TerraLex Guide to Data Protection

On a national level, privacy and data protection are predominantly covered by the Swiss Consitution, the Federal Act on Data Protection, the corresponding Ordinance on Data Protection and the Federal Act on Freedom of Information in the Administration. In addition, the Swiss Cantons have known their own information and data protection acts applying to their public bodies.

Moreover, Switzerland provides for specific privacy and data protection provisions in various sector or industry-specific laws and in generally applicable acts such as the Swiss Criminal Code and the Information Security Act including its corresponding ordinances. In particular, these are:

• Articles 162, 271, 273, 320 and 321 et seq Swiss Criminal Code
• Article 6 of the Federal Act on Unfair Competition
• Article 47 of the Federal Act on Banks
• Article 16 Federal Act on the Swiss National Bank
• Article 69 Federal Act on Financial Instiutions
• Article 147 Federal Act on Financial Market Infrastructures and Market Conduct in Securities and Derivatives Trading
• Articles 328, 730b para. 2 Federal Act on the Amendment of the Siwss Civil Code (Part Five: The Code of Obligations)
• Article 40 Federal Act on the University-Based Medical Professions
• Article 33 Federal Act on the General Provisions of Social Security Law
• Article 84a Federal Act on Health Insurance
• Article 86 and 76 Federal Act on Occupational Old-Age, Survivors’ and Disability Pension Plans
• Article 66a Federal Act on Disability Insurance
• Article 95a Federal Act on Military Insurance
• Article 43 and 50 Federal Telecommunications Act
• Article 27 Federal Postal Act
• Article 12 Federal Act on Free Movement of Lawyers
• Article 7 and 34 Federal Act on Recruitment and Staff Leasing
• Article 44 et seq Federal Act on Labour in Industry, Trade and Commerce

Depending on the act, the laws may apply to individuals, legal persons or public bodies and authorities. In particular, the Federal Act on Data Protection (DPA) applies to the processing of personal data pertaining to natural persons by private persons or federal bodies. The geographic scope of application of the DPA extends to all fact patterns that have an effect in Switzerland, even if they occurred abroad.

The Federal Data Protection Act (DPA) distinguishes between personal data and sensitive personal data. The DPA does not cover non-personal data.

Personal data is all information concerning an identified or identifiable natural person, whereas sensitive personal data is a sub-section of personal data. Specifically, sensitive personal data is:

• data on religious, ideological, political or trade union-related views or activities;
• data on health, the intimate sphere or the racial or ethnic origin;
• genetic data;
• biometric data which unequivocally identifies a natural person;
• data on administrative or criminal proceedings and sanctions;
• data on social security measures.

The information relating to an identified or identifiable legal person are not considered personal data.

The Federal Data Protection Act (DPA) does not apply to:

• personal data that is processed by a natural person exclusively for personal use;
• personal data that is processed by the Federal Chambers and parliamentary committees in connection with their deliberations;
• personal data that is processed by institutional beneficiaries according to Article 2 Paragraph 1 of the Host State Act of 22 June 2007, which enjoy immunity in Switzerland.

Also, the DPA only applies to first instance proceedings and the processing of personal data and the rights of the data subjects in court proceedings and proceedings governed by the federal rules of procedure are governed by the applicable prodecural provisions. In addition, public registers pertaining to private law relationships are governed by the special provisions of the applicable federal law.

The Federal Act on Data Protection (DPA) does not know the term “data owner” as Swiss law has no concept of ownership in data. An exception to this is the ownership of data sets. The closest to the term “data owner” would be the term "data subject". A data subject is a natural person whose personal data is processed and should ultimately be in a position to determine such processing activities. The DPA knows the following rights of data subjects:

• The right to access;
• The right to release and transfer data;
• The right to correct incorrect personal data;
• The right to have an objection noted;
• The right to withdraw consent;
• The right to erasure (e.g. when consent is withdrawn);
• The right to block.

Unlike European data protection law, the Federal Act on Data Protection (DPA) does not require a legal basis for the processing personal or sensitive personal data. Instead, the DPA requires each data processing activity to comply with the following principles: lawfulness, good faith, proportionality, purpose limitation (including recognizability and transparency), limitation of processing, accuracy and data security. This being said, the principle of lawfulness requires the processor to consider the reason for processing personal data, which can be an overriding private or public interest or (explicit) consent.

The main obligations imposed by the Federal Act on Data Protection (DPA) are:

• The processing of personal data must be in compliance with the principles of lawfulness, good faith, proportionality, purpose limitation, limitation of data processing and accuracy.
• Ensuring data security, which includes the obligation to implement technical and organisational security measures to protect personal data.
• Adherence to the data protection principles by implementing privacy by design and by default measures.
• Providing data subjects with adequate information that would allow them to exercise their rights.
• Having in place written contracts with processors that, in particular, ensure data security.
• Compliance with obligations relating to data transfers abroad.
• Keeping records of processing activities; however, certain companies are exempt in particular due to their size.
• Carrying out data protection impact assessments if required.
• Appointing a data protection representative in certain circumstances.
• Notification of data security breaches to the Federal Data Protection and Information Commissioner.

Yes, the Federal Act on Data Protection (DPA) stipulates a data retention period but does not define the period in exact numbers. The DPA only states that personal data must be anonymized or destroyed as soon as it is no longer needed for the purpose of processing.

Also, the Federal Ordinance on Data Protection stipulates that the controller must retain the data protection impact assessment for at least two years after the termination of the data processing activities.

The Federal Act on Data Protection (DPA) requires controllers and processors to keep an inventory of their processing activities. Controllers are private persons or federal bodies that, alone or jointly with others, decide on the purpose and means of the processing. Processors are private persons or federal bodies that process personal data on behalf of the controller. Unlike European law, the DPA does not provide for the concept of joint controllers.

The inventory of the controller must at least entail the following information:

• The identity of the controller;
• A description of the categories of data subjects and the categories of the processed personal data;
• The categories of the recipients;
• If possible, the period of storage of the personal data or the criteria to determine the period of storage;
• If possible, a general description of the measures to guarantee data security;
• In case of disclosure of data abroad, the name of the state in question and the guarantees taken to ensure adequate data protection.

The processors' inventory must at least entail information on the identity of the processor and of the controller, the categories of processing activities performed on behalf of the controller and a general description of the measures taken to guarantee data security, if possible, and in case of a disclosure abroad, the name of the state in question and the guarantees taken to ensure adequate data protection.

Please note that there is an exemption from the duty to keep an inventory of processing activities applying to companies and other organisations under private law which employ fewer than 250 members of staff on 1 January of a year and natural persons unless they process sensitive personal data on a broad scale or carry out high-risk profiling.

Yes. The federal data protection authority is named the Federal Data Protection and Information Commissioner (FDPIC or in German EDÖB).

The FDPIC oversees the application of federal data protection legislation and is the mediation body for access to all official documents. Regarding the application of the federal data protection legislation, the FDPIC can initiate investigations and order administrative measures. To do so, the FDPIC can order:

• Access to all information, documents, registers of the processing activities and personal data which are required for the investigation;
• Access to premises and facilities;
• Questioning of witnesses;
• Evaluation of experts.

The FDPIC is also the point of contact if a data protection impact assessment (DPIA) results in a high risk to the privacy and fundamental rights of data subjects despite appropriate measures being put in place. The Federal Act on Data Protection (DPA) requires controllers to seek the opinion of the FDPIC in such instances. The FDPIC will then examine the DPIA and inform the data controller in two months of any objections. Also, professional, industry and trade associations can draw up codes of conduct and submit them to the FDPIC for an opinion, which the FDPIC publishes along with a list of standard data protection clauses that he has approved, issued or recognized. Moreover, the FDPIC serves as the body to which data breaches that may result in a high risk to the privacy or fundamental rights of data subjects must be notified.

In addition, the FDPIC also publishes guidelines, information sheets, template documents and information about investigations and administrative measures.

There is no obligation to designate a data protection officer or a data protection advisor (DPO); however, private controllers may appoint one. If a DPO is appointed, the DPO is the contact point for the data subjects and for the competent data protection authorities for data protection matters in Switzerland. In particular, the DPO has to train and advise the private controller in matters of data protection and must participate in the enforcement of data protection regulations. If a DPO is appointed, the controller may benefit from an exception from consulting the Federal Data Protection and Information Commissioner if a data protection impact assessment (DPIA) results in a high risk to the personality or fundamental rights of the data subjects despite any envisaged measures.

A controller or processor may disclose personal data abroad if the Federal Council has determined that the legislation of the relevant recipient State or international body guarantees an adequate level of protection.

In the absence of such a decision by the Federal Council, the controller or the processor may still disclose personal data if appropriate protection is guaranteed by:

• An international treaty;
• Data protection provisions of a contract between the controller or the processor and its contracting partner, which were communicated to the Federal Data Protection and Information Commissioner (FDPIC) beforehand;
• Specific safeguards prepared by the competent federal body and communicated to the FDPIC beforehand;
• Standard data protection clauses previously approved, established or recognized by the FDPIC;
• Binding corporate rules on data protection, which were previously approved by the FDPIC or by a foreign authority responsible for data protection and belonging to a state that guarantees adequate protection.

The FDPIC currently recognizes the EU standard contractual clauses as an appropriate protection. However, an appendix must be added to the EU standard contractual clauses to reflect the additional requirements published by the FDPIC.

No, it is not necessary to notify the Federal Data Protection and Information Commissioner prior to the international data transfer.

Yes. The controller and the processor must implement adequate technical and organisational measures that are adequate to the risk and secure the personal data appropriately. The measures must enable the avoidance of data security breaches. In particular, the measures must ensure confidentiality, availability, integrity and traceability.

Confidentiality means that the controller or processor ensures through technical and organisational measures that the data processed is only accessible to an authorised person. This may be achieved using access controls, entrance controls or usage controls.

Availability means that the controller or processor ensures the processed data is available at any time.

Integrity means that the data cannot be changed unintentionally or by an unauthorized person. To achieve this, a processor may implement data carrier controls, storage controls, recovery plans, availability of automated data processing systems, reporting mechanisms of malfunctions and reliability tests.

Traceability means that the data must be retraceable and that the processor must keep track of each step of the processing activity. Measures that can achieve this are input controls, disclosure controls, and data breach detection measures and mitigating measures to eliminate the impact of security breaches.

Yes. The Federal Data Protection Act (DPA) provides for mandatory notification duties. Specifically, the DPA requires the controller to notify the Federal Data Protection and Information Commissioner as soon as possible of a data security breach that is probable to result in a high risk to the personality rights or the fundamental rights of the data subject. The notification obligation may extend to a notification of the affected data subjects. In addition, the Information Security Act provides for a notification duty for operators of critical infrastructures in case of a cyber incident or the threat of such an incident.

The Federal Act on Data Protection (DPA) stipulates criminal sanctions for individuals for not complying with certain obligations in this law. In particular, on complaint, private persons are liable to a fine of up to CHF 250,000.00 if they breach their obligations to provide access and information or fail to cooperate. For example, this includes wilfully providing false or incomplete information in a privacy notice. Also, private persons are liable to a fine of up to CHF 250,000.00 if they willfully provide false information to the Federal Data Protection and Information Commissioner (FDPIC) in the context of an investigation. Moreover, private persons are liable to a fine of up to CHF 250,000.00 if they wilfully disclose personal data abroad in violation of the DPA, assign the data processing to a processor without concluding a data processing agreement and ensuring data security or fail to comply with the minimum data security requirements outlined in the DPA.

In addition, if a person wilfully discloses secret personal data of which such person has gained knowledge while exercising their profession, which requires knowledge of such data, such person may also be liable on a complaint to a fine of up to CHF 250,000.00. The same penalty applies to anyone who wilfully discloses secret personal data of which such person has gained knowledge while performing activities for a person bound by a confidentiality obligation or while training with such a person.

Finally, private persons may be liable to a fine of up to CHF 250,000.00 if they fail to comply with a decision issued by the FDPIC concerning the criminal penalty or a decision issued by the appellate authorities.

N/A