have come under scrutiny by the courts and have resulted in conflicting judgements.
Thus, it remains to be seen what effect this section will have in light of the new
dFDPA.
Use of electronic means by employees is not regulated by law, though; many
companies regulate the use internally, as they need to comply with other regulations.
For example, the banking sector must comply with financial market law, professional secrecy laws and client confidentiality. In order to do so, the way in which
employees may use electronic means and to what extent may be strictly governed by
corporate regulations and compliance procedures within the company.
2.11 Enforcement
The FDPA—like many statutes—has in addition to the Swiss Penal Code, its own
penal provisions at the end in Section 8 (so called “Nebenstrafrecht”). Therein,
sanctions are provided for the violation of the duty of disclosure, reporting obligations, duty to collaborate, due diligence as well as the violation of non-disclosure
obligations. The non-disclosure obligations are the only obligations sanctioned by a
potential prison sentence of up to 3 years or financial penalty within the data
protection code. All other violations are sanctioned by fines of up to 500,000 CHF
and a reduced amount of up to 250,000 CHF in case of negligence. Fines are issued
by the Federal Data Protection and Information Commissioner’s Office and may be
imposed on the company as well as the responsible person.
3 Special Processing Situations
The draft FDPA provides a central regulatory framework. However, Swiss legislators have decided not to include issues such as Big Data at this time (at least not in a
structured way). The FDPA merely touches topics including access rights, privacy
by design and default and data protection impact assessments. This creates a degree
of legal uncertainty for the online marketing sector, as much leeway in the interpretation of certain provisions is available similar to the GDPR.
The framework formulates basic data protection principles that are now common
standard across the EU. The principle of data protection by default is now also a part
of the draft FDPA, which requires companies to apply by default the highest data
protection setting to their services and only to reduce these settings if the customer or
user wishes to do so.
16 Furthermore, consent must be given voluntarily and freely.
16 See for example the European Data Protection Board, Preliminary Opinion on privacy by design,
https://edps.europa.eu/sites/edp/files/publication/18-05-31_preliminary_opinion_on_privacy_by_
design_en_0.pdf.
Swiss Data Protection Law
405
Thus, it remains to be seen what effect this section will have in light of the new
dFDPA.
Use of electronic means by employees is not regulated by law, though; many
companies regulate the use internally, as they need to comply with other regulations.
For example, the banking sector must comply with financial market law, professional secrecy laws and client confidentiality. In order to do so, the way in which
employees may use electronic means and to what extent may be strictly governed by
corporate regulations and compliance procedures within the company.
2.11 Enforcement
The FDPA—like many statutes—has in addition to the Swiss Penal Code, its own
penal provisions at the end in Section 8 (so called “Nebenstrafrecht”). Therein,
sanctions are provided for the violation of the duty of disclosure, reporting obligations, duty to collaborate, due diligence as well as the violation of non-disclosure
obligations. The non-disclosure obligations are the only obligations sanctioned by a
potential prison sentence of up to 3 years or financial penalty within the data
protection code. All other violations are sanctioned by fines of up to 500,000 CHF
and a reduced amount of up to 250,000 CHF in case of negligence. Fines are issued
by the Federal Data Protection and Information Commissioner’s Office and may be
imposed on the company as well as the responsible person.
3 Special Processing Situations
The draft FDPA provides a central regulatory framework. However, Swiss legislators have decided not to include issues such as Big Data at this time (at least not in a
structured way). The FDPA merely touches topics including access rights, privacy
by design and default and data protection impact assessments. This creates a degree
of legal uncertainty for the online marketing sector, as much leeway in the interpretation of certain provisions is available similar to the GDPR.
The framework formulates basic data protection principles that are now common
standard across the EU. The principle of data protection by default is now also a part
of the draft FDPA, which requires companies to apply by default the highest data
protection setting to their services and only to reduce these settings if the customer or
user wishes to do so.
16 Furthermore, consent must be given voluntarily and freely.
16 See for example the European Data Protection Board, Preliminary Opinion on privacy by design,
https://edps.europa.eu/sites/edp/files/publication/18-05-31_preliminary_opinion_on_privacy_by_
design_en_0.pdf.
Swiss Data Protection Law
405