privacy interest of the individual.
12 However, in practice as soon as sensitive data is
involved the informed consent of the affected individual should be sought.
2.3 Purpose Limitation
The current FDPA also contains a purposes limitation similar to the former EU Data
Protection Directive as well as the new GDPR. This requires the processing that is
being conducted by a private entity to be in conformity with the expectations of the
affected individual present at the time of the data collection and based on the context
of the collection.
13
2.4 Data Subject Rights
The rights of the data subject are set out in section 4 of the FDPA. As described
above, the Swiss legislator does not distinguish between the legal basis of data
collection, hence section 4 provides the general rules and rights that apply to the data
subject. These include mainly access rights in order to provide better transparency
for the data subject. However, the current FDPA does not contain any of the wideranging information and transparency provisions that are present in the GDPR.
Rather an internal check is imposed whether the data processing meets the expectations of the individual concerned. With the draft FDPA the information requirements will be expanded to fulfil those of the GDPR. However, it is currently debated
whether the draft FDPA will fall short of the current GDPR with regard to the rights
of individuals.
No court fees are charged in disputes relating to data protection. Further, no fee
shall be charged to data subjects for exercising their right of access, subject to any
exceptions that may be provided for by way of ordinance.
2.5 Automated Decision Making
Controllers must upon request inform the data subject of automated decisions that
are carried out on their personal data (i.e. decisions taken solely on the basis of
automated data processing) which result in legal consequences or significant impairment and give the data subject the opportunity to comment on such decisions.
Controllers are exempt from such information duties in particular if the data subject
12 Federal Data Protection Act, Art. 12 and 13.
13 Federal Data Protection Act, Art 4(3).
402
D. N. Staiger
12 However, in practice as soon as sensitive data is
involved the informed consent of the affected individual should be sought.
2.3 Purpose Limitation
The current FDPA also contains a purposes limitation similar to the former EU Data
Protection Directive as well as the new GDPR. This requires the processing that is
being conducted by a private entity to be in conformity with the expectations of the
affected individual present at the time of the data collection and based on the context
of the collection.
13
2.4 Data Subject Rights
The rights of the data subject are set out in section 4 of the FDPA. As described
above, the Swiss legislator does not distinguish between the legal basis of data
collection, hence section 4 provides the general rules and rights that apply to the data
subject. These include mainly access rights in order to provide better transparency
for the data subject. However, the current FDPA does not contain any of the wideranging information and transparency provisions that are present in the GDPR.
Rather an internal check is imposed whether the data processing meets the expectations of the individual concerned. With the draft FDPA the information requirements will be expanded to fulfil those of the GDPR. However, it is currently debated
whether the draft FDPA will fall short of the current GDPR with regard to the rights
of individuals.
No court fees are charged in disputes relating to data protection. Further, no fee
shall be charged to data subjects for exercising their right of access, subject to any
exceptions that may be provided for by way of ordinance.
2.5 Automated Decision Making
Controllers must upon request inform the data subject of automated decisions that
are carried out on their personal data (i.e. decisions taken solely on the basis of
automated data processing) which result in legal consequences or significant impairment and give the data subject the opportunity to comment on such decisions.
Controllers are exempt from such information duties in particular if the data subject
12 Federal Data Protection Act, Art. 12 and 13.
13 Federal Data Protection Act, Art 4(3).
402
D. N. Staiger