Sep 252020

The Swiss Parliament Agrees on the Draft Bill of a New Data Protection Act

William RM Long, Francesca Blythe and Sabrine Schnyder
, , , , , , ,

After three years of discussions and in a final debate, the Swiss parliament has agreed on the final draft bill of a new and modernized data protection law.

In particular, the National Council and the Council of States found a compromise on the these outstanding issues:

  • Definition of the term “profiling” (Article 4 (f) and (fbis) nDPA): The two chambers followed the suggestion of the Council of States to introduce “high risk profiling” in addition to normal “profiling”.
  • Express consent (Article 5(7) nDPA): In accordance with the compromise regarding profiling, express consent will be required for the processing of sensitive personal data as well as for profiling by a Federal authority and “high risk profiling,” as suggested by the Council of States.
  • Justifications in relation to the verification of the creditworthiness of a customer (Article 27(2)(c) nDPA):  According to Article 27(2)(c) nDPA, a violation of the data protection principles set out in the law may be justified if the data controller processes personal data in order to verify the creditworthiness of a customer and if certain conditions are met: (1) the data controller neither processes sensitive data, nor conducts a high risk profiling, (2) the data is only transferred to third parties if required for the conclusion or processing of the contract with the customer, and (3) the processed personal data does not go back more than 10 years (instead of 5 years as originally suggested by the Council of States and the Federal Council).

The Federal Council will set the date for the entry into force of the revised law.  That decision will depend on whether there will be a public vote, as the draft bill is subject to an optional referendum (the time limit for which is 100 days), as well as how fast the Federal Council can update the Ordonnance to the law (regulating some provisions in more detail).

William RM Long

London

wlong@sidley.com

Francesca Blythe

London

fblythe@sidley.com

Sabrine Schnyder

sschnyder@sidley.com

You might also like
UK Sets Out It’s “Pro-Innovation” Approach To AI Regulation

On 29 March 2023, the UK’s Department for Science Innovation and Technology (“DSIT”) published its long awaited White Paper on its “pro-innovation approach to AI regulation” (the “White Paper”), along with a corresponding impact assessment. The White Paper builds on the “proportionate, light touch and forward-looking” approach to AI regulation set out in the policy paper published in July 2022. Importantly, the UK has decided to take a different approach to regulating AI compared to the EU, opting for a decentralised sector-specific approach, with no new legislation expected at this time. Instead, the UK will regulate AI primarily through sector-specific, principles based guidance and existing laws, with an emphasis on an agile and innovation-friendly approach. This is in significant contrast to the EU’s proposed AI Act which is a standalone piece of horizontal legislation regulating all AI systems, irrespective of industry.

How the China Personal Information Protection Law Applies to Foreign Asset Managers

Since China’s Personal Information Protection Law (PIPL) came into effect in November 2021, there has been widespread uncertainty amongst offshore fund managers and investors with entities outside Mainland China as to how and whether the regime applies to them. Given the potential for foreign asset managers to overlook or misinterpret PIPL, this brief update outlines some guidance as to how PIPL can apply, and to whom, in a practical context.

EU Moving Closer to an AI Act – Key Areas of Impact for Life Sciences/MedTech Companies

The European Union is moving closer to adopting the first major legislation to horizontally regulate artificial intelligence. Today, the European Parliament (Parliament) reached a provisional agreement on its internal position on the draft Artificial Intelligence Regulation (AI Act). The text will be adopted by Parliament committees in the coming weeks and by the Parliament plenary in June. The plenary adoption will trigger the next legislative step of trilogue negotiations with the European Council to agree on a final text. Once adopted, according to the text, the AI Act will become applicable 24 months after its entry into force (or 36 months according to the Council’s position), which is currently expected in the second half of 2025, at the earliest.