Sep 82020

Swiss Data Protection Authority Concludes Swiss-US Privacy Shield No Longer Valid for Swiss-US Transfers

William RM Long, Sabrine Schnyder and Francesca Blythe
, , ,

Following the Court of Justice of the European Union’s (“CJEU”) decision in Data Protection Commissioner v Facebook Ireland Ltd and Maximillian Schrems (“Schrems II”), the Swiss Federal Data Protection and Information Commissioner (“FDPIC”) concluded in a position paper published on 8 September that the Swiss-US Privacy Shield no longer provides a valid mechanism for the transfer of personal data from Switzerland to the US.

Although the Swiss-U.S. Privacy Shield has not officially been invalidated by the Swiss Federal Council and therefore still remains in force, given these conclusions of the FDPIC, organizations relying on the Swiss-US Privacy Shield should look for alternative data transfer mechanisms in order to legitimize transfers of personal data from Switzerland to the US, e.g., standard contractual clauses (“SCCs”).

The FDPIC has not yet opined on the validity of the use of SCCs and, in particular, the need to implement additional safeguards to protect personal data transferred to certain third countries (e.g., China, India and the US).  However, given the CJEU’s judgment in Schrems II and the subsequent guidance published by the European Data Protection Board (“EDPB”), organizations based in Switzerland should monitor this issue very closely.

This post is as of the posting date stated above. Sidley Austin LLP assumes no duty to update this post or post about any subsequent developments having a bearing on this post.

William RM Long

London

wlong@sidley.com

Sabrine Schnyder

Francesca Blythe

London

fblythe@sidley.com

You might also like
Biometric Litigation Risks Endure Even Post BIPA Amendment

Enacted in 2008, the Illinois Biometric Information Privacy Act (“BIPA”) regulates the collection and possession of biometric data by private entities operating in Illinois. Biometric data includes, for example, fingerprints, voiceprints, eye scans, and face/hand scans. Notably, BIPA establishes a private right of action, allowing any person to seek damages, attorneys’ fees, and injunctive relief if the person has been aggrieved by a BIPA violation. The statutory damages for BIPA violations are steep, including $1,000 to $5,000 per violation, attorneys’ fees and costs, and the possibility of injunctive relief.

Massachusetts’ Highest Court Signals Willingness to Scrutinize State Wiretapping Laws and Knock Out Claims at the Pleading Stage

For the past few years, hundreds of companies have been caught in a wave of privacy class actions relying on decades-old wiretapping laws to attack modern website technologies and business tools. Last week, Massachusetts’s highest court engaged in a thorough assessment of that state’s wiretap law and rejected plaintiff’s argument that commonly used website advertising and analytical tools intercepted “communications” in violation of the law. The basis for the suit is not novel — hundreds of similar cases have been filed in the past few years. But the Supreme Judicial Court’s willingness to engage in a deep analysis of the wiretapping law early in the case is noteworthy.

Second Circuit Offers Guidance on Meaning of “Consumer” Under the U.S. Video Privacy Protection Act

Yesterday, in Salazar v. National Basketball Association, the Second Circuit Court of Appeals reversed a district court’s dismissal of a putative class action under the Video Privacy Protection Act (VPPA), offering an interpretation of the VPPA’s definition of “consumer” that differs from how the majority of courts have used that term.