to understand and make informed decisions if she or he wishes to be subject to a
particular data processing.
2.1 Scope
Neither the FDPA nor the proposed draft contains any remarks as to the territorial
scope of the data protection law. Nonetheless, the FDPA is a national law and
therefore the territorial principle is applied limiting the scope to conduct in Switzerland. This means in fact, that the law is applicable to any data handling occurring
within Switzerland. This has also been firmly established in a decision of the Swiss
Federal Administrative Tribunal against Google in 2011 (A-7040/2009).
11
The transfer of personal data to another country is regulated in Articles 5 and 6 of
the FDPA. Namely, personal data can be transferred if the Swiss Federal Government has determined that the foreign jurisdiction provides an equivalent level of
protection for the data handled. If there is no determination available as to the data
protection level of a foreign jurisdiction, exceptions under Article 5 paragraph
3 FDPA may apply. Under no circumstances can data be transmitted if personality
and privacy rights of the data subject are severely threatened.
Damages as well as compensation for pain and suffering are subject to
civil actions governed by the Swiss Civil Code. However, this process is costly
and is seldom used by individuals. The most likely result of a breach will be a
complaint to the local data protection authority. However, their powers and remedies
are currently limited.
The following four specific situations are not subject to the FDPA. These involve
the data collection for the purposes of personal use, consultation of federal councils
and commissions, handling by a neutral judicial authority as well as data handling by
institutions as determined by “host state” legislation.
2.2 Legal Basis for Processing
In order to process personal data a legal basis must be available to the private entity.
However, in comparison to the EU General Data Protection Regulation the current
FDPA allows for much more leeway as many of the processing activities can be
carried out as long as they are not infringing the privacy rights of the individual. For
this to apply, however, the context of the data collection, the expectations of the
individual, the information provided and the limitation of the processing are key
factors. If sensitive personal data is involved either the consent of the individual is
required, or alternatively a public or private interest is applicable that outweighs the
11 Google Street View decision A-7040/2009, https://www.bvger.ch/bvger/de/home/medien/
medienmitteilungen-archiv-2002%2D%2D-2016/2011.html.
Swiss Data Protection Law
401
particular data processing.
2.1 Scope
Neither the FDPA nor the proposed draft contains any remarks as to the territorial
scope of the data protection law. Nonetheless, the FDPA is a national law and
therefore the territorial principle is applied limiting the scope to conduct in Switzerland. This means in fact, that the law is applicable to any data handling occurring
within Switzerland. This has also been firmly established in a decision of the Swiss
Federal Administrative Tribunal against Google in 2011 (A-7040/2009).
11
The transfer of personal data to another country is regulated in Articles 5 and 6 of
the FDPA. Namely, personal data can be transferred if the Swiss Federal Government has determined that the foreign jurisdiction provides an equivalent level of
protection for the data handled. If there is no determination available as to the data
protection level of a foreign jurisdiction, exceptions under Article 5 paragraph
3 FDPA may apply. Under no circumstances can data be transmitted if personality
and privacy rights of the data subject are severely threatened.
Damages as well as compensation for pain and suffering are subject to
civil actions governed by the Swiss Civil Code. However, this process is costly
and is seldom used by individuals. The most likely result of a breach will be a
complaint to the local data protection authority. However, their powers and remedies
are currently limited.
The following four specific situations are not subject to the FDPA. These involve
the data collection for the purposes of personal use, consultation of federal councils
and commissions, handling by a neutral judicial authority as well as data handling by
institutions as determined by “host state” legislation.
2.2 Legal Basis for Processing
In order to process personal data a legal basis must be available to the private entity.
However, in comparison to the EU General Data Protection Regulation the current
FDPA allows for much more leeway as many of the processing activities can be
carried out as long as they are not infringing the privacy rights of the individual. For
this to apply, however, the context of the data collection, the expectations of the
individual, the information provided and the limitation of the processing are key
factors. If sensitive personal data is involved either the consent of the individual is
required, or alternatively a public or private interest is applicable that outweighs the
11 Google Street View decision A-7040/2009, https://www.bvger.ch/bvger/de/home/medien/
medienmitteilungen-archiv-2002%2D%2D-2016/2011.html.
Swiss Data Protection Law
401