has expressly consented to such processing or if the decision relates directly to the
execution or performance of a contract. This stands in stark contrast to the GDPR
which requires prior notice through for example the data protection policy in order to
allow the individual to understand and assess the data processing that will be
undertaken.
2.6 Protection of Minors
The FDPA does not contain any clauses with regard to minors. However, the view in
the legislative process is that the current protections under Swiss civil law are
sufficient and the revised FDPA does not require specific protections such as the
ones that are contained in the GDPR. This may present a point of controversy for
enterprises that operate in various EU jurisdictions as well as Switzerland as they are
required to undergo legal assessments in every country and to adjust their service
offering according to origin of the user. Such as situation hinders business and
should be addressed through a universal standard.
2.7 Right to Be Forgotten
Currently Switzerland does not have a right to be forgotten similar to the
EU. However, the new draft FDPA contains a conclusive list of legal claims against
data handling by any natural person and is to be understood as an extension of the
protection of personality rights. The list includes the right to be forgotten, right to
rectification, and the right to forbid data handling. As Switzerland is debating the
extent to which it wants to follow EU law and the GDPR it remains to be seen what
the effect of such a right to be forgotten will be and the extent to which it will be
applicable in light of vast legal data retention requirements that cover nearly all
business communication.
14
2.8 Data Protection Impact Assessment
Controllers must conduct an impact assessment if processing may lead to a high risk
for the data subject’s privacy or fundamental rights (e.g. in case of extensive
14 For more details on the current state see the draft Federal Data Protection Act https://www.admin.
ch/opc/de/federal-gazette/2017/7193.pdf and the parliamentary discussion https://www.parlament.
ch/de/ratsbetrieb/amtliches-bulletin/amtliches-bulletin-die-verhandlungen?SubjectId¼43570.
Swiss Data Protection Law
403
execution or performance of a contract. This stands in stark contrast to the GDPR
which requires prior notice through for example the data protection policy in order to
allow the individual to understand and assess the data processing that will be
undertaken.
2.6 Protection of Minors
The FDPA does not contain any clauses with regard to minors. However, the view in
the legislative process is that the current protections under Swiss civil law are
sufficient and the revised FDPA does not require specific protections such as the
ones that are contained in the GDPR. This may present a point of controversy for
enterprises that operate in various EU jurisdictions as well as Switzerland as they are
required to undergo legal assessments in every country and to adjust their service
offering according to origin of the user. Such as situation hinders business and
should be addressed through a universal standard.
2.7 Right to Be Forgotten
Currently Switzerland does not have a right to be forgotten similar to the
EU. However, the new draft FDPA contains a conclusive list of legal claims against
data handling by any natural person and is to be understood as an extension of the
protection of personality rights. The list includes the right to be forgotten, right to
rectification, and the right to forbid data handling. As Switzerland is debating the
extent to which it wants to follow EU law and the GDPR it remains to be seen what
the effect of such a right to be forgotten will be and the extent to which it will be
applicable in light of vast legal data retention requirements that cover nearly all
business communication.
14
2.8 Data Protection Impact Assessment
Controllers must conduct an impact assessment if processing may lead to a high risk
for the data subject’s privacy or fundamental rights (e.g. in case of extensive
14 For more details on the current state see the draft Federal Data Protection Act https://www.admin.
ch/opc/de/federal-gazette/2017/7193.pdf and the parliamentary discussion https://www.parlament.
ch/de/ratsbetrieb/amtliches-bulletin/amtliches-bulletin-die-verhandlungen?SubjectId¼43570.
Swiss Data Protection Law
403