With the revision of the Federal Act on Data Protection in Switzerland (nFADP), introduced by Parliament on September 25, 2020, some important provisions regarding the processing of personal data are changing. Swiss companies will have to comply by September 1, 2023, the date on which the law comes into force.

What exactly does the new FADP involve?

After a legislative process lasting almost four years, the first FADP issued in 1992 has been completely revised with the main purpose of protecting the personality and fundamental rights of natural persons whose personal data is being processed. The Data Protection Act has been adapted, on the one hand, to ensure greater security in the face of a constantly evolving technological and social context. On the other hand, the revision guarantees compatibility with the European General Data Protection Regulation (GDPR) in force within the EU territory, in order to avoid competitive disadvantages for Swiss companies.

What are the main changes introduced by the FADP?

• New scope of application. The FADP, like the GDPR, is limited to protecting processed data relating to natural persons and does not concern legal entities.
• Broader extension. Genetic and biometric data are now also classified as sensitive personal data.
• Greater transparency. The identity and contact details of the data controller, the purpose of the processing, the recipients or categories of recipients, and the recipient country in the event of data export abroad must be communicated. In this respect, the new FADP is even stricter than the GDPR.
• Privacy by design. Requires companies to protect processed data with appropriate technical and organizational measures from the design and planning stages of the processing itself.
• Privacy by default. Ensures that only the data strictly necessary for each specific processing purpose is processed by default.
• Profiling. Unlike the GDPR, there is no general obligation to request consent for automated data processing. This applies when evaluating certain personal aspects of a subject, such as economic situation, health status, interests, behavior, location, etc.
• Data protection impact assessment. Requires companies to carry out a documented assessment of high risks to the personality or fundamental rights of the data subject.
• Record of processing activities. Companies are required to constantly maintain and update a register containing the prescribed information.
• For the communication of personal data abroad, the Federal Council must have determined that the recipient State guarantees an adequate level of data protection.
• Timely notification to the FDPIC. In the event of a data security breach, rapid notification to the Federal Data Protection and Information Commissioner is required.

What sanctions are provided for?

In addition to the possible sanctions imposed by the Federal Data Protection Commissioner, fines of up to CHF 250,000 and criminal proceedings are provided for non-compliant private individuals. Should you require further information regarding Data Protection in Switzerland, we invite you to contact our consultants at the Lugano office.