The revised Swiss Federal Act on Data Protection (Swiss FADP) has sparked discussions about data protection in Switzerland and its impact on companies, especially in the age of digitalization. To help you navigate the finer points of this law, I have put together a comprehensive guide.
Introduction to the Swiss FADP
The revised FADP is a Swiss law designed to strengthen the protection of personal data. It arrives at a time when digital transformation is advancing rapidly and data protection has become a pressing issue. The law aims to align Swiss data protection standards with the European Union's General Data Protection Regulation (GDPR).
The EU-U.S. Data Privacy Framework and its implications
On July 10, 2023, the European Commission established the EU-U.S. Data Privacy Framework (DPF), a pivotal development for international data transfers.
The DPF serves as a mechanism to ensure adequate data protection when private or public entities in the EU and the European Economic Area (EEA) transfer personal data to U.S. companies that are part of the framework.
Introducing the EU-U.S. DPF was no easy road. It was the third attempt by EU and U.S. authorities to enable the transatlantic transfer of personal data. The Court of Justice of the European Union (CJEU) had invalidated the previous attempts, the Safe Harbor agreement and the Privacy Shield, which led to the creation of the EU-U.S. DPF.
The EU-U.S. DPF also relies on U.S. Executive Order 14086 (EO 14086), signed by President Biden on October 7, 2022. This order establishes safeguards for U.S. signals intelligence activities and aligns them with European legal principles, including proportionality, oversight, and effective legal remedies for data subjects.
Companies under the EU-U.S. DPF must comply with specific data protection principles set by the U.S. Department of Commerce. These principles are intended to achieve a level of data protection equivalent to that applied to personal data originating from data exporters in the EU and the EEA.
The impact of the EU-U.S. DPF on data exports to the U.S.
With the EU Commission's approval of the DPF, data exporters can transfer personal data from the EU and the EEA to U.S. companies certified under the DPF without additional safeguards. However, companies should consider whether to fully switch their data transfers to the DPF given its uncertain future.
Swiss companies and the EU-U.S. DPF
Swiss companies can only benefit from the EU-U.S. DPF to a limited extent, as it does not cover data exporters in Switzerland that transfer personal data to certified companies in the U.S. For Swiss data exporters to lawfully transfer personal data to recipients in the U.S., they must rely on statutory exceptions or implement alternative safeguards that ensure an adequate level of data protection, such as the EU Standard Contractual Clauses (SCCs), also known as data processing agreements (DPAs).
The planned Swiss-U.S. Data Privacy Framework
Switzerland is currently in discussions about a “Swiss-U.S. Data Privacy Framework”. This framework is intended to address the limitations of the EU-U.S. DPF for Swiss companies. Until it is adopted, Swiss companies must be patient and continue to treat the U.S. as a country without an adequate level of data protection.
Considerations for Swiss companies
Swiss companies should continue to regard the U.S. as a country without adequate data protection laws until the Swiss-U.S. Data Privacy Framework is adopted.
However, if a U.S. company is certified under the EU-U.S. DPF, this can be seen as an additional layer of protection.
EU-U.S. Data Privacy Framework: the essentials at a glance
When the EU-U.S. DPF took effect
The EU-U.S. DPF is currently in force. The associated adequacy decision took effect immediately upon its adoption on July 10, 2023.
What is new about the EU-U.S. DPF?
The EU-U.S. DPF introduces several rights for data subjects, including access to their data and the correction or deletion of inaccurately or unlawfully processed data. It establishes a set of remedies for cases in which personal data is processed contrary to the principles of the EU-U.S. DPF, including a free, independent dispute resolution mechanism and an arbitration panel.
How to check whether a U.S. company is certified under the EU-U.S. DPF
The U.S. Department of Commerce maintains a list of U.S. companies that have self-certified and declared their commitment to complying with the principles of the EU-U.S. DPF. This list helps data exporters verify a U.S. company's certification.
Consequences of removal from the Data Privacy Framework list
If a company is removed from the Data Privacy Framework list, it no longer benefits from the EU Commission's adequacy decision on the EU-U.S. DPF. As a result, European data exporters cannot transfer personal data to these U.S. companies without additional safeguards, such as a specific DPA that guarantees adequate protection under the GDPR.
Conclusion
The world of data protection is constantly evolving. With the introduction of the revised FADP and the EU-U.S. DPF, Swiss companies have to navigate a complex landscape. While they await the Swiss-U.S. Data Privacy Framework, they must stay informed and adapt to these changes to make the transition smoother.
Ultimately, it is about handling personal data with the utmost care, respecting privacy and fostering trust in this digital age.