Swiss Data Protection Act

The revised Data Protection Act (DPA) in Switzerland is set to come into effect on September 1, 2023. The aim of the new law is to ensure that Switzerland maintains an adequate level of data protection according to the European Union (EU) standards, enabling the transfer of personal data across borders without additional measures. This article “Swiss Data Protection Act” explores the key changes brought by the new DPA, with a focus on data anonymization, and compares it to the EU’s General Data Protection Regulation (GDPR).

What Remains the Same

Switzerland’s liberal data protection principles remain in place under the new DPA. Unlike the GDPR, where data processing is initially prohibited and requires specific justifications, Switzerland generally permits the processing of personal data and only requires justification in exceptional cases. The general processing principles, including transparency, purpose limitation, and proportionality, continue to be upheld. Additionally, the principles of “Privacy by Design” and “Privacy by Default” have been introduced, emphasizing the importance of incorporating privacy measures from the outset.

Key Changes

Privacy Notice:

The new DPA extends the obligation to inform individuals about data processing, encompassing all data collection. Existing privacy notices must be reviewed and updated to meet the new requirements. While the catalog of minimum disclosures is not as extensive as the GDPR’s, it importantly includes specifying recipient countries of cross-border data transfers, which poses practical challenges.

Data Subject Rights:

The rights of data subjects will be extended in line with the GDPR, including the right of access, rectification, objection, deletion, and data portability. Requests must generally be processed within 30 days. Note that non-compliance with data subject rights may lead to criminal sanctions.

Risk Assessments:

Similar to the GDPR, high-risk data processing now requires a data protection impact assessment, assessing risks to data subjects and defining mitigation measures. This assessment is particularly necessary for processing sensitive data, monitoring public areas, or engaging in intensive profiling activities. Transfer impact assessments are also mandatory when transferring personal data to countries with inadequate data protection levels.

Register of Processing Activities:

Companies are required to maintain a register of processing activities, systematically documenting all personal data processing, including purposes and data categories. Companies with fewer than 250 employees may be exempted if they do not engage in high-risk data processing.

Data Security:

Companies must implement data security measures proportionate to the risks posed to individuals by the processing of the information. The DPA also sets out defined minimum requirements. Notably, inadequate data security can again lead to criminal sanctions, necessitating increased investments in cybersecurity.

Breach Reporting:

Failures of security measures and other data breaches that put personal data in jeopardy now require reporting to the Federal Data Protection and Information Commissioner (FDPIC) and potentially to affected individuals, if a certain threshold is met. In light of the threat of criminal sanctions for insufficient cybersecurity measures, this reporting obligation may be met with resistance.

Data Anonymization

No definition of ‘data anonymization’ exists under the DPA. Yet, if the data is anonymized, certain additional processing without consent of the individual to whom the data pertains is permitted, i.e., the processing of the data for study, planning, or statistical purposes. An exception to the anonymization requirement in this context applies if this is impossible or would entail a disproportionate effort, in which case appropriate measures to prevent re-identification must be taken. This use of personal data was previously only permitted if undertaken by certain public institutions.

A further requirement is that in the case of disclosure of particularly sensitive personal information to third parties the data must not allow for the identification of individuals. If that is impossible, it must be ensured that the recipient only processes the data for purposes that are not related to the individuals, e.g., again for study, planning, or statistical purposes. 

When the results of the conducted study, planning exercise, or the statistical analysis are published, the data must likewise not allow for the identification of the individuals whose data is contained in the dataset. 

The new DPA now also provides for anonymization as an alternative to deletion of personal data.

In the absence of a definition of anonymized data it is unclear what is required of someone processing personal data, but it appears that it is more than taking appropriate measures to prevent the identification of a person, as this is listed as an alternative to data anonymization. 

Sanctions

The new DPA enables enforcement through administrative procedures, civil actions, and criminal sanctions. The FDPIC can issue administrative orders, requiring changes or prohibiting certain data processing activities. Data subjects can sue for infringements, and offenders may face fines up to CHF 250,000 and potential entry in the criminal register. However, not all violations are punishable, and penalties apply to individuals acting on behalf of companies rather than companies themselves.

Comparison to the GDPR

While the new DPA aligns Swiss data protection law with the GDPR in many aspects, there are notable differences. Switzerland’s liberal approach to data processing remains intact, requiring specific justifications only in exceptional cases. The GDPR, on the other hand, initially prohibits all data processing. Furthermore, the scope and level of sanctions differ, with the Swiss penalties primarily targeting individuals and sanctions being uninsurable.

With regards to data anonymization, the GDPR excludes anonymized data from its application, whereas the DPA merely permits certain processing without consent when data is anonymized or protected against identification.

In addition to enhancing data protection measures, the new Swiss Data Protection Act highlights the importance of first-party data privacy. It ensures the secure handling of personal information within organizations.

Conclusion

The new Swiss Data Protection Act  increases compliance requirements and introduces the potential for severe sanctions. Companies should prioritize establishing a data protection organization, embedding data protection processes within existing frameworks, and planning for a smooth transition to regular operations. By adopting these measures, organizations can adapt to the evolving landscape of data protection and ensure compliance with the new DPA.

For companies using large, unstructured datasets for study, planning, or statistical purposes, Private AI can help anonymize data across 49 languages. Using the latest advancements in Machine Learning, Private AI can identify and replace over 50 entities of personal data to facilitate compliance. To see the tech in action, try our web demo, or request an API key to try it yourself on your own data.