The Swiss-US-Privacy Shield offered so far to Swiss and US companies the opportunity to comply with Swiss data protection regulations when transferring personal data from Switzerland to the USA or making data in Switzerland accessible in order to support transatlantic trade. On 12 April 2017, the US Department of Homeland Security (DHS) announced that the newly launched Swiss-US Privacy Shield accepted self-certification. Such self-certification has been acknowledged on the Privacy Shield’s website by the US Citizenship and Immigration Services (USCIS) in Washington D.C. and the Federal Bureau of Investigation (FBI). This Swiss-US Privacy Shield system involving the US Department of Homeland Security and the FBI in the US had replaced the previous Swiss Safe Harbor self declaration.In his communication of 8 September 2020, the FDPIC[1] reports that the reference to the USA in the list of states[2] has been shifted from “adequate data protection under certain conditions” to “the rights under the Swiss-US Privacy Shield do not meet the requirements of adequate data protection” as defined by the Swiss Federal Act on Data Protection (Swiss FADP)[3].
Listing National Data Protection Levels
The list of states serves as a tool for Swiss data exporters and provides a general assessment by the authorities of the level of data protection in the listed countries. The list has no binding character and is refutable. The list does not free data exporters of their obligation to question the presumed level of protection if there are indications of data protection risks in a specific case nor, if necessary, to apply safeguards in accordance with Art. 6 Para. 2 FADP – or even to refrain from exporting data altogether.[4]
Evaluation Criteria
The FDPIC applies the following criteria to determine the level of data protection in a country:
- Legislation and its practical application by the individual countries and how this legislation is assessed by academia and courts;
- Conventions, publications, official statements and decisions by domestic and foreign institutions and authorities on the equivalence or adequacy of the level of data protection afforded by other countries or international organizations.
Valid But Ineffective
The Swiss-US Privacy Shield was created as part of an exchange of letters between Switzerland and the United States. It is therefore a form of international treaty. Such a treaty can only be terminated in accordance with principles of international law. In Switzerland, the termination of an international treaty is subject to a parliamentary approval decision in accordance with Art. 24 of the Swiss Parliament Act and is subsequently pronounced by the Federal Council.
Sources:
[1] https://www.edoeb.admin.ch/edoeb/en/home/latest-news/media/medienmitteilungen.msg-id-80318.html
[2] https://www.newsd.admin.ch/newsd/message/attachments/62783.pdf .
[3] Federal Act of 19 June 1992 on Data Protection (SR 235.1, FADP), https://www.admin.ch/opc/de/classified-compilation/19920153/index.html .
[4] https://www.newsd.admin.ch/newsd/message/attachments/62791.pdf , para. 1.Switzerland, together with the countries of the European Union (EU), the European Economic Area (EEA), and some non-European countries belong to a group of nations, which mutually assume the existence of an equivalent and adequate level of data protection in the sense of Art. 6 Para. 1 FADP. This means that, generally, personal data can be transferred between Switzerland and other countries in the group without any additional special safeguards within the meaning of Art. 6 Para. 2 FADP, as it is the case for data transfers in a domestic context.
When this group of countries assesses the adequacy of another country’s data protection levels, there is a shared expectation between these countries, that the list of countries will be kept updated in such a way that the level of protection considered mutually adequate will be respected at all times by all countries. A mutual need for coordination arises in particular when the adequacy of a third country has been reassessed, as it is currently the case in the EU/EEA Member States4 following the latest ruling by the Court of Justice of the European Union (CJEU) with regard to the USA.[1]
Therefore, Switzerland takes into consideration the developments in the EU.
[1] CJEU, decision of 16 July 2020 in case C-311/18, CRi 2020, 109 – Schrems II.