacy by design and data security principles. Joint controller arrangements in accordance with the GDPR will satisfy this requirement.All joint controllers must likely be indicated in privacy notices, and in the response to subject access requests.Controller-to-controller transfersIn the event of a controller-to-controller transfer, the disclosing controller must comply with the processing principles and with cross-border transfer restrictions. Outside these requirements, there are no minimum requirements for controller-to-controller arrangements, but parties will often enter into a controller-to-controller agreement.It should be noted, however, that under article 62 FDPA, disclosing secret personal data of which knowledge has been gained while exercising a profession that requires such knowledge (or acting on behalf of a person bound by a confidentiality obligation) is liable to a fine of up to CHF 250,000. There is a discussion in Switzerland if any disclosure that is not necessary for a contract with the data subject may be in breach of this provision, or only disclosures in breach of the FDPA.

Question 8

Cross-border data transfers

Accepted Answer

The FDPA regulates data transfers abroad (including disclosure by giving access) in articles 16 et seq. Transfers abroad are permitted as follows:to recipients in countries where the Federal Council has issued an adequacy finding (article 16(1) FDPA). These findings will be binding on exporting companies. The list of adequate countries is an annex to the FDPO, and includes all EEA member states as well as some other countries;where the importing country does not provide adequate protection, the transfer is permitted based on BCR or if the parties enter into a data transfer agreement that is based on standard data protection clauses (including the EU Standard Contractual Clauses, usually slightly modified to account for Swiss law) or, in case of an ad hoc agreement, that has been notified to the FDPIC prior to the transfer;where data is to be transferred to a recipient in a country without adequate protection outside of a data transfer, such a transfer is permitted if it is based on BCR; based on explicit consent; directly connected with the conclusion or the performance of a contract between the controller and the data subject or between controller and another party in the interest of the data subject; necessary in order to safeguard an overriding public interest or for the establishment, exercise or enforcement of legal claims before a court or another competent foreign authority; necessary to protect the life or physical integrity of the subject or a third party, if consent is not an option; the subject has made the data generally accessible and has not expressly prohibited its processing; or the data originates from a register provided for by law which is accessible to the public or persons with a legitimate interest, provided the conditions for consultation are met.Upon request, the exporting party must inform the FDPIC of disclosures of data under some of the exceptions set out above (article 17(2) FDPA).Note that as of today there is no Swiss-US Data Privacy Framework (DPF) in place (the successor to the Privacy Shield), but we expect that the Swiss DPF will become applicable by end of Q1 2024.

Question 9

Data Subject Rights

Accepted Answer

General commentsUnder the FDPA, by and large subjects have the same rights as under the GDPR, but the modalities for using these rights and the controller’s obligations to comply with these rights differ to an extent. The differences can be summarized as follows:Right to be informed: see below;Access: Data subjects have a right to be informed, on request, about the processing of data relating to them and receive a copy of their data and information about the processing;Rectification: The right to have data updated or otherwise rectified is similar under article 32 FDPA and under the GDPR. However, under the FDPA, there is no rectification right where data is processed or archived in the public interest (article 32(1) FDPA, and where the accuracy or inaccuracy of data cannot be determined, the subject may request the competent court to order a note indicating the objection be added to the data (article 32(3) FDPA;Objection: Data subjects may object to the further processing of data relating to them at any time (article 30(2)(b) FDPA). In the event of an objection, further processing is only permitted if it is justified by a prevailing private or public interest. To the extent it is not, processing must be restricted, or data must be deleted;Restriction of processing: There is no express right to restrict further processing of data. However, where data is kept in an archive or backup system (for example if a subject has objected to the further processing but the controller has a prevailing interest in keeping a copy of the data), the controller must take appropriate measures to prevent processing for other purposes. In practice, this requirement has similar effects as the right to restrict processing under articles 4(3) and 18 GDPR;Deletion: Controllers must delete personal data as soon as it is no longer required for a lawful purpose, subject to retention obligations. This may be the result of an objection to the further processing of data as mentioned above. Controllers under an obligation to delete must, at their option, delete, destroy or anonymize the data (cf. article 32(4) FDPA). “Deletion” means deleting personal data in a manner that prevents restoring them under normal circumstances, whereas “destruction” means the irreversible destruction of the data carrier, for example shredding paper or demagnetizing a hard drive. Despite unclear wording, the FDPA generally does not require destruction. Moreover, anonymization is a viable alternative for deletion, regardless of the purpose of anonymization (even though this view is debated);Data portability: Data subjects have a right to obtain certain personal data in a standard electronic format or have data transferred to another controller;Automated individual decision-making: There is not a requirement to establish legal grounds, but the controller must inform the subjects and accept escalation rights.Access rightSimilar to the GDPR, data subjects have the right to access their data. Subject access requests (SARs) may be made in writing or any other form, unless the revFDPO will have formal requirements, and must generally include proof of identity. The current, accepted practice is to require a copy of an ID document as proof, and we expect this practice will continue under the FDPA.On request, controller must provide the following to subjects making a SAR:Name and details of the controller(s)Processing purposesCategories of data, if not collected from the subjectRecipients or categories of recipientsWhere applicable, adequate safeguards for transfers abroad or exemptions applicableRetention time or criteriaInformation about the source of data, to the extent availableAutomated individual decision-makingIn addition, controllers must provide a copy of the personally identifiable data processed.The required information must be given free of charge, except that controllers may charge a fee of up to CHF 300 where SARs responding to SARs leads to disproportionate efforts (article 19 FDPO). Under the FDPA, access must be provided within 30 days from receipt of the SAR (or proof of identity, whichever is later), but the controller may extend this period by providing notice to the subject within the 30 days (article 18 FDPO). No restrictions apply as to the grounds of extension, provided they are reasonable.The following exceptions from the access rights apply (article 26 FDPA; we only list the exceptions that potentially apply for private companies not acting as federal bodies):Refusing, restricting or deferring access is necessary to protect prevailing interests of a third party;the SAR is manifestly unfounded, in particular where its purpose is contrary to data protection or obviously frivolous;refusing, restricting or deferring access is required for the controller’s overriding interests, provided the controller does not disclose the data to third parties (which excludes processors and affiliated companies).Where the controller relies on such an exception, it must indicate its reasons (article 26(4) FDPA). In practice, courts require a fairly detailed explanation.In addition to the grounds mentioned above, the media may refuse or restrict access where personal data is used exclusively for publication in the edited section of a periodically published medium as necessary to protect sources, draft publications or the free formation of the public opinion, and journalists may refuse, restrict or defer access to personal data used exclusively as a personal work instrument. However, depending on the circumstances and the level of their editorial work, platform providers may not be considered to be part of the “media”.Data portabilityUnder article 28 FDPA, data subjects may request a copy of personal data in a standard electronic format (for example an Excel file) or may have data transferred to another controller.The portability right applies only to data (article 20 FDPO) that:is processed in an automated manner; andhas been provided voluntarily by the data subject or is observed from the data subject’s behaviour, excluding derived data such as affinity clusters or AI or machine-learning patterns.The controller may refuse, restrict or defer portability in the following scenarios (article 29(1) FDPA; the same scenarios that restrict the right of access):The measure is necessary to protect prevailing interests of a third party;the request is manifestly unfounded, in particular where its purpose is contrary to data protection or obviously frivolous;the measure is required for the controller’s overriding interests, provided the controller does not disclose the data to third parties (which excludes processors and affiliated companies).Again, where the controller relies on such an exception, it must indicate its reasons (article 29(2) FDPA).

Question 10

Risks and Sanctions

Accepted Answer

Civil liabilityA breach of the FDPA may lead to civil claims against the controller and/or the processor in breach, including cease and desist claims and claims for compensation of monetary damages. However, it would be on the claimant to establish and quantify the economic loss suffered as a result of the breach, which is usually a challenge in practice. Data subjects can also enforce their rights of information, correction and opt-out and may request that a court decision be published.Investigation and orders by the FDPICUnder the FDPA, the FDPIC may initiate (ex officio or upon notification by a subject or other party) an investigation against controllers and processors if there are sufficient indications that processing could violate the FDPA (article 49(1) FDPA. Controllers and processors must provide the FDPIC with all information and make available all documents that are necessary for the investigation (article 49(3) and 50(1) FDPA).If the FDPIC concludes that the FDPA is violated, the FDPIC may order that the processing is fully or partially adjusted, suspended or terminated and that the personal data is fully or partially deleted or destroyed (article 51(1) FDPA). The FDPIC may also defer or prohibit disclosure abroad and may order that the controller and/or processor, as applicable,informs the FDPIC about cross-border transfers;take the measures required under the data protection by design and by default and the data security principles;inform the data subjects about the processing;perform a DPIA and, if applicable, consult the FDPIC;inform the FDPIC and/or, as applicable, the data subjects of a data security breach;provide access to the data subject;designate a CH Representative (cf. seq. 17 et seq.).The FDPIC may also inform the public of his findings and his decisions in cases of general interest (article 57(2) FDPA), which may lead to negative publicity. Moreover, as noted above the FDPIC is subject to the Freedom of Information Act and may be required to release information to the public or the media, on request.SanctionsDifferent from the GDPR, the FDPA generally does not provide for fines on legal entities (but see below). However, certain breaches may lead to fines of up to CHF 250,000 being imposed on the individuals responsible for a breach, including, if applicable, on directors and officers and employees with independent decision-making power (article 29 of the Criminal Code), provided these breaches have been committed wilfully (cf. article 12 Criminal Code) and on condition that a subject makes a complaint. These breaches include (articles FDPA):failure to provide the required information to the data subjects;failure to comply with the access right;failure to cooperate with a FDPIC investigation or to provide truthful information to the FDPIC, or to comply with an order by the FDPIC;providing information to a recipient abroad in violation of transfer restrictions;disclosing personal data to a data processor in violation of a confidentiality obligation, or without ensuring adequate security measures on the part of the processor;do not take the minimum security measures that may be set out in the revFDPO;failure to comply with the obligation of certain professionals to keep non-public data confidential if the subject confidentiality (regardless of whether the data is sensitive or not).In the event of such a breach, a fine of up to CHF 50,000 may be imposed on the controller or processor in breach where the individuals responsible for the breach cannot be or are not identified.

Question 11

Processing Employee Data

Accepted Answer

General principlesUnder article 328b of the Swiss Code of Obligations (CO), employee data must not be processed unless processing is objectively related to job applications or the employment relationship. This restricts both the categories that an employer may process lawfully, such as when assessing potential candidates and throughout the employment relationship, but also the scope and purposes of its processing.Article 328b CO mostly takes up the general principle of purpose limitation and data minimization. As such, it does not impose requirements that would not follow from the FDPA. However, courts would likely apply slightly stricter criteria when assessing the lawfulness of data processing within the employment relationship.Where an employer intends to use personal data in a manner that is not required for the employment relationship, for example using employee photos on a website, the employer will usually rely on consent. Employee consent remains a valid basis, provided that it is given freely, and the information given to the employee is sufficient.Shared services within a groupIn a typical group scenario, employee data will be shared with other entities through an HR information management system (“HRIS”), through shared employee lists and for reporting purposes. Group companies engaging in these processing purposes will frequently act as joint controllers, though this requires a case-by-case analysis. In addition, one or several entitieswill act as group-internal service providers (e.g., to provide shared reports, or operate an HRIS). This will require one or several data processing agreements, in addition to any joint controller arrangements or controller-to-controller agreements.However, where the purpose of such shared processing is not beyond what employees would reasonably expect and is properly explained in an employee privacy notice, it is usually considered to be consistent with the processing principles as well as with article 328b CO. Employee consent is therefore usually not a requirement in these scenarios.

La loi suisse sur la protection des données en bref

Dispositions applicables

Révision de la FDPA et de la FDPO

Pas de principe de responsabilité

Conseiller en protection des données

Représentant suisse

Obligation de nommer

Obligations du représentant

Dossiers des activités de traitement

Évaluations de l’impact sur la protection des données

Notification de violation de données

Notification par le processeur au contrôleur

Notification par le contrôleur au FDPIC

Communication par le contrôleur aux personnes concernées par les données

Conserver les journaux

Règles de traitement

“Profilage à haut risque”

Décision individuelle automatisée

Informations minimales

Contraintes de forme et de temps

Exceptions à l’obligation d’informer

Arrangements de contrôleurs conjoints

Transferts de contrôleur à contrôleur

Droit d’accès

Portabilité des données

Responsabilité civile

Enquête et ordres de la FDPIC

Sanctions

La loi sui­s­se sur la pro­tec­tion des don­nées en bref

Dis­po­si­ti­ons applicables

Révi­si­on de la FDPA et de la FDPO

Pas de prin­ci­pe de responsabilité

Con­seil­ler en pro­tec­tion des données

Repré­sen­tant suisse

Obli­ga­ti­on de nommer

Obli­ga­ti­ons du représentant

Dos­siers des acti­vi­tés de traitement

Éva­lua­tions de l’im­pact sur la pro­tec­tion des données

Noti­fi­ca­ti­on de vio­la­ti­on de données

Noti­fi­ca­ti­on par le pro­ce­s­seur au contrôleur

Noti­fi­ca­ti­on par le con­trô­leur au FDPIC

Com­mu­ni­ca­ti­on par le con­trô­leur aux per­son­nes con­cer­nées par les données

Con­ser­ver les journaux