Jusletter IT

The approximately 15 years old Swiss Federal Act on Data Protection (FADP)¹ is currently being revised. The new FADP is planned to come into force before or on 1 August 2018², a couple of months after the European General Data Protection Regulation (GDPR)³, which comes into force on 25 May 2018.⁴

On 21 December 2016 the Federal Council released a preliminary draft of the new FADP for consultation.⁵ Recently, on 15 September 2017, the Federal Council released the draft of the new FADP, accompanied by its dispatch. A first goal of the new FADP is to adapt data protection to the digital age, thereby increasing protection of, and transparency for, individuals. A second goal is to adapt Swiss legislation to the European GDPR to ensure free data transmission between Switzerland and member states of the EU.⁶ Here are some selected highlights of the FADP draft:

• Limitation to individuals: unlike the current FADP, which protects data of individuals and legal entities, the protection of the new FADP shall be limited to natural persons.⁷ Most countries worldwide do not foresee the protection of personal data of legal entities.⁸
• Profiling: the static result of a «personality profile» in the current FADP is replaced with a dynamic process of «profiling».⁹ The new term¹⁰ is defined as assessment of certain characteristics of a person on the basis of automated personal data, in particular analyzing or predicting the work performance, economic circumstances, health, behaviour, interests, whereabouts or mobility. Profiling is defined as high risk processing that requires an impact assessment. This impact assessment must describe the planned processing, an assessment of the risks for the personality or the fundamental rights of the affected person as well as measures for the protection of her personality and fundamental rights.¹¹
• Cross-border transfer: generally, personal data of individuals can still be transferred abroad if certain protection measures are in place, e.g. country approved by Federal Council or agreed model clauses with foreign contracting partner.¹² But there is a new notification obligation upon request by the Federal Data Protection and Informaption Commissioner (FDPIC) if the personal data transferred abroad relates to, and is in the interest of, a third party (i.e. not the contracting party). Finally, cross-border data transmission cannot yet be justified merely by private interests.¹³
• Deceased Person: the regulation regarding disclosure of personal data of a deceased person currently regulated at ordinance level¹⁴ is elevated to statute level. The FDAP draft now also foresees the possibility of requesting deletion of personal data of a deceased person by her heirs, with exceptions.¹⁵
• Information duty: the information duty has been extended insofar as a person must be informed about the collection of any of her personal data (and not only, as in the current FADP, about the collection of sensitive data or personality profiles). The information to the affected person includes, among others, the processing scope, the recipient of the personal data, and the country to which the personal data are exported.¹⁶ There are numerous exceptions to this information duty.¹⁷
• Fines: in deviation to the European GDPR, which foresees fines up to several million Euros, the FADP draft limits fines in the event of breach of duties to CHF 250’000.–. It is an offence requiring complaint and the breach must have been committed intentionally.¹⁸

Daniel Ronzani