Swiss Data Protection Act

Share This Post

The revised Data Protection Act (DPA) in Switzerland is set to come into effect on September 1, 2023. The aim of the new law is to ensure that Switzerland maintains an adequate level of data protection according to the European Union (EU) standards, enabling the transfer of personal data across borders without additional measures. This article explores the key changes brought by the new DPA, with a focus on data anonymization, and compares it to the EU’s General Data Protection Regulation (GDPR).

What Remains the Same

Switzerland’s liberal data protection principles remain in place under the new DPA. Unlike the GDPR, where data processing is initially prohibited and requires specific justifications, Switzerland generally permits the processing of personal data and only requires justification in exceptional cases. The general processing principles, including transparency, purpose limitation, and proportionality, continue to be upheld. Additionally, the principles of “Privacy by Design” and “Privacy by Default” have been introduced, emphasizing the importance of incorporating privacy measures from the outset.

Key Changes

Privacy Notice:

The new DPA extends the obligation to inform individuals about data processing, encompassing all data collection. Existing privacy notices must be reviewed and updated to meet the new requirements. While the catalog of minimum disclosures is not as extensive as the GDPR’s, it importantly includes specifying recipient countries of cross-border data transfers, which poses practical challenges.

Data Subject Rights:

The rights of data subjects will be extended in line with the GDPR, including the right of access, rectification, objection, deletion, and data portability. Requests must generally be processed within 30 days. Note that non-compliance with data subject rights may lead to criminal sanctions.

Risk Assessments:

Similar to the GDPR, high-risk data processing now requires a data protection impact assessment, assessing risks to data subjects and defining mitigation measures. This assessment is particularly necessary for processing sensitive data, monitoring public areas, or engaging in intensive profiling activities. Transfer impact assessments are also mandatory when transferring personal data to countries with inadequate data protection levels.

Register of Processing Activities:

Companies are required to maintain a register of processing activities, systematically documenting all personal data processing, including purposes and data categories. Companies with fewer than 250 employees may be exempted if they do not engage in high-risk data processing.

Data Security:

Companies must implement data security measures proportionate to the risks posed to individuals by the processing of the information. The DPA also sets out defined minimum requirements. Notably, inadequate data security can again lead to criminal sanctions, necessitating increased investments in cybersecurity.

Breach Reporting:

Failures of security measures and other data breaches that put personal data in jeopardy now require reporting to the Federal Data Protection and Information Commissioner (FDPIC) and potentially to affected individuals, if a certain threshold is met. In light of the threat of criminal sanctions for insufficient cybersecurity measures, this reporting obligation may be met with resistance.

Data Anonymization

No definition of ‘data anonymization’ exists under the DPA. Yet, if the data is anonymized, certain additional processing without consent of the individual to whom the data pertains is permitted, i.e., the processing of the data for study, planning, or statistical purposes. An exception to the anonymization requirement in this context applies if this is impossible or would entail a disproportionate effort, in which case appropriate measures to prevent re-identification must be taken. This use of personal data was previously only permitted if undertaken by certain public institutions.

A further requirement is that in the case of disclosure of particularly sensitive personal information to third parties the data must not allow for the identification of individuals. If that is impossible, it must be ensured that the recipient only processes the data for purposes that are not related to the individuals, e.g., again for study, planning, or statistical purposes. 

When the results of the conducted study, planning exercise, or the statistical analysis are published, the data must likewise not allow for the identification of the individuals whose data is contained in the dataset. 

The new DPA now also provides for anonymization as an alternative to deletion of personal data.

In the absence of a definition of anonymized data it is unclear what is required of someone processing personal data, but it appears that it is more than taking appropriate measures to prevent the identification of a person, as this is listed as an alternative to data anonymization. 

Sanctions

The new DPA enables enforcement through administrative procedures, civil actions, and criminal sanctions. The FDPIC can issue administrative orders, requiring changes or prohibiting certain data processing activities. Data subjects can sue for infringements, and offenders may face fines up to CHF 250,000 and potential entry in the criminal register. However, not all violations are punishable, and penalties apply to individuals acting on behalf of companies rather than companies themselves.

Comparison to the GDPR

While the new DPA aligns Swiss data protection law with the GDPR in many aspects, there are notable differences. Switzerland’s liberal approach to data processing remains intact, requiring specific justifications only in exceptional cases. The GDPR, on the other hand, initially prohibits all data processing. Furthermore, the scope and level of sanctions differ, with the Swiss penalties primarily targeting individuals and sanctions being uninsurable.

With regards to data anonymization, the GDPR excludes anonymized data from its application, whereas the DPA merely permits certain processing without consent when data is anonymized or protected against identification. 

Conclusion

The new Swiss Data Protection Act  increases compliance requirements and introduces the potential for severe sanctions. Companies should prioritize establishing a data protection organization, embedding data protection processes within existing frameworks, and planning for a smooth transition to regular operations. By adopting these measures, organizations can adapt to the evolving landscape of data protection and ensure compliance with the new DPA.

For companies using large, unstructured datasets for study, planning, or statistical purposes, Private AI can help anonymize data across 49 languages. Using the latest advancements in Machine Learning, Private AI can identify and replace over 50 entities of personal data to facilitate compliance. To see the tech in action, try our web demo, or request an API key to try it yourself on your own data.

Get started with Private AI today:

Subscribe To Our Newsletter

Sign up for Private AI’s mailing list to stay up to date with more fresh content, upcoming events, company news, and more! 

More To Explore

Blog

Is Salesforce Law25 Compliant?

Although they hardly need an introduction, Salesforce is a cloud-based customer relationship management (CRM) service that allows businesses to efficiently connect with their customers, find

Read More »

Download the Free Report

Request an API Key

Fill out the form below and we’ll send you a free API key for 500 calls (approx. 50k words). No commitment, no credit card required!

Language Packs

Expand the categories below to see which languages are included within each language pack.
Note: English capabilities are automatically included within the Enterprise pricing tier. 

French
Spanish
Portuguese

Arabic
Hebrew
Persian (Farsi)
Swahili

French
German
Italian
Portuguese
Russian
Spanish
Ukrainian
Belarusian
Bulgarian
Catalan
Croatian
Czech
Danish
Dutch
Estonian
Finnish
Greek
Hungarian
Icelandic
Latvian
Lithuanian
Luxembourgish
Polish
Romanian
Slovak
Slovenian
Swedish
Turkish

Hindi
Korean
Tagalog
Bengali
Burmese
Indonesian
Khmer
Japanese
Malay
Moldovan
Norwegian (Bokmål)
Punjabi
Tamil
Thai
Vietnamese
Mandarin (simplified)

Arabic
Belarusian
Bengali
Bulgarian
Burmese
Catalan
Croatian
Czech
Danish
Dutch
Estonian
Finnish
French
German
Greek
Hebrew
Hindi
Hungarian
Icelandic
Indonesian
Italian
Japanese
Khmer
Korean
Latvian
Lithuanian
Luxembourgish
Malay
Mandarin (simplified)
Moldovan
Norwegian (Bokmål)
Persian (Farsi)
Polish
Portuguese
Punjabi
Romanian
Russian
Slovak
Slovenian
Spanish
Swahili
Swedish
Tagalog
Tamil
Thai
Turkish
Ukrainian
Vietnamese

Rappel

Testé sur un ensemble de données composé de données conversationnelles désordonnées contenant des informations de santé sensibles. Téléchargez notre livre blanc pour plus de détails, ainsi que nos performances en termes d’exactitude et de score F1, ou contactez-nous pour obtenir une copie du code d’évaluation.

99.5%+ Accuracy

Number quoted is the number of PII words missed as a fraction of total number of words. Computed on a 268 thousand word internal test dataset, comprising data from over 50 different sources, including web scrapes, emails and ASR transcripts.

Please contact us for a copy of the code used to compute these metrics, try it yourself here, or download our whitepaper.