1.2 Data Protection Supervisor
Under the previous as well as the revised dFDPA the supervision of data protection
matter lies with the Federal Data Protection and Information Commissioner.
Section 7 (Articles 37–49) contains the rights and responsibilities of the Federal
Data Protection and Information Commissioner who is tasked with ensuring data
protection compliance in accordance with the law. The Commissioner’s powers
include the right to investigate matters and conduct on premise inspections. However, currently any fines that may be imposed under the FDPA are not issued by the
Commissioner but by the court system. The revision of the FDPA aims at allowing
the Commissioner to impose such fines and not only to investigate the matters. This
would also enable him to address complaints that are brought to his or her attention
by the public, and to take remedial action. Section 8 of the dFDPA contains specific
penal provisions. Sanctions are imposed on the individual who is responsible for the
processing operation and include personal fines of up to 500,000 CHF (Article 50 et
seq). As the revised dFDPA is still a draft, there is no relevant case law under the new
data protection code yet. It will remain to be seen to what extent the power to issue
fines will be used or if alternative administrative measures will be chosen.
As Switzerland has a federal system, the Commissioner is responsible for the
compliance with data protection law on the federal level; however, there are authorities on the Cantonal level (Data Protection Commissioners) supervising strictly
cantonal issues of data protection compliance.
In addition to the powers of the Commissioner the new dFDPA eliminates the
duty to notify data files to the Federal Data Protection and Information Commissioner, which applied to all private parties who regularly disclosed personal data to
third parties or processed sensitive personal data.
9
2 Key Data Protection Provisions in Switzerland
Swiss data protection law does not distinguish by the specific method of data
handling as it aims at being technology neutral. Cases of data handling by the
electronic means fall under the FDPA in the same way as any other method does.
The law generally regulates how the data controller must act. For example, social
media companies are classed as data controllers within the meaning of the FDPA.
10
Article 4 paragraph 6 of the dFDPA requires the data controller to provide the
data subject with clear information about whether data is collected or not, as well as
information about what kind of data is collected. This is in line with the GDPR
requirements to ensure transparent data processing and allows the affected individual
9 Federal Data Protection Act, Art. 11a (5).
10 Draft Federal Data Protection Act, Art. 3 (h).
400
D. N. Staiger
Under the previous as well as the revised dFDPA the supervision of data protection
matter lies with the Federal Data Protection and Information Commissioner.
Section 7 (Articles 37–49) contains the rights and responsibilities of the Federal
Data Protection and Information Commissioner who is tasked with ensuring data
protection compliance in accordance with the law. The Commissioner’s powers
include the right to investigate matters and conduct on premise inspections. However, currently any fines that may be imposed under the FDPA are not issued by the
Commissioner but by the court system. The revision of the FDPA aims at allowing
the Commissioner to impose such fines and not only to investigate the matters. This
would also enable him to address complaints that are brought to his or her attention
by the public, and to take remedial action. Section 8 of the dFDPA contains specific
penal provisions. Sanctions are imposed on the individual who is responsible for the
processing operation and include personal fines of up to 500,000 CHF (Article 50 et
seq). As the revised dFDPA is still a draft, there is no relevant case law under the new
data protection code yet. It will remain to be seen to what extent the power to issue
fines will be used or if alternative administrative measures will be chosen.
As Switzerland has a federal system, the Commissioner is responsible for the
compliance with data protection law on the federal level; however, there are authorities on the Cantonal level (Data Protection Commissioners) supervising strictly
cantonal issues of data protection compliance.
In addition to the powers of the Commissioner the new dFDPA eliminates the
duty to notify data files to the Federal Data Protection and Information Commissioner, which applied to all private parties who regularly disclosed personal data to
third parties or processed sensitive personal data.
9
2 Key Data Protection Provisions in Switzerland
Swiss data protection law does not distinguish by the specific method of data
handling as it aims at being technology neutral. Cases of data handling by the
electronic means fall under the FDPA in the same way as any other method does.
The law generally regulates how the data controller must act. For example, social
media companies are classed as data controllers within the meaning of the FDPA.
10
Article 4 paragraph 6 of the dFDPA requires the data controller to provide the
data subject with clear information about whether data is collected or not, as well as
information about what kind of data is collected. This is in line with the GDPR
requirements to ensure transparent data processing and allows the affected individual
9 Federal Data Protection Act, Art. 11a (5).
10 Draft Federal Data Protection Act, Art. 3 (h).
400
D. N. Staiger