On 18 December 2019, the Council of States as second chamber debated and adopted the proposal of the completely revised Federal Act on Data Protection in its overall vote. The council adopted almost all amendments to the draft law of the Federal Council and to the amendments made by the National Council that were suggested by the Political Institution Committee of the Council of States in November 2019. The small chamber solely rejected the very far-reaching suggestion of the committee that every transfer of personal data should require the consent of the data subject.
Changes to draft law of Federal Council and to amendments of National Council
In view of implementing the new data protection legislation, companies should evaluate, in particular, the following changes to the draft law of the Federal Council and to the National Council’s amendments thereto:
- Definition of sensitive personal data: Data on trade union-related views or activities shall remain to be mentioned explicitly in the definition of sensitive personal data, as it was in the draft law of the Federal Council. Furthermore, as stated in the draft law of the Federal Council, genetic data shall not only be considered as sensitive personal data if it serves to uniquely identify a person. This additional requirement requested by the National Council shall be discarded.
- Profiling with high risk: The new law shall differentiate between “profiling” and “profiling with high risk” and shall include an additional definition for the latter. Requirements to be fulfilled for data processing activities in connection with profiling with high risk shall be more stringent, requiring, in particular, the explicit consent of the data subject.
- Breach of data security: To be qualified as a breach of data security, the loss, deletion, destruction, alteration and unauthorized disclosure of, or access to personal data must always be unintentional or unlawful.
- Extent of and exceptions from the obligation to provide information: A list of the data subjects’ rights and the controller’s intention of processing data in order to verify data subjects’ credit worthiness and a potential disclosure of this data to third parties shall be added to the statutory minimum list of information to be provided to the data subject. Furthermore, it shall not be possible to use a disproportional effort as justification for not providing the information.
- Extent of the right to access: The data subject shall always be informed if data is being processed for the verification of his or her credit worthiness and for an automated individual decision-making. In addition, the controller must inform data subjects about the logic on which the processing and the decision, respectively, are based.
- Intra group exemption: In connection with the requirements for the limitation of the obligation to provide information and of the access right, as well as with the acknowledged overriding interest for the processing of competitors’ data, companies that are controlled by the same legal person are not considered as third parties when disclosing data. The Council of States has instructed the National Council to review, during its next debate, if this exemption shall apply also to cooperatively organized companies.
- Sanctioned duty of care breach: As suggested by the draft law of the Federal Council, a breach of the minimum standard for data security shall be sanctioned with a fine of up to CHF 250,000.
The Council of States has amended all provisions of the draft law of the National Council which were considered critical for obtaining the European Commission’s adequacy decision. It can be assumed that the draft law in the current version adopted by the Council of States would fulfill the requirements of the EU regarding adequacy of the Swiss data protection level.
The National Council is, at first, expected to debate the bill in the upcoming spring session 2020 during a procedure for the resolution of differences. Depending on when the same procedure will take place in the Council of States, the final version of the draft law may be adopted already during the spring session 2020 or only in the summer session 2020.