With the recent revisions to the Swiss Federal Data Protection Act, our team have summarised both the key points of the changes as well as listed a number of next steps that may need actioning in your organisation.
As experienced experts in Swiss and EU data protection law, our experts are able to show you the differences to the EU and support you in implementing a data protection concept that is suitable for your company.
Key points of the revision
- The new DPA is unlikely to enter into force before 2022; some do not expect it until summer 2022
- The basic principles of data protection do not change; consent for processing personal data is still mostly not required (unlike under the GDPR)
- More or less burdensome governance obligations have been added, such as the maintenance of data processing inventories, an obligation to report data breaches and other security breaches, and the obligation to conduct data protection impact assessments
- New provisions allow companies to appoint data protection advisors and require foreign companies with significant activities in Switzerland to designate a Swiss representation
- The rights of data subjects will be somewhat expanded; it will be even easier to demand that a company release one's own data
- Contracts must be checked for compliance with the DPA; in particular, the involvement of subcontractors will be regulated more strictly (analogous to the DPA)
- Profiling was at the center of the discussion, but hardly anything changes
- The duty to provide information for data procurements is expanded in terms of content (i.e. what must be must be informed about) is expanded; companies must therefore review their data protection declarations
- The transfer of data abroad will be liberalized, but violations will now be punishable by law
- Processing of data for checking creditworthiness will be restricted, especially in terms of time.
- The Federal Data Protection and Information Commissioner can now issue processing prohibitions and other and other orders and no longer only "recommendations".
- The penalty provisions (CHF 250,000) are aimed at responsible employees, not companies, but concern only a few cases (information, disclosure, exports, security, outsourcing)
- Whoever is DPA compliant will also be DPA compliant, with some exceptions; data about legal entities are no longer in the scope of application.
Need for action
Considering the above key points that came out of the revision, we have compiled a number of key actions that may need completing in your organisation. Our dedicated DPMS solution enables businesses to track these changes and identify actions for their own teams.
- Review and adapt data protection declarations to the new requirements; check whether all cases are covered where the company procures personal data
- Create a list of data processing activities
- Identify order processing and check and adapt contracts to the new requirements
- Identify foreign transfers and check and adapt them in accordance with the requirements
- Introduce process for data protection impact assessment, possibly appoint data protection advisor
- Introduce process for reporting and handling data security breaches
- Establish or adapt guidelines for responding to requests from data subjects
- Identify automated individual decisions and, if relevant, re-regulate them if necessary
- Identify processing of genetic and biometric data and for non-personal purposes and creditworthiness, and review and adapt them in response to new requirements
- Adapt training and instructions, provide for audits
Our team is at your disposal, click here to make an appointment for a detailed consultation.
