The Federal Assembly released, on 20 November 2019, a statement on the Committee on Political Institutions of the Council of States’ (‘PIC-S’) completed consultation on the draft data protection law (‘the Draft Law’). In addition, the Council of Europe announced, on 21 November 2019, that Switzerland had signed the Protocol amending the Convention for the Protection of Individuals with regard to Processing of Personal Data (CETS No. 223) (‘Convention 108 and Amending Protocol’).
Following the State Political Commission of the National Council’s (‘the National Council’) consultation on the Draft Law in August 2019, the PIC-S completed its own article-by-article examination of the Draft Law. The PIC-S consultation, which includes a number of revisions of the National Council’s implementations, followed the PIC-S’s meeting on 18 and 19 November 2019, proceedings in late October, and interviews with cantonal data protection officers. The aims of the PIC-S’s proposals are twofold: to ensure that the standard of data protection afforded to Swiss citizens and consumers is not lower than that of the Federal Act on Data Protection 1992 currently in force, and that it is comparable to the protection offered by the General Data Protection Regulation (Regulation (EU) 2016/679) (‘GDPR’) and the Council of Europe’s Convention 108 and Amending Protocol. The Federal Assembly outlined that such developments seek to ensure that Switzerland’s data protection developments are deemed adequate by the EU, pursuant to Article 45 of the GDPR.
Moreover, the PIC-S proposed deviations from decisions made by the National Council on several points in order to align the Draft Law more closely with the GDPR. The PIC-S removed the exception to the duty to inform, introduced by the National Council, in cases amounting to disproportionate effort (Article 18(1)(e) of the Draft Law), waived the provision of a comprehensive catalogue of information in the event that data subjects exercise their right of access (Article 23(2) of the Draft Law), and included trade union activities within the category of sensitive personal data (Article 4(1)(c) the Draft Law).
Additionally, the PIC-S diverged from the National Council concerning provisions on profiling, which the Federal Assembly noted are essential for the recognition of the Swiss legislation as adequate by the EU. The PIC-S introduced the concept of ‘high-risk profiling’ and provided for enhanced protection for such processing. Furthermore, to strengthen individuals’ rights in credit assessments, the PIC-S excluded data older than five years and data concerning minors from use in processing for this purpose. Moreover, the PIC-S accorded with the National Council regarding concessions available to companies that appoint a data protection advisor, which promote self-regulation and corporate accountability.
The PIC-S adopted the Draft Law unanimously and referred it to the Plenum of the Council of States for consultation during the winter session. The Swiss Federal Data Protection and Information Commissioner showed its support for the PIC-S’s swift consultation process and revisions, noting the Draft Law was significantly improved. Finally, the signing of Convention 108 and Amending Protocol by the Permanent Representative of the Republic of Switzerland to the Council of Europe, Ambassador Christian Meuwly, adopts an international standard of data protection and will facilitate cross-border data transfers.
LILY DAVIES Privacy Analyst