<h3>What is the EU Cyber Resilience Act?</h3>
<p>The CRA establishes horizontal cybersecurity requirements for products with digital elements that are made available on the EU/EEA market. Its primary goal is to enhance cybersecurity across the EU/EEA by ensuring that hardware and software products and their remote data processing solutions are designed, developed, and maintained with fewer vulnerabilities throughout their lifecycle.</p>
<h3>Which Products are Covered by the EU Cyber Resilience Act?</h3>
<p>So-called &#8220;products with digital elements&#8221; covered by the CRA include hardware and software products that are intended or foreseeable to operate with connectivity to other devices or networks. This includes a broad variety of connected products, such as laptops, smartphones, tablets, fitness trackers, drones, routers, browsers, baby phones, surveillance cameras with remote access, smart home appliances, and remote-controlled or connected machinery and factory equipment.</p>
<p>In each case, the CRA does not only apply to the connected product as such, but also to its remote data processing solution. This includes cloud-enabled functionalities of connected products that enable users to control the product at a distance. For other cloud computing services, such as software as a service (SaaS), platform as a service (PaaS) or infrastructure as a service (IaaS), the cybersecurity requirements of NIS 2 Directive (EU) 2022/2555 (<strong>NIS 2 Directive</strong>) apply if the relevant service provider is deemed an essential or important entity under the relevant national implementation laws of the NIS 2 Directive.</p>
<p>The CRA is the first horizontal regulation applicable to products with digital elements across all sectors. Before the CRA, the EU had only vertical, sector-specific cyber security requirements, such as in the field of medical devices, motor vehicles, civil aviation or marine equipment. These sector-specific regulations remain in force and products regulated under the relevant acts are exempt from the CRA. Likewise, products with digital elements developed or modified exclusively for national security or defense purposes are outside the scope of the CRA.</p>
<h3>How Are Swiss Companies Affected by the EU Cyber Resilience Act?</h3>
<p>The CRA applies if products with digital elements are made available on the EU/EEA market. Manufacturers and distributors domiciled outside the EU/EEA have to ensure compliance with the CRA if they make their covered products available in the EU/EEA. Given the EU/EEA&#8217;s significance as a primary sales market for numerous Swiss industries, the CRA will notably affect companies in Switzerland. Moving forward, exporters of products under the CRA will need to comply with the CRA.</p>
<h3>What Are the Main Obligations Under the EU Cyber Resilience Act?</h3>
<p>The main obligations under the CRA apply to manufacturers of products with digital elements and include the following:</p>
<ul>
<li><strong>Product requirements</strong>: Manufacturers must ensure compliance with the essential cybersecurity requirements defined in Annex I to the CRA when placing a product with digital elements on the market, e.g., they must design and manufacture digital products to avoid known vulnerabilities and regularly update products to address security flaws. If components sourced from third parties are integrated into a product, the manufacturer must exercise due diligence so that those components do not compromise the cybersecurity of the product.</li>
<li><strong>Continuous risk assessment</strong>: Manufacturers must perform a cybersecurity risk assessment regarding the relevant product with digital elements. The cybersecurity risk assessment must be documented and updated during the support period. The support period shall reflect the length of time during which the product is expected to be in use, but is generally at least five years. The support period for a product may vary depending on its characteristics, often being longer for durable goods like fridges compared to smartphones. Manufacturers should also carefully select advertising language. Promising &#8220;lifelong happiness&#8221; with a device could imply a support obligation under the CRA for the user&#8217;s lifetime.</li>
<li><strong>Documentation and information</strong>: Before the product with digital elements is placed on the market, the manufacturer must draw up a technical documentation with all relevant details of the means used by the manufacturer to ensure that the product complies with the CRA. The manufacturer must keep the technical documentation at the disposal of the market surveillance authorities for at least 10 years after the product has been placed on the market or for the support period, whichever is longer. In addition, manufacturers must ensure that the product with digital elements is accompanied with the minimum information and instructions according to Annex II of the CRA (including the contact details of the manufacturer, the intended purpose of the product and the end-date of the support period).</li>
<li><strong>Reporting</strong>: Manufacturers must report any actively exploited vulnerability contained in the product and any severe incident having an impact on the security of the product to a designated Computer Incident Response Team (CSIRT) and the EU Agency for Network and Information Security (ENISA). For this purpose, the manufacturer must submit an early warning notification of an incident without undue delay and in any event within 24 hours of the manufacturer becoming aware of it. In addition, a detailed report on the incident must be submitted without undue delay, but at the latest within 72 hours, and a final report within 14 days.</li>
<li><strong>Conformity assessment</strong>: Manufacturers must perform a conformity assessment of the product with digital elements to determine whether the essential cybersecurity requirements set out in Annex I to the CRA are met. The EU differentiates between different product categories and classes and imposes stricter obligations the higher the criticality of the product. For the majority of products subject to the CRA, a self-assessment by the manufacturer will be sufficient to assess safety. For important and critical products, an assessment by a third party is required.</li>
</ul>
<p>While the bulk of obligations applies to manufacturers, the CRA contains a set of reduced duties for the other actors in the supply chain of a product with digital elements. For instance, distributors of products with digital elements must act with due care, verify that the manufacturer has complied with its duties under the CRA relevant to the distributor&#8217;s operations and collaborate with the relevant market surveillance authorities.</p>
<h3>When Will the EU Cyber Resilience Act Come Into Effect?</h3>
<p>The CRA will enter into force on December 10, 2024, and is set to actually apply starting December 11, 2027, giving companies a three-year transition period to comply with the new requirements. Products with digital elements that have been placed on the market before that date, can also be subject to the CRA if, from that date, these products are substantially modified, e.g., in the event of a software update that changes the intended purpose of the product or if new features are added to a product.</p>
<p>Certain provisions of the CRA will be enforceable already earlier: The reporting obligations of manufacturers of products with digital elements will apply from September 11, 2026. Even earlier than that, the EU/EEA Member States must establish the regulatory infrastructure required to enforce the CRA, i.e., they must notify the EU Commission of bodies authorized to carry out conformity assessments under the CRA (conformity assessment bodies or notified bodies), ensure appeal procedures against decisions of the notified bodies and designate notifying authorities. These duties of EU/EEA Member States apply from June 11, 2026.</p>
<h3>What Are the Sanctions for Violations of the CRA?</h3>
<p>The CRA provides for administrative fines up to EUR 15 million or 2.5% of the company&#8217;s global annual turnover, whichever is higher. In addition to fines, the national market surveillance authority can take appropriate steps to prohibit or restrict a non-compliant product with digital elements from being made available on its national market, to withdraw it from that market, or to recall it if an economic operator does not take adequate corrective action intended to make the product comply with the CRA.</p>
<h3>Does Switzerland Have a Law Similar to the EU Cyber Resilience Act?</h3>
<p>Switzerland does not have a dedicated horizontal act for cybersecurity of products with digital elements, like the CRA.</p>
<p>The Swiss horizontal product safety regulation, the Product Safety Act (PSA), applies to hardware and software, including products of the kind covered by the CRA, but it does not include specific cybersecurity requirements. Horizontal cybersecurity requirements are provided for in the Swiss Federal Act on Data Protection (<strong>FADP</strong>; see our Bulletin <a href="https://www.homburger.ch/en/insights/revision-of-the-swiss-data-protection-law-is-complete" target="_blank" rel="noopener">here</a>), insofar as the processing of personal data is at issue. In addition, sector-specific regulation addressing aspects of cybersecurity exists, such as the FINMA Circular 2023/1 on Operational Risks and Resilience. In a wider context, the revised Swiss Information Security Act (ISA), expected to come into force on January 1, 2025, provides for a duty of critical infrastructures to report cyberattacks to the National Cyber Security Centre (NCSC) and thus replicates obligations that are prescribed by the NIS 2 Directive in the EU.</p>
<h3>Which Other Laws Apply When Bringing Digital Products to Market?</h3>
<p>The EU has enacted comprehensive legislation to harmonize the digital market. In some cases, similar Swiss laws exist. These other EU and Swiss laws may need to be observed cumulatively if a company intends to make a product with digital elements available on the market. In particular, the following provisions may apply:</p>
<ul>
<li>General Data Protection Regulation (<strong>GDPR</strong>). The GDPR applies if personal data of individuals is processed in the context of the product. Similarly, the FADP needs to be complied with in such a case.</li>
<li>Artificial Intelligence (<strong>AI</strong>) Act (<strong>EU AI Act</strong>): The EU AI Act applies if AI systems or general purpose AI models are used in the context of the product (see our Bulletin on the EU AI Act <a href="https://www.homburger.ch/de/insights/eu-ai-act-enters-into-force-on-august-1-2024" target="_blank" rel="noopener">here</a>). Switzerland does not (yet) have a law similar to the EU AI Act. It is expected that the Swiss Federal Council will inform end of 2024 or early 2025 how it intends to regulate AI.</li>
<li>Data Act: If the product with digital elements is a connected product or a related service of the so-called internet of things (<strong>IoT</strong>), the Data Act applies. Switzerland does not have a law similar to the Data Act regulating the handling of personal and non-personal data in the context of the IoT.</li>
</ul>
<h3>Action Points for Swiss Companies</h3>
<p>To prepare for the CRA, Swiss companies should undertake the following initial steps:</p>
<ul>
<li><strong>Assess CRA scope</strong>: Swiss companies making products available in the EU/EEA should assess whether they are in scope of the CRA.</li>
<li><strong>Assess current compliance</strong>: Companies in scope of the CRA should evaluate current products and systems against the CRA requirements to identify any gaps in compliance.</li>
<li><strong>Implement necessary changes</strong>: Companies in scope of the CRA must ensure compliance with the CRA until the relevant provisions enter into force. If necessary, they must update security protocols, product designs, and compliance processes as needed to meet CRA standards. Companies should also review and adapt their contractual provisions to require their business partners (e.g., suppliers of components for products with digital elements) to comply with the CRA.</li>
<li><strong>Conduct regular training</strong>: Companies in scope of the CRA should train staff on CRA requirements and the importance of cyber resilience.</li>
<li><strong>Establish continuous monitoring</strong>: Companies in scope of the CRA should set up systems to continuously monitor compliance with CRA standards to swiftly address any deviations or updates.</li>
</ul>
<p>These proactive measures will help Swiss companies navigate CRA regulations effectively and maintain access to the EU/EEA market.</p>


20241128_Bulletin_Preview_EU-Cyber-Resilience-Act_1000x1000

EU Cyber Resilience Act's Impact on Swiss Companies

<h3>As from September 15, 2024, the New Framework will Facilitate the Disclosure of Personal Data from Switzerland to the U.S.</h3>
<h3>What Is New?</h3>
<p>By way of its decision of August 14, 2024, the Swiss Federal Council has recognized that the Swiss-U.S. DPF provides for an adequate level of data protection when private companies or public authorities in Switzerland disclose personal data to U.S. companies that participate in the Swiss-U.S. DPF. <a href="https://www.fedlex.admin.ch/eli/cc/2022/568/en#annex_1" target="_blank" rel="noopener">Annex 1</a> of the Swiss Federal Ordinance on Data Protection will be updated to include such disclosures under the Swiss-U.S. DPF as guaranteeing an adequate level of data protection.</p>
<p>Switzerland thus follows the approach taken earlier by the EU with the adoption of the EU-U.S. Data Privacy Framework (<strong>EU-U.S. DPF</strong>) (see our <a href="https://www.homburger.ch/en/insights/are-data-transfers-to-the-united-states-safe-again" target="_blank" rel="noopener">Bulletin of July 11, 2023</a>). The new Swiss-U.S. DPF substantially corresponds to the EU-U.S. DPF, which marked the (preliminary) end of a period of uncertainty for disclosures of personal data to the U.S. after the «Schrems II» landmark decision of the Court of Justice of the European Union (<strong>CJEU</strong>) struck down the predecessor of the EU-U.S. DPF (see our <a href="https://homburger.ch/de/insights/eugh-urteil-im-fall-schrems-ii" target="_blank" rel="noopener">Bulletin of July 16, 2020</a>).</p>
<p>Most importantly, the Swiss-U.S. DPF provides for the following:</p>
<ul>
<li>The U.S. aligns its legal system with fundamental principles of Swiss law by way of the <a href="https://www.federalregister.gov/documents/2022/10/14/2022-22531/enhancing-safeguards-for-united-states-signals-intelligence-activities" target="_blank" rel="noopener">U.S. Executive Order 14086</a> executed by President Biden on October 7, 2022 (<strong>EO 14086</strong>). The changes include a limitation of U.S. intelligence activities to what is proportionate, oversight of U.S. intelligence services, and effective redress. Earlier this year on June 13, 2024, the <a href="https://www.justice.gov/opcl/executive-order-14086" target="_blank" rel="noopener">U.S. Attorney General has designated Switzerland as a qualifying state</a> for purposes of implementing the redress mechanism.</li>
<li>U.S. companies may self-certify that they adhere to a defined set of privacy principles. Certified U.S. companies must ensure in particular the rights for data subjects as known from the DPA and redress options, including a free of charge independent dispute resolution mechanism and an arbitration panel. Compliance with these principles is monitored by the U.S. Department of Commerce (<strong>DoC</strong>) and enforced by the U.S. Federal Trade Commission.</li>
</ul>
<h3>When Will the Swiss-U.S. DPF Enter Into Force?</h3>
<p>The new Swiss-U.S. DPF will be effective from September 15, 2024.</p>
<h3>What Are the Consequences of the New Swiss-U.S. DPF?</h3>
<p>The Swiss-U.S. DPF will facilitate disclosures of personal data from Switzerland to the U.S.: Once effective, Swiss data exporters will be able to disclose personal data to recipients in the U.S. who participate in the Swiss-U.S. DPF without having to enter into SCC and performing a data transfer impact assessment.</p>
<p>Even for companies continuing to rely on SCC, the new Swiss-U.S. DPF will facilitate their data disclosure to the U.S. and the data transfer impact assessment, given that the limitations imposed by the U.S. EO 14086 apply irrespective of whether personal data is disclosed under the Swiss-U.S. DPF or based on a different transfer instrument, such as the SCC.</p>
<h3>Is There a List of U.S. Companies Participating in the Swiss-U.S. DPF?</h3>
<p>The DoC maintains and publishes a list of U.S. companies that have self-certified and declared to comply with the Swiss-U.S. DPF (<strong>DPF List</strong>, accessible <a href="https://www.dataprivacyframework.gov/list" target="_blank" rel="noopener">here</a>). There are exceptions as to which U.S. companies are eligible to participate in the Swiss-U.S. DPF, but Swiss data exporters can rely on the fact that companies on the list published by the DoC are certified.</p>
<h3>Is There Still a Need to Execute a Data Transfer Agreement Under the Swiss-U.S. DPF?</h3>
<p>Even when disclosing personal data under the Swiss-U.S. DPF, it is typically advisable for data exporters to enter into a suitable data transfer agreement with the data importer. This agreement should include the following, in addition to any other terms governing the relevant data disclosure in the specific circumstances:</p>
<ul>
<li>Obligation to comply with the principles of the Swiss-U.S. DPF;</li>
<li>Obligation to remain duly certified under the Swiss-U.S. DPF;</li>
<li>Obligation to notify data exporter immediately of a removal of the DPF List and the reason for such removal;</li>
<li>Mechanism to tackle the consequences of a removal from the DPF List.</li>
</ul>
<h3>What to Do with Existing SCC or Binding Corporate Rules?</h3>
<p>In principle, SCC or binding corporate rules that were concluded earlier are no longer necessary for data disclosures to a U.S. data importer who participates in the Swiss-U.S. DPF. Companies should however carefully consider whether to fully migrate their disclosures of personal data to the U.S. to the Swiss-U.S. DPF as there may be valid reasons to continue relying on the SCC or binding corporate rules:</p>
<ul>
<li>If the U.S. data importer is removed from the DPF List, the data disclosure is no longer considered to be covered by an adequate level of protection. Existing SCC or binding corporate rules could still serve as a fallback to ensure adequate protection; and</li>
<li>The validity of the EU-U.S. DPF is already being challenged through lawsuits in the EU, as its predecessors were. Should the CJEU ultimately decide to invalidate the EU-U.S. DPF, this will in all likelihood also impact the Swiss-U.S. DPF and companies relying exclusively on the Swiss-U.S. DPF may be left unprotected. Thus, maintaining existing SCC or binding corporate rules may serve as a protection should the Swiss-U.S. DPF be invalidated at some point.</li>
</ul>
<h3>What Are the Consequences of a Removal from the DPF List?</h3>
<p>U.S. companies may fall off the DPF List of participating companies if:</p>
<ul>
<li>They voluntarily withdraw from the Swiss-U.S. DPF;</li>
<li>They fail to complete their annual re-certification; or</li>
<li>They persistently fail to comply with the principles.</li>
</ul>
<p>For data disclosures that occurred <em>prior</em> to the removal of the U.S. company from the DPF List, the Swiss data exporter may argue that these disclosures were made lawfully under the adequacy decision.</p>
<p>For data disclosures that occurred <em>after</em> the removal of the U.S. company from the DPF List, the Swiss Federal Council’s adequacy decision does not apply. Instead, the parties must guarantee an adequate level of data protection by other means recognized by the law, including SCC or binding corporate rules. If no such guarantees can be put in place, the U.S. data importer should return or delete the personal data.</p>
<h3>Is the Swiss-U.S. DPF a Permanent Solution for Swiss-U.S. Data Disclosures?</h3>
<p>In principle, the Swiss-U.S. DPF is intended to be a permanent solution. However, it marks the third attempt of Swiss and U.S. authorities to facilitate transatlantic disclosure of personal data, after the CJEU struck down first the EU-U.S. Safe Harbor Framework, and then the EU-U.S. Privacy Shield (with the so-called «Schrems II» decision, see our <a href="https://www.homburger.ch/en/insights/cjeu-decision-schrems-ii-new-hurdles-data-transfers-usa" target="_blank" rel="noopener">Bulletin of July 16, 2020</a>), which in each case also ended the corresponding arrangements between Switzerland and the U.S. Given that the EU-U.S. DPF is already being challenged through lawsuits in the EU, time will tell whether the EU-U.S. DPF and the Swiss-U.S. DPF will withstand the judicial review.</p>
<p>In addition, the U.S. legislation may change. The Swiss Federal Council will constantly monitor the relevant U.S. decisions and review the adequacy decision on a regular basis. The first review will take place one year from now. If the Swiss-U.S. DPF malfunctions, the adequacy decision will be adjusted or withdrawn.</p>


RZ_Preview_Lock_SB_01

New Swiss-U.S. Data Privacy Framework

<p>On March 13, 2024, the European Parliament adopted the Artificial Intelligence Act, a far-reaching, 400-plus-page piece of legislation that seeks to establish a uniform legal framework for the development of AI.</p>
<p>The Act reaches beyond the EU&#8217;s borders, regulating AI providers and users regardless of location provided that the AI «output» is used in the EU. Although Switzerland has taken a <a href="https://www.homburger.ch/de/insights/swiss-federal-council-launches-ai-regulatory-regime-review" target="_blank" rel="noopener">wait-and-see approach</a> to regulating AI, its position in Europe means that most Swiss AI will be subject to EU regulation and Switzerland may be compelled, whether de facto or de jure, to adopt equivalent regulations.</p>
<p>The Act largely takes a risk-based approach to regulating AI. Closely tracking the draft leaked in January (discussed <a href="https://www.homburger.ch/de/insights/leaked-draft-of-eu-ai-act-sheds-light-on-proposed-regulation" target="_blank" rel="noopener">here</a>), it bans certain practices that threaten fundamental rights, such as social scoring and the exploitation of age or disability, and subjects «high-risk AI», such as biometric identification, credit scoring, and employee evaluations, to data governance, human oversight, impact assessments, and other restrictions.</p>
<p>The Act departs from the risk-based approach in two key respects:</p>
<ul>
<li>First, it imposes basic transparency requirements on nearly all individual users of AI. These measures seek to ensure that AI-generated content is labeled, including deepfakes, and users know when they are interacting with AI.</li>
<li>Second, the Act singles out for specific regulation «general-purpose AI models» and «general-purpose AI systems». These measures, which were added following the generative AI explosion in 2023, depart from the Act&#8217;s technology-agnostic risk-based approach and may prove complicated to interpret and enforce as the technology evolves.</li>
</ul>
<p>The penalties for violations are potentially substantial. Member states will establish their own rules, but the Commission&#8217;s «AI Office» is empowered to fine prohibited AI practices up to EUR 35 million or, if the offender is a company, up to 7 percent of total worldwide annual turnover, whichever is higher.</p>
<p>Restrictions on «unacceptable» uses come into force later this year. The «general-purpose AI system» regulations in early 2025. The transparency requirements and the regulation of «high-risk» systems become effective in 2026.</p>
<p>The EU&#8217;s efforts to regulate the risks of AI are laudable. The EU is trying to set early boundaries for an emerging technology that may have a profound social and economic impact. The Act sets important guardrails, but it contains only limited provisions to support the AI tech sector in Europe. Time will tell if the regulations stifle innovation and progress and weaken Europe&#8217;s competitive position vis-à-vis the United States and China, contributing to Europe falling further behind. To avoid these pitfalls, the new law will need constant re-evaluation to determine whether new developments require new approaches and safeguards.</p>


EU Adopts AI Act 

Gesellschaftsrecht / M&A

IP / IT

Datenschutz

Prozesse

Regulierung

Apollo_bw_640-140

Homburger News

Homburger and Apollo Global Management

<p>Homburger advises high-growth, global alternative asset manager Apollo Global Management, Inc. (Apollo; NYSE: APO) on the acquisition of The Travel Corporation (TTC), a leading international travel group. TTC, which has been privately owned and operated for more than a century, is a global portfolio of 18 market leading travel brands, including Trafalgar, a leading escorted tour operator, Uniworld Boutique River Cruises, a luxury all-inclusive river cruise line, Contiki, youth travel specialist tour company, premium guided vacation company Insight Vacations, as well as other global travel brands and supporting business entities.</p>
<p>The Homburger team is led by Daniel Hasler and includes Marco Rostetter, Nicola Togni, Léonard Aeschlimann, Isabelle Cordey and Luc Huber (all Corporate / M&amp;A), Gabriel Kasper (Data Protection and IP / IT) and Manuel Adassery (Regulatory and Litigation).</p>


Homburger advises Apollo Global Management, Inc. on the acquisition of The Travel Corporation

Kapitalmarkt

Steuern

Finanzierungen und Anlageprodukte

Arbeitsrecht und Vergütung für Führungskräfte

Wettbewerb

<p>Am 16. Mai 2024 wurde Homburger bei den LMG Life Sciences EMEA Awards mit dem «Impact Deal of the Year»-Award für die Beratung von VectivBio bei deren öffentlicher Übernahme durch Ironwood ausgezeichnet. Das Homburger Team wurde von Andreas Müller und Margrit Marti geleitet und umfasste Experten aus den Teams für Gesellschaftsrecht / M&amp;A, Kapitalmarkt, Steuern, Finanzierungen und Anlageprodukte, IP / IT, Datenschutz, Arbeitsrecht und Vergütung für Führungskräfte sowie Wettbewerb und Regulierung.</p>
<p>Mit der Auszeichnung werden komplexe und einflussreiche Transaktionen in der Life-Science-Branche gewürdigt.</p>


Homburger mit dem LMG Life Sciences EMEA Award für den «Impact Deal of the Year» geehrt

Schiedsgerichtsbarkeit

Compliance

Untersuchungen

Finanzmarktrecht

Healthcare / Life Sciences

Legal 500_webnews

The Legal 500 hat Homburger in 12 Kategorien als Tier 1-Kanzlei ausgezeichnet und wählt 7 Anwälte für die Hall of Fame aus

Homburger_SocialMedia_Template_001

<p>The Legal 500 hat Homburger in den folgenden Kategorien als Tier 1-Kanzlei ausgezeichnet: Banking and Finance; Capital Markets; Commercial, Corporate and M&amp;A; Competition; Data Privacy and Data Protection; Dispute Resolution: Arbitration; Dispute Resolution: Litigation; Employment; Healthcare and Life Sciences; Intellectual Property; Regulatory, Compliance and Investigations und Tax.</p>
<p>Sechs Partner and ein Senior Counsel wurden mit der «Hall of Fame» geehrt: <a href="https://www.homburger.ch/de/team/daniel-daeniker" target="_blank" rel="noopener">Daniel Daeniker</a>: Commercial, Corporate, M&amp;A; <a href="https://www.homburger.ch/de/team/marcel-dietrich" target="_blank" rel="noopener">Marcel Dietrich</a>: Competition, <a href="https://homburger.ch/de/team/balz-gross" target="_blank" rel="noopener">Balz Gross</a>: Dispute Resolution – Arbitration; <a href="https://www.homburger.ch/de/team/felix-dasser" target="_blank" rel="noopener">Felix Dasser</a>: Dispute Resolution – Litigation; <a href="https://www.homburger.ch/de/team/georg-rauber" target="_blank" rel="noopener">Georg Rauber</a>: Intellectual Property; <a href="https://homburger.ch/de/team/flavio-romerio" target="_blank" rel="noopener">Flavio Romerio</a>: Regulatory, Compliance and Investigations; and <a href="https://www.homburger.ch/de/team/rene-bosch" target="_blank" rel="noopener">René Bösch</a>: Banking &amp; Finance – Zurich und Capital Markets. In die «Hall of Fame» werden Anwälte aufgenommen, welche konstant gutes Feedback von Klienten erhalten und mindestens acht Jahre hintereinander in den The Legal 500 Rankings an erster Stelle standen.</p>
<p>The Legal 500 als Teil von Legalease, einem Anbieter von Informationen zum Rechtsmarkt, analysiert Anwaltskanzleien in der ganzen Welt und veröffentlicht jährliche Rankings basierend auf einer umfangreichen Recherche.</p>


<ul>
<li>Führung von datenschutzrechtlichen Verfahren vor Gerichten und Behörden</li>
<li>Beratung und Vertretung in Streitigkeiten betreffend datenschutzrechtlicher Ansprüche, wie beispielsweise Auskunftsrecht, Bearbeitungsverbote und Übermittlungen ins Ausland</li>
<li>Durchsetzung und Abwehr von persönlichkeitsrechtlichen Ansprüchen, insbesondere auch im Zusammenhang mit Medienberichten</li>
<li>Vertretung von Unternehmen in behördlichen und aufsichtsrechtlichen Verfahren, beispielsweise bei Datenschutzverletzungen</li>
</ul>


Prozess- und Verfahrensführung im Bereich Datenschutz und Persönlichkeitsrecht

<ul>
<li>Entwicklung und Umsetzung von Strategien und innovativen Lösungen, um den Datenschutz in Unternehmen sowohl unter dem Schweizer Datenschutzrecht als auch der europäischen Datenschutz-Grundverordnung (DSGVO) sicherzustellen</li>
<li>Beratung in Bezug auf die datenschutzkonforme Nutzung neuer Technologie und die Umsetzung von Digitalisierungsprojekten</li>
<li>Ausarbeitung und Strukturierung der zur Gewährleistung des Datenschutzes notwendigen Dokumentation, wie beispielsweise Datenschutzerklärungen, Reglemente und Verträge</li>
<li>Beratung im Zusammenhang mit internationalen und gruppeninternen Datenübermittlungen und Ausarbeitung der erforderlichen Dokumentation</li>
<li>Unterstützung bei der unternehmensinternen Aufarbeitung von Datenschutzverletzungen und anderen datenschutzrechtlich relevanten Vorkommnissen</li>
</ul>
<p>&nbsp;</p>


Datenschutz

Prozess- und Verfahrensführung im Bereich Datenschutz und Persönlichkeitsrecht

Beratung im Datenschutzrecht

Hauptkontakte

EU Cyber Resilience Act's Impact on Swiss Companies

New Swiss-U.S. Data Privacy Framework

EU Adopts AI Act

Homburger advises Apollo Global Management, Inc. on the acquisition of The Travel Corporation

Homburger mit dem LMG Life Sciences EMEA Award für den «Impact Deal of the Year» geehrt

The Legal 500 hat Homburger in 12 Kategorien als Tier 1-Kanzlei ausgezeichnet und wählt 7 Anwälte für die Hall of Fame aus

Alternative Funds 2024: Switzerland

Fintech 2025: Switzerland

Datenschutzstrafrecht