Swiss Federal Act on Data Protection

Swiss Federal Act on Data Protection
Title	Swiss Federal Act on Data Protection
Enacted by	Federal Assembly of Switzerland
Enacted	1992
Amended	2020
Status	in force

Swiss Federal Act on Data Protection

The Swiss Federal Act on Data Protection is the principal statutory framework regulating processing of personal data in Switzerland enacted by the Federal Assembly of Switzerland and administered by the Federal Data Protection and Information Commissioner. It aligns Swiss practice with international instruments such as the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data and interacts with regulatory regimes including the European Union's General Data Protection Regulation and the Council of Europe standards. The Act underpins interactions among public authorities like the Federal Office of Justice and private actors including multinational firms such as UBS, Credit Suisse, and technology companies operating from Silicon Valley to Zurich.

Overview

The Act establishes principles for lawful processing recognized in decisions from courts like the Federal Supreme Court of Switzerland and policy guidance from bodies such as the Organisation for Economic Co-operation and Development and the International Organization for Standardization. It sets out duties that affect stakeholders including cantonal administrations like the Canton of Geneva and international entities such as the World Health Organization when handling health-related data. The legislative framework connects to treaties such as the European Convention on Human Rights and organizational frameworks like the United Nations's data protection initiatives.

Scope and Definitions

The Act defines "personal data" with terms interpreted in case law from the Federal Administrative Court of Switzerland and doctrinal writings referencing principles from the Council of Europe and the European Court of Human Rights. It distinguishes categories such as "sensitive personal data" relevant to health providers like Hôpitaux Universitaires de Genève and financial institutions like Julius Baer Group. Territorial application issues arise with cross-border transfers involving jurisdictions such as the United States, United Kingdom, European Union, China, and Japan and affect multinational corporations like Google, Facebook, Microsoft, and Amazon.

Rights of Data Subjects

The Act grants rights comparable to remedies in rulings by the European Court of Justice and mechanisms used by data protection authorities including the Information Commissioner's Office and the French Commission Nationale de l'Informatique et des Libertés. Data subjects can exercise rights against employers such as Nestlé or insurers like Swiss Re and seek rectification, deletion, or access in proceedings similar to those before tribunals like the Cantonal Court of Zurich. Judicial review may ultimately reach the Federal Supreme Court of Switzerland where precedents reference doctrines developed in cases involving entities like Novartis and Roche.

Obligations of Data Controllers and Processors

Controllers and processors must implement measures echoing standards from ISO/IEC 27001 and guidance issued by the European Data Protection Board and the International Telecommunication Union. Obligations affect private-sector actors such as Swisscom, Zurich Insurance Group, and platforms operated by Twitter and LinkedIn, as well as public bodies including the Federal Department of Home Affairs and cantonal healthcare agencies. Cross-border processing raises compliance questions under frameworks like the Privacy Shield negotiations and adequacy determinations by the European Commission.

Enforcement and Sanctions

Enforcement is carried out by the Federal Data Protection and Information Commissioner with recourse to administrative proceedings and judicial review in courts such as the Federal Supreme Court of Switzerland and cantonal tribunals like the Geneva Court of First Instance. Sanctions may involve administrative fines and corrective orders analogous to decisions by the Bundesamt für Justiz and the European Court of Human Rights's supervisory mechanisms, affecting institutions from banks like PostFinance to research bodies like the Swiss Federal Institute of Technology in Zurich.

Amendments and Legislative History

Major revision efforts culminated in amendments aligning the Act with developments in European Union law and pressures stemming from technological change influenced by companies such as Apple and Samsung. Parliamentary debates in the Federal Assembly of Switzerland and reports by the Federal Council referenced comparative law from states including Germany, France, Italy, and Netherlands. The 2020 revision process involved consultations with stakeholders like the Swiss Bankers Association, Pharmaceutical Research and Manufacturers of America, and civil society organizations including Digitale Gesellschaft.

Category:Swiss legislation Category:Data protection law