processing of sensitive personal data or profiling).
15 If such risk is present, the
Federal Data Protection and Information Commissioner must be consulted prior to
the processing. No impact assessment is required if the Controller is certified by a
recognized certification body or complies with a code of conduct. In case of multiple
similar processing activities, the Controller may conduct a general impact assessment which applies across all processing activities. This is in line with the EU
approach which will facilitate the development and usability of standards with
regard to high risk personal data processing. However, it has been criticized as
hindering the common use of profiling which forms the backbone of most of today’s
online business. Some profiling does not necessary involve any high risk for the
individual and thus profiling should not generally require a DPIA without further
factors that substantiate the claim of a high risk.
2.9 Data Breach Obligations
The Swiss FDPA does not contain a requirement to notify a data protection authority
of a data breach. However, in light of the risk-based approach taken by the EU, clear
notification requirements also seem warranted for Switzerland. As small data protection breaches occur on a daily basis, notification requirements should be practicable thus only require notification to the authorities when there is a real and
substantial risk for the affected individuals. Nevertheless, in order to cope with the
higher workload and added responsibility additional funds must be provided to the
Federal Data Protection Supervisor.
2.10 Employee Data
Section 5 of the FDPA regulates data collection and handling by private individuals,
including corporate bodies. Most importantly it governs personality rights and the
legal consequences of violations. This affects employers as well as other data
collectors, as personality rights may only be limited with strict justification under
Article 24 of the data protection code. Although personal data of employees are not
considered as sensitive data in the sense of the legal definition in Article 4, the Swiss
legislator did provide further protection for employee data in the Code of Obligations (Article 328b OR) according to which an employer may only collect and
handle data for which he can provide a legitimate interest for. Such data would
typically include information such as home addresses, banking connections (in order
to pay salary), emergency contacts, and personal information as provided in a CV or
by an employee directly. However, the scope of this provision and its application
15 Draft Federal Data Protection Act, Art. 20.
404
D. N. Staiger
15 If such risk is present, the
Federal Data Protection and Information Commissioner must be consulted prior to
the processing. No impact assessment is required if the Controller is certified by a
recognized certification body or complies with a code of conduct. In case of multiple
similar processing activities, the Controller may conduct a general impact assessment which applies across all processing activities. This is in line with the EU
approach which will facilitate the development and usability of standards with
regard to high risk personal data processing. However, it has been criticized as
hindering the common use of profiling which forms the backbone of most of today’s
online business. Some profiling does not necessary involve any high risk for the
individual and thus profiling should not generally require a DPIA without further
factors that substantiate the claim of a high risk.
2.9 Data Breach Obligations
The Swiss FDPA does not contain a requirement to notify a data protection authority
of a data breach. However, in light of the risk-based approach taken by the EU, clear
notification requirements also seem warranted for Switzerland. As small data protection breaches occur on a daily basis, notification requirements should be practicable thus only require notification to the authorities when there is a real and
substantial risk for the affected individuals. Nevertheless, in order to cope with the
higher workload and added responsibility additional funds must be provided to the
Federal Data Protection Supervisor.
2.10 Employee Data
Section 5 of the FDPA regulates data collection and handling by private individuals,
including corporate bodies. Most importantly it governs personality rights and the
legal consequences of violations. This affects employers as well as other data
collectors, as personality rights may only be limited with strict justification under
Article 24 of the data protection code. Although personal data of employees are not
considered as sensitive data in the sense of the legal definition in Article 4, the Swiss
legislator did provide further protection for employee data in the Code of Obligations (Article 328b OR) according to which an employer may only collect and
handle data for which he can provide a legitimate interest for. Such data would
typically include information such as home addresses, banking connections (in order
to pay salary), emergency contacts, and personal information as provided in a CV or
by an employee directly. However, the scope of this provision and its application
15 Draft Federal Data Protection Act, Art. 20.
404
D. N. Staiger