<h3>As from September 15, 2024, the New Framework will Facilitate the Disclosure of Personal Data from Switzerland to the U.S.</h3>
<h3>What Is New?</h3>
<p>By way of its decision of August 14, 2024, the Swiss Federal Council has recognized that the Swiss-U.S. DPF provides for an adequate level of data protection when private companies or public authorities in Switzerland disclose personal data to U.S. companies that participate in the Swiss-U.S. DPF. <a href="https://www.fedlex.admin.ch/eli/cc/2022/568/en#annex_1" target="_blank" rel="noopener">Annex 1</a> of the Swiss Federal Ordinance on Data Protection will be updated to include such disclosures under the Swiss-U.S. DPF as guaranteeing an adequate level of data protection.</p>
<p>Switzerland thus follows the approach taken earlier by the EU with the adoption of the EU-U.S. Data Privacy Framework (<strong>EU-U.S. DPF</strong>) (see our <a href="https://www.homburger.ch/en/insights/are-data-transfers-to-the-united-states-safe-again" target="_blank" rel="noopener">Bulletin of July 11, 2023</a>). The new Swiss-U.S. DPF substantially corresponds to the EU-U.S. DPF, which marked the (preliminary) end of a period of uncertainty for disclosures of personal data to the U.S. after the «Schrems II» landmark decision of the Court of Justice of the European Union (<strong>CJEU</strong>) struck down the predecessor of the EU-U.S. DPF (see our <a href="https://homburger.ch/de/insights/eugh-urteil-im-fall-schrems-ii" target="_blank" rel="noopener">Bulletin of July 16, 2020</a>).</p>
<p>Most importantly, the Swiss-U.S. DPF provides for the following:</p>
<ul>
<li>The U.S. aligns its legal system with fundamental principles of Swiss law by way of the <a href="https://www.federalregister.gov/documents/2022/10/14/2022-22531/enhancing-safeguards-for-united-states-signals-intelligence-activities" target="_blank" rel="noopener">U.S. Executive Order 14086</a> executed by President Biden on October 7, 2022 (<strong>EO 14086</strong>). The changes include a limitation of U.S. intelligence activities to what is proportionate, oversight of U.S. intelligence services, and effective redress. Earlier this year on June 13, 2024, the <a href="https://www.justice.gov/opcl/executive-order-14086" target="_blank" rel="noopener">U.S. Attorney General has designated Switzerland as a qualifying state</a> for purposes of implementing the redress mechanism.</li>
<li>U.S. companies may self-certify that they adhere to a defined set of privacy principles. Certified U.S. companies must ensure in particular the rights for data subjects as known from the DPA and redress options, including a free of charge independent dispute resolution mechanism and an arbitration panel. Compliance with these principles is monitored by the U.S. Department of Commerce (<strong>DoC</strong>) and enforced by the U.S. Federal Trade Commission.</li>
</ul>
<h3>When Will the Swiss-U.S. DPF Enter Into Force?</h3>
<p>The new Swiss-U.S. DPF will be effective from September 15, 2024.</p>
<h3>What Are the Consequences of the New Swiss-U.S. DPF?</h3>
<p>The Swiss-U.S. DPF will facilitate disclosures of personal data from Switzerland to the U.S.: Once effective, Swiss data exporters will be able to disclose personal data to recipients in the U.S. who participate in the Swiss-U.S. DPF without having to enter into SCC and performing a data transfer impact assessment.</p>
<p>Even for companies continuing to rely on SCC, the new Swiss-U.S. DPF will facilitate their data disclosure to the U.S. and the data transfer impact assessment, given that the limitations imposed by the U.S. EO 14086 apply irrespective of whether personal data is disclosed under the Swiss-U.S. DPF or based on a different transfer instrument, such as the SCC.</p>
<h3>Is There a List of U.S. Companies Participating in the Swiss-U.S. DPF?</h3>
<p>The DoC maintains and publishes a list of U.S. companies that have self-certified and declared to comply with the Swiss-U.S. DPF (<strong>DPF List</strong>, accessible <a href="https://www.dataprivacyframework.gov/list" target="_blank" rel="noopener">here</a>). There are exceptions as to which U.S. companies are eligible to participate in the Swiss-U.S. DPF, but Swiss data exporters can rely on the fact that companies on the list published by the DoC are certified.</p>
<h3>Is There Still a Need to Execute a Data Transfer Agreement Under the Swiss-U.S. DPF?</h3>
<p>Even when disclosing personal data under the Swiss-U.S. DPF, it is typically advisable for data exporters to enter into a suitable data transfer agreement with the data importer. This agreement should include the following, in addition to any other terms governing the relevant data disclosure in the specific circumstances:</p>
<ul>
<li>Obligation to comply with the principles of the Swiss-U.S. DPF;</li>
<li>Obligation to remain duly certified under the Swiss-U.S. DPF;</li>
<li>Obligation to notify data exporter immediately of a removal of the DPF List and the reason for such removal;</li>
<li>Mechanism to tackle the consequences of a removal from the DPF List.</li>
</ul>
<h3>What to Do with Existing SCC or Binding Corporate Rules?</h3>
<p>In principle, SCC or binding corporate rules that were concluded earlier are no longer necessary for data disclosures to a U.S. data importer who participates in the Swiss-U.S. DPF. Companies should however carefully consider whether to fully migrate their disclosures of personal data to the U.S. to the Swiss-U.S. DPF as there may be valid reasons to continue relying on the SCC or binding corporate rules:</p>
<ul>
<li>If the U.S. data importer is removed from the DPF List, the data disclosure is no longer considered to be covered by an adequate level of protection. Existing SCC or binding corporate rules could still serve as a fallback to ensure adequate protection; and</li>
<li>The validity of the EU-U.S. DPF is already being challenged through lawsuits in the EU, as its predecessors were. Should the CJEU ultimately decide to invalidate the EU-U.S. DPF, this will in all likelihood also impact the Swiss-U.S. DPF and companies relying exclusively on the Swiss-U.S. DPF may be left unprotected. Thus, maintaining existing SCC or binding corporate rules may serve as a protection should the Swiss-U.S. DPF be invalidated at some point.</li>
</ul>
<h3>What Are the Consequences of a Removal from the DPF List?</h3>
<p>U.S. companies may fall off the DPF List of participating companies if:</p>
<ul>
<li>They voluntarily withdraw from the Swiss-U.S. DPF;</li>
<li>They fail to complete their annual re-certification; or</li>
<li>They persistently fail to comply with the principles.</li>
</ul>
<p>For data disclosures that occurred <em>prior</em> to the removal of the U.S. company from the DPF List, the Swiss data exporter may argue that these disclosures were made lawfully under the adequacy decision.</p>
<p>For data disclosures that occurred <em>after</em> the removal of the U.S. company from the DPF List, the Swiss Federal Council’s adequacy decision does not apply. Instead, the parties must guarantee an adequate level of data protection by other means recognized by the law, including SCC or binding corporate rules. If no such guarantees can be put in place, the U.S. data importer should return or delete the personal data.</p>
<h3>Is the Swiss-U.S. DPF a Permanent Solution for Swiss-U.S. Data Disclosures?</h3>
<p>In principle, the Swiss-U.S. DPF is intended to be a permanent solution. However, it marks the third attempt of Swiss and U.S. authorities to facilitate transatlantic disclosure of personal data, after the CJEU struck down first the EU-U.S. Safe Harbor Framework, and then the EU-U.S. Privacy Shield (with the so-called «Schrems II» decision, see our <a href="https://www.homburger.ch/en/insights/cjeu-decision-schrems-ii-new-hurdles-data-transfers-usa" target="_blank" rel="noopener">Bulletin of July 16, 2020</a>), which in each case also ended the corresponding arrangements between Switzerland and the U.S. Given that the EU-U.S. DPF is already being challenged through lawsuits in the EU, time will tell whether the EU-U.S. DPF and the Swiss-U.S. DPF will withstand the judicial review.</p>
<p>In addition, the U.S. legislation may change. The Swiss Federal Council will constantly monitor the relevant U.S. decisions and review the adequacy decision on a regular basis. The first review will take place one year from now. If the Swiss-U.S. DPF malfunctions, the adequacy decision will be adjusted or withdrawn.</p>


RZ_Preview_Lock_SB_01

New Swiss-U.S. Data Privacy Framework

<p>On March 13, 2024, the European Parliament adopted the Artificial Intelligence Act, a far-reaching, 400-plus-page piece of legislation that seeks to establish a uniform legal framework for the development of AI.</p>
<p>The Act reaches beyond the EU&#8217;s borders, regulating AI providers and users regardless of location provided that the AI «output» is used in the EU. Although Switzerland has taken a <a href="https://www.homburger.ch/de/insights/swiss-federal-council-launches-ai-regulatory-regime-review" target="_blank" rel="noopener">wait-and-see approach</a> to regulating AI, its position in Europe means that most Swiss AI will be subject to EU regulation and Switzerland may be compelled, whether de facto or de jure, to adopt equivalent regulations.</p>
<p>The Act largely takes a risk-based approach to regulating AI. Closely tracking the draft leaked in January (discussed <a href="https://www.homburger.ch/de/insights/leaked-draft-of-eu-ai-act-sheds-light-on-proposed-regulation" target="_blank" rel="noopener">here</a>), it bans certain practices that threaten fundamental rights, such as social scoring and the exploitation of age or disability, and subjects «high-risk AI», such as biometric identification, credit scoring, and employee evaluations, to data governance, human oversight, impact assessments, and other restrictions.</p>
<p>The Act departs from the risk-based approach in two key respects:</p>
<ul>
<li>First, it imposes basic transparency requirements on nearly all individual users of AI. These measures seek to ensure that AI-generated content is labeled, including deepfakes, and users know when they are interacting with AI.</li>
<li>Second, the Act singles out for specific regulation «general-purpose AI models» and «general-purpose AI systems». These measures, which were added following the generative AI explosion in 2023, depart from the Act&#8217;s technology-agnostic risk-based approach and may prove complicated to interpret and enforce as the technology evolves.</li>
</ul>
<p>The penalties for violations are potentially substantial. Member states will establish their own rules, but the Commission&#8217;s «AI Office» is empowered to fine prohibited AI practices up to EUR 35 million or, if the offender is a company, up to 7 percent of total worldwide annual turnover, whichever is higher.</p>
<p>Restrictions on «unacceptable» uses come into force later this year. The «general-purpose AI system» regulations in early 2025. The transparency requirements and the regulation of «high-risk» systems become effective in 2026.</p>
<p>The EU&#8217;s efforts to regulate the risks of AI are laudable. The EU is trying to set early boundaries for an emerging technology that may have a profound social and economic impact. The Act sets important guardrails, but it contains only limited provisions to support the AI tech sector in Europe. Time will tell if the regulations stifle innovation and progress and weaken Europe&#8217;s competitive position vis-à-vis the United States and China, contributing to Europe falling further behind. To avoid these pitfalls, the new law will need constant re-evaluation to determine whether new developments require new approaches and safeguards.</p>


EU Adopts AI Act 

<h3>A. Introduction</h3>
<p>The Swiss Federal Supreme Court&#8217;s January 19, 2024 decision, which was published on February 12, 2024, concerns an internal investigation into sexual harassment allegations against an employee. In that context, the Court assessed whether the internal investigation, which confirmed a reasonable suspicion of sexual harassment and ultimately led to the employee&#8217;s dismissal, had been conducted properly.</p>
<p>The key rulings from the Court&#8217;s decision are:</p>
<ol>
<li>When private employers perform internal investigations, the standard criminal procedural guarantees do not apply;</li>
<li>Employers do not need to provide an employee subject to investigation with advance notice of an interview or an opportunity to prepare. Rather, it suffices if the employer informs the accused employee at the beginning of the interview of its purpose and content;</li>
<li>The absence of a «person of trust» at the interview does not constitute a serious deficiency in the investigation process that would render the employee&#8217;s termination abusive, even if an employer&#8217;s internal regulations entitle employees to be accompanied by a «person of trust» at such interviews;</li>
<li>Employers are not required to inform the accused employee in detail of the allegations against him or her. Generic and anonymized information about the allegations is sufficient;</li>
<li>A reasonable suspicion, confirmed by an internal investigation, is sufficient basis to ordinarily terminate an employee lawfully even if the suspicion is later proven to be unfounded. Before terminating an employee, the employer is not required to prove the truth of the allegations.</li>
</ol>
<p>The Court&#8217;s ruling rejects the views previously expressed by some legal scholars that employers must provide employees subject to investigation the procedural guarantees accorded to the accused person in criminal investigations.</p>
<h3>B. Summary of Facts and Procedural History</h3>
<p>As noted above, the case concerned an internal investigation regarding allegations of sexual harassment at a bank. Employee A contacted the bank&#8217;s ombudswoman for conduct and ethics and reported sexual harassment by Employee B. The bank conducted an internal investigation to clarify the sexual harassment allegations. As part of the investigation, several employees, including Employee B, were interviewed. The internal investigation concluded that there was sufficient basis for a reasonable suspicion that Employee B had sexually harassed Employee A. As a result, the bank terminated Employee B by observing the applicable notice period.</p>
<p>Employee B then brought a claim for unfair dismissal and damages. The Zurich Labor Court rejected the claim. It held that it was irrelevant whether the allegations of sexual harassment were true or not. Rather, the only relevant factor was whether the bank had sufficiently investigated the allegations. The Labor Court found that it had.</p>
<p>Employee B appealed to the High Court of the Canton of Zurich, which concluded that the bank had not afforded Employee B an adequate opportunity to defend himself against the allegations. In particular, it focused on the lack of detail provided by the bank regarding the allegations, which, according to the High Court, prevented Employee B from adequately defending himself and, in particular, from providing exculpatory facts and evidences. The High Court therefore held that the termination was abusive.<a href="#_ftn1" name="_ftnref1">[1]</a></p>
<p>Thereafter the bank appealed to the Swiss Federal Supreme Court, which overturned the High Court&#8217;s decision.</p>
<h3>C. Findings of the Swiss Federal Supreme Court</h3>
<h4>1. No equivalent procedural guarantees as in criminal investigations</h4>
<p>The Court&#8217;s decision clarifies uncertainty respecting the law applicable to internal investigations in private companies. In a case from May 2016,<a href="#_ftn2" name="_ftnref2">[2]</a> the Court quoted legal scholars who expressed the view that in internal investigations, employers had to provide accused employees with procedural guarantees equivalent to those of a criminal proceedings (i.e., a right to prepare for the defense, be represented by a lawyer, and request the taking of evidence).<a href="#_ftn3" name="_ftnref3">[3]</a> As a result, following the Court&#8217;s May 2016 decision, it was unclear what procedural guarantees, if any, were required in internal investigations. In its recent decision, the Court clarified that its 2016 ruling merely reproduced the views expressed by some legal scholars but did not endorse them.<a href="#_ftn4" name="_ftnref4">[4]</a></p>
<p>The Court further explained that, unlike in a criminal proceedings, in which an accused person is subject to the state&#8217;s criminal power and may face criminal liability (including imprisonment and fines), employees and employers voluntarily enter into an employment relationship and the worst threat an employee can face is termination.</p>
<p>According to the Court, the bank&#8217;s internal investigation provided adequate protections for Employee B because the bank interviewed several employees, reviewed Employee B&#8217;s electronic communications, and provided Employee B an opportunity to comment on the minutes of his interview.</p>
<h4>2. No obligation to announce the purpose and the content of the interview in advance</h4>
<p>The Court held that, unlike in criminal proceedings, employers are not required to inform employees in advance of the purpose and content of an internal investigation interview. Rather, it is sufficient if the employee is informed at the beginning of the interview of its purpose and content. There is no legal requirement to provide the employee with an opportunity to prepare for the interview.<a href="#_ftn5" name="_ftnref5">[5]</a></p>
<h4>3. No right to be accompanied by a «person of trust»</h4>
<p>The Court held that the absence of a «person of trust» at the interview does not constitute a serious deficiency in the investigation process that would render the employee&#8217;s termination abusive, even if an employer&#8217;s internal regulations entitle employees to be accompanied by a «person of trust» at such interviews.<a href="#_ftn6" name="_ftnref6">[6]</a></p>
<h4>4. Right to have the allegations clarified</h4>
<p>The Court confirmed that the internal investigation of a private employer is not comparable to a state criminal investigation and that therefore the employer is not required to inform the employee in detail of the allegations against him or her. Rather, generic and anonymized information about the allegations is sufficient. The Court also explained that accuser&#8217;s identity must be kept confidential and may not be disclosed to the accused employee.</p>
<h4>5. Ordinary termination due to reasonable suspicion is not abusive</h4>
<p>The Court&#8217;s ruling reminded that Swiss employment law is governed by the principle of freedom of termination. This means that there are no particular reasons required for an ordinary termination of the employment relationship.</p>
<p>Accordingly, unlike in criminal proceedings, in which there can be no conviction unless the alleged crime is proven beyond a reasonable doubt, an employee may be terminated based on mere suspicions, even if the suspicions later turn out to be unfounded.</p>
<p>Employers still have an obligation to establish that their suspicions are reasonable before terminating their employees. Termination may be abusive if based on mere allegations absent an adequate investigation to ascertain the trustworthiness of the allegations, or if the investigation fails to establish a reasonable suspicion that the allegations are indeed true.<a href="#_ftn7" name="_ftnref7">[7]</a></p>
<h6><a href="#_ftnref1" name="_ftn1">[1]</a>        OGer ZH LA210022 of May 23, 2023.</h6>
<h6><a href="#_ftnref2" name="_ftn2">[2]</a>        BGer 4A_694/2015 of May 4, 2016, E. 2.4.</h6>
<h6><a href="#_ftnref3" name="_ftn3">[3]</a>        BGer 4A_694/2015 of May 4, 2016, E. 2.4.</h6>
<h6><a href="#_ftnref4" name="_ftn4">[4]</a>        BGer 4A_368/2023 of January 19, 2024, E. 4.1.</h6>
<h6><a href="#_ftnref5" name="_ftn5">[5]</a>        BGer 4A_368/2023 of January 19, 2024, E. 4.4.1.</h6>
<h6><a href="#_ftnref6" name="_ftn6">[6]</a>        BGer 4A_368/2023 of January 19, 2024, E. 4.4.2.</h6>
<h6><a href="#_ftnref7" name="_ftn7">[7]</a>        BGer 4A_368/2023 of January 19, 2024, E. 4.2.</h6>


RZ_20240213_Bulletin-Illustration-Preview_1000x1000_01

No Criminal Procedural Guarantees in Internal Investigations

Corporate / M&A

IP / IT

Data Protection

Litigation

Regulatory

Homburger News

Share-Image Teamplate Deals-and-Cases

<p>Homburger advises high-growth, global alternative asset manager Apollo Global Management, Inc. (Apollo; NYSE: APO) on the acquisition of The Travel Corporation (TTC), a leading international travel group. TTC, which has been privately owned and operated for more than a century, is a global portfolio of 18 market leading travel brands, including Trafalgar, a leading escorted tour operator, Uniworld Boutique River Cruises, a luxury all-inclusive river cruise line, Contiki, youth travel specialist tour company, premium guided vacation company Insight Vacations, as well as other global travel brands and supporting business entities.</p>
<p>The Homburger team is led by Daniel Hasler and includes Marco Rostetter, Nicola Togni, Léonard Aeschlimann, Isabelle Cordey and Luc Huber (all Corporate / M&amp;A), Gabriel Kasper (Data Protection and IP / IT) and Manuel Adassery (Regulatory and Litigation).</p>


Homburger advises Apollo Global Management, Inc. on the acquisition of The Travel Corporation

Capital Markets

Financing and Investment Products

Employment and Executive Compensation

Competition

<p>On May 16, 2024, Homburger received the «Impact Deal of the Year» award at the LMG Life Sciences EMEA Awards 2024 for advising VectivBio in connection with the public tender offer by Ironwood. The Homburger Team was led by Andreas Müller and Margrit Marti and comprised lawyers from the Corporate / M&amp;A, Capital Markets, Tax, Financing and Investment Products, IP / IT, Data Protection, Employment and Executive Compensation, and Competition and Regulatory teams.</p>
<p>The awards recognize complex and impactful transactions in the life sciences industry.</p>


Homburger honored with LMG Life Sciences EMEA award for «Impact Deal of the Year»

Arbitration

Compliance

Investigations

Financial Market Regulation

Healthcare / Life Sciences

Legal 500_webnews

Homburger_SocialMedia_Template_001

<p>The Legal 500 has ranked Homburger Tier 1 in the categories Banking and Finance; Capital Markets; Commercial, Corporate and M&amp;A; Competition; Data Privacy and Data Protection; Dispute Resolution: Arbitration; Dispute Resolution: Litigation; Employment; Healthcare and Life Sciences; Intellectual Property; Regulatory, Compliance and Investigations and Tax.</p>
<p>Six partners and one senior counsel were honored with the «Hall of Fame»: <a href="https://www.homburger.ch/en/team/daniel-daeniker" target="_blank" rel="noopener">Daniel Daeniker</a>: Commercial, Corporate, M&amp;A; <a href="https://www.homburger.ch/en/team/marcel-dietrich" target="_blank" rel="noopener">Marcel Dietrich</a>: Competition, <a href="https://homburger.ch/en/team/balz-gross" target="_blank" rel="noopener">Balz Gross</a>: Dispute Resolution – Arbitration; <a href="https://www.homburger.ch/en/team/felix-dasser" target="_blank" rel="noopener">Felix Dasser</a>: Dispute Resolution – Litigation; <a href="https://www.homburger.ch/en/team/georg-rauber" target="_blank" rel="noopener">Georg Rauber</a>: Intellectual Property; <a href="https://homburger.ch/en/team/flavio-romerio" target="_blank" rel="noopener">Flavio Romerio</a>: Regulatory, Compliance and Investigations; and <a href="https://www.homburger.ch/en/team/rene-bosch" target="_blank" rel="noopener">René Bösch</a>: Banking &amp; Finance – Zurich and Capital Markets. The Hall of Fame of The Legal 500 recognizes lawyers that receive constant praise from their clients and that have been ranked top tier for eight consecutive years in The Legal 500 rankings.</p>
<p>The Legal 500 as a part of Legalease, a provider of legal market information, analyses the capabilities of law firms across the world and publishes annual rankings based upon extensive research.</p>


The Legal 500 ranks Homburger Tier 1 in 12 categories and selected 7 lawyers for the Hall of Fame

<ul>
<li>Representation in proceedings regarding data protection and privacy before courts and regulatory authorities</li>
<li>Advice on and representation in disputes concerning claims under data protection and privacy law, including the right to information, prohibition of processing and transfer of data to other jurisdictions</li>
<li>Enforcement and defense of claims under personality rights, including in connection with media reports</li>
<li>Representation of companies in regulatory proceedings and investigations relating to data breaches and other matters regarding data protection</li>
</ul>


Representation in litigation and other proceedings regarding data protection and privacy

<ul>
<li>Development and implementation of strategies and innovative solutions to ensure data protection compliance in companies, both under Swiss law and the European General Data Protection Regulation (GDPR)</li>
<li>Advice on data protection compliance when using new technology and implementing digitalization strategies</li>
<li>Drafting of documentation required to ensure data protection compliance, such as data protection policies, regulations and necessary agreements</li>
<li>Advice relating to international and intra-group data transfers</li>
<li>Support in dealing with data breaches and other incidents relating to data protection and privacy</li>
</ul>


Data Protection

Representation in litigation and other proceedings regarding data protection and privacy

Advice on data protection and privacy law

Main Contacts

New Swiss-U.S. Data Privacy Framework

EU Adopts AI Act

No Criminal Procedural Guarantees in Internal Investigations

Homburger advises Apollo Global Management, Inc. on the acquisition of The Travel Corporation

Homburger honored with LMG Life Sciences EMEA award for «Impact Deal of the Year»

The Legal 500 ranks Homburger Tier 1 in 12 categories and selected 7 lawyers for the Hall of Fame

Alternative Funds 2024: Switzerland

Fintech 2025: Switzerland

Datenschutzstrafrecht