The State Political Commission of the National Council has taken the following decisions by amending the draft Data Protection Act (BBl 2017 7193):
Appointment of the Data Protection and Publicity Officer
The Data Protection Commissioner should be elected by the Federal Assembly at the request of the Commission and not by the Federal Council with subsequent approval by the Federal Assembly as has been the case up to now. From the Commission’s point of view, the independence of this position can thus be better guaranteed.
Right to data transferability
In future, any person should be able to require a service provider to provide personal data relating to him in a standard format so that he can transfer them to another service provider. This provision gives rise to a right to the surrender or transfer of certain personal data disclosed to the person responsible. If certain conditions are met, the enforcement of these rights should be free of charge.
Particularly sensitive personal data
Some adjustments have been made to the definition of personal data for which a special level of protection applies. The State Policy Commission has no longer included information on social assistance measures in the list of particularly sensitive data. This is justified by the fact that the information on the receipt of social assistance can be in the interest of the contracting parties, the provider or even the public. The data on trade union activities are also no longer listed, in deviation from the DSGVO. New personal data with a special level of protection include genetic data, while biometric data have probably been forgotten.
Foreign companies
Foreign companies must comply with Swiss data protection law and must appoint a domestic representative.
Data of deceased persons
No separate regulation, as envisaged by the Federal Council in the draft, will be created for the handling of the data of deceased persons. In the Commission’s view, there are already sufficient possibilities for the problems arising in this context.
Sanctions
In the new version, the Data Protection Act does not receive any administrative sanctions, but only criminal sanctions. The reason given for this is that the amendment simplifies the application of the law. Legal persons can only be sanctioned in certain cases, otherwise the penalty is limited to natural persons. The maximum fine is CHF 250,000, which the Commission considers appropriate and sufficient deterrent.
Two-year adjustment period for companies
In order to allow companies sufficient time to make the necessary adjustments, the new law will enter into force two years after the referendum deadline or a referendum.
Sources:
Press release of the Parliament of 16.08.2019, “COMMISSION CONCLUSES ADVISING THE REVISION OF THE DATA PROTECTION LAW”, (as at 11.09.2019)
Draft Federal Act on the Total Revision of the Federal Act on Data Protection and the Amendment of Other Decrees on Data Protection, (as at: 11.09.2019)