as personal data.
4 The question in these cases is always one of degree to which the
personal data relates to an identifiable individual and the ability of one party to
identify that individual or its power to affect identification. These questions will also
remain under the GDPR as well as the revised Swiss FDPA. Most likely the EU Data
Protection Board (EDPB) will issue some guidance on this matter with regard to
specific and common processing scenarios so as to limit the legal ambiguity especially for smaller enterprises that cannot afford vast legal assessments and rely on
any guidance that they may be able to receive from data protection authorities and
the EDPB.
5
Once personal data is present in any business operation, it must be processed in
accordance with the principles set out in Article 5 of the draft revised FDPA. These
principles include data minimization, purpose limitation and transparent data
processing. In cases where enforcement under FDPA fails, the Swiss Civil Code
provides catch-all elements ensuring the civil protection of personality rights.
6 This
allows for an independent course of action that is currently already present today.
However, these remain in addition to the power of the Federal Data Protection and
Information Commissioner to impose fines and penalties and are often of much more
limited scope.
In addition to the general scope of personal data there is also a category of
sensitive data which requires further protection going beyond the standard protections. This category includes data relating to the religious, political and union
member views, health care data, data relating to race or ethnicity, biometric data
which allows for the identification of an individual, data on any prosecution or
administrative procedure concerning an individual, as well as information on social
welfare issues.
7 Such sensitive data also triggers the necessity of a Data Protection
Impact Assessment as there is generally a high risk involved in the processing of
such data that needs to be accounted for and were possible mitigated. In such a case
the FDPIC must also be contacted for an opinion unless a Data Protection Officer has
been consulted by the private entity.
8
The revised dFDPA is applicable both to private entities and persons, as well as
all federal agencies. However, the courts as well as the agencies involved in the
legislative process are excluded from the scope of the law. In contrast to the old
version the dFDPA does not classify data of companies (legal entities) as personal
data anymore.
4 Logistep BGE 136 II 508 and Patrick Breyer v. Bundesrepublik Deutschland, C-582/14, ECLI:EU:
C:2016:779.
5 For more information on the European Data Protection Board see: https://edpb.europa.eu.
6 Swiss Civil Code, Art, 28 et seq. https://www.admin.ch/opc/en/classified-compilation/19070042/
201801010000/210.pdf.
7 Draft Federal Data Protection Act, Art. 3(c), https://www.admin.ch/opc/de/federal-gazette/2017/
7193.pdf.
8 Ibid., Art. 21.
Swiss Data Protection Law
399
4 The question in these cases is always one of degree to which the
personal data relates to an identifiable individual and the ability of one party to
identify that individual or its power to affect identification. These questions will also
remain under the GDPR as well as the revised Swiss FDPA. Most likely the EU Data
Protection Board (EDPB) will issue some guidance on this matter with regard to
specific and common processing scenarios so as to limit the legal ambiguity especially for smaller enterprises that cannot afford vast legal assessments and rely on
any guidance that they may be able to receive from data protection authorities and
the EDPB.
5
Once personal data is present in any business operation, it must be processed in
accordance with the principles set out in Article 5 of the draft revised FDPA. These
principles include data minimization, purpose limitation and transparent data
processing. In cases where enforcement under FDPA fails, the Swiss Civil Code
provides catch-all elements ensuring the civil protection of personality rights.
6 This
allows for an independent course of action that is currently already present today.
However, these remain in addition to the power of the Federal Data Protection and
Information Commissioner to impose fines and penalties and are often of much more
limited scope.
In addition to the general scope of personal data there is also a category of
sensitive data which requires further protection going beyond the standard protections. This category includes data relating to the religious, political and union
member views, health care data, data relating to race or ethnicity, biometric data
which allows for the identification of an individual, data on any prosecution or
administrative procedure concerning an individual, as well as information on social
welfare issues.
7 Such sensitive data also triggers the necessity of a Data Protection
Impact Assessment as there is generally a high risk involved in the processing of
such data that needs to be accounted for and were possible mitigated. In such a case
the FDPIC must also be contacted for an opinion unless a Data Protection Officer has
been consulted by the private entity.
8
The revised dFDPA is applicable both to private entities and persons, as well as
all federal agencies. However, the courts as well as the agencies involved in the
legislative process are excluded from the scope of the law. In contrast to the old
version the dFDPA does not classify data of companies (legal entities) as personal
data anymore.
4 Logistep BGE 136 II 508 and Patrick Breyer v. Bundesrepublik Deutschland, C-582/14, ECLI:EU:
C:2016:779.
5 For more information on the European Data Protection Board see: https://edpb.europa.eu.
6 Swiss Civil Code, Art, 28 et seq. https://www.admin.ch/opc/en/classified-compilation/19070042/
201801010000/210.pdf.
7 Draft Federal Data Protection Act, Art. 3(c), https://www.admin.ch/opc/de/federal-gazette/2017/
7193.pdf.
8 Ibid., Art. 21.
Swiss Data Protection Law
399