Swiss Data Protection Law
Dominic N. Staiger
1 Introduction to Data Protection in Switzerland
The data protection framework in Switzerland is based on both laws and regulations
of the individual Cantons as well as the Swiss Confederation. The processing of
personal data by private entities such as corporations is based on the Federal Data
Protection Act (FDPA) (“Datenschutzgesetz”). This Act also governs the processing
of personal data by federal agencies. Since its enactment in 1993 the law has
undergone several minor revisions. However, a new fundamental revision of the
FDPA has been introduced into parliament in 2016 in order to bring the Swiss data
protection law in line with the requirements of the new EU General Data Protection
Regulation (GDPR).
1 This adjustment is necessary for Switzerland to maintain its
status as a country with an equivalent data protection level to that of the
EU. Currently Switzerland retains this status allowing for a free flow of personal
data between EU Member States and Switzerland. Thus, for the Swiss economy with
its many innovative service providers and export industry, the ability to offer cross
boarder personal data processing plays an important role in the increasingly digitised
and interconnected markets.
In some respect the new draft FDPA (dFDPA) falls short of the GDPR standard
and seeks to limit certain areas. For example, the dFDPA provides in particular no
right to data portability, no extra-territorial scope, lower requirements with respect to
D. N. Staiger (*)
University of Zurich, Zurich, Switzerland
e-mail: dominic.staiger@sidd.swiss
1 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the
protection of natural persons with regard to the processing of personal data and on the free
movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
OJ L 119 4.5.2016, p. 1.
© Springer Nature Switzerland AG 2020
D. Moura Vicente, S. de Vasconcelos Casimiro (eds.), Data Protection in the
Internet, Ius Comparatum – Global Studies in Comparative Law 38,
https://doi.org/10.1007/978-3-030-28049-9_16
397
Dominic N. Staiger
1 Introduction to Data Protection in Switzerland
The data protection framework in Switzerland is based on both laws and regulations
of the individual Cantons as well as the Swiss Confederation. The processing of
personal data by private entities such as corporations is based on the Federal Data
Protection Act (FDPA) (“Datenschutzgesetz”). This Act also governs the processing
of personal data by federal agencies. Since its enactment in 1993 the law has
undergone several minor revisions. However, a new fundamental revision of the
FDPA has been introduced into parliament in 2016 in order to bring the Swiss data
protection law in line with the requirements of the new EU General Data Protection
Regulation (GDPR).
1 This adjustment is necessary for Switzerland to maintain its
status as a country with an equivalent data protection level to that of the
EU. Currently Switzerland retains this status allowing for a free flow of personal
data between EU Member States and Switzerland. Thus, for the Swiss economy with
its many innovative service providers and export industry, the ability to offer cross
boarder personal data processing plays an important role in the increasingly digitised
and interconnected markets.
In some respect the new draft FDPA (dFDPA) falls short of the GDPR standard
and seeks to limit certain areas. For example, the dFDPA provides in particular no
right to data portability, no extra-territorial scope, lower requirements with respect to
D. N. Staiger (*)
University of Zurich, Zurich, Switzerland
e-mail: dominic.staiger@sidd.swiss
1 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the
protection of natural persons with regard to the processing of personal data and on the free
movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
OJ L 119 4.5.2016, p. 1.
© Springer Nature Switzerland AG 2020
D. Moura Vicente, S. de Vasconcelos Casimiro (eds.), Data Protection in the
Internet, Ius Comparatum – Global Studies in Comparative Law 38,
https://doi.org/10.1007/978-3-030-28049-9_16
397