<h3>As from September 15, 2024, the New Framework will Facilitate the Disclosure of Personal Data from Switzerland to the U.S.</h3>
<h3>What Is New?</h3>
<p>By way of its decision of August 14, 2024, the Swiss Federal Council has recognized that the Swiss-U.S. DPF provides for an adequate level of data protection when private companies or public authorities in Switzerland disclose personal data to U.S. companies that participate in the Swiss-U.S. DPF. <a href="https://www.fedlex.admin.ch/eli/cc/2022/568/en#annex_1" target="_blank" rel="noopener">Annex 1</a> of the Swiss Federal Ordinance on Data Protection will be updated to include such disclosures under the Swiss-U.S. DPF as guaranteeing an adequate level of data protection.</p>
<p>Switzerland thus follows the approach taken earlier by the EU with the adoption of the EU-U.S. Data Privacy Framework (<strong>EU-U.S. DPF</strong>) (see our <a href="https://www.homburger.ch/en/insights/are-data-transfers-to-the-united-states-safe-again" target="_blank" rel="noopener">Bulletin of July 11, 2023</a>). The new Swiss-U.S. DPF substantially corresponds to the EU-U.S. DPF, which marked the (preliminary) end of a period of uncertainty for disclosures of personal data to the U.S. after the «Schrems II» landmark decision of the Court of Justice of the European Union (<strong>CJEU</strong>) struck down the predecessor of the EU-U.S. DPF (see our <a href="https://homburger.ch/de/insights/eugh-urteil-im-fall-schrems-ii" target="_blank" rel="noopener">Bulletin of July 16, 2020</a>).</p>
<p>Most importantly, the Swiss-U.S. DPF provides for the following:</p>
<ul>
<li>The U.S. aligns its legal system with fundamental principles of Swiss law by way of the <a href="https://www.federalregister.gov/documents/2022/10/14/2022-22531/enhancing-safeguards-for-united-states-signals-intelligence-activities" target="_blank" rel="noopener">U.S. Executive Order 14086</a> executed by President Biden on October 7, 2022 (<strong>EO 14086</strong>). The changes include a limitation of U.S. intelligence activities to what is proportionate, oversight of U.S. intelligence services, and effective redress. Earlier this year on June 13, 2024, the <a href="https://www.justice.gov/opcl/executive-order-14086" target="_blank" rel="noopener">U.S. Attorney General has designated Switzerland as a qualifying state</a> for purposes of implementing the redress mechanism.</li>
<li>U.S. companies may self-certify that they adhere to a defined set of privacy principles. Certified U.S. companies must ensure in particular the rights for data subjects as known from the DPA and redress options, including a free of charge independent dispute resolution mechanism and an arbitration panel. Compliance with these principles is monitored by the U.S. Department of Commerce (<strong>DoC</strong>) and enforced by the U.S. Federal Trade Commission.</li>
</ul>
<h3>When Will the Swiss-U.S. DPF Enter Into Force?</h3>
<p>The new Swiss-U.S. DPF will be effective from September 15, 2024.</p>
<h3>What Are the Consequences of the New Swiss-U.S. DPF?</h3>
<p>The Swiss-U.S. DPF will facilitate disclosures of personal data from Switzerland to the U.S.: Once effective, Swiss data exporters will be able to disclose personal data to recipients in the U.S. who participate in the Swiss-U.S. DPF without having to enter into SCC and performing a data transfer impact assessment.</p>
<p>Even for companies continuing to rely on SCC, the new Swiss-U.S. DPF will facilitate their data disclosure to the U.S. and the data transfer impact assessment, given that the limitations imposed by the U.S. EO 14086 apply irrespective of whether personal data is disclosed under the Swiss-U.S. DPF or based on a different transfer instrument, such as the SCC.</p>
<h3>Is There a List of U.S. Companies Participating in the Swiss-U.S. DPF?</h3>
<p>The DoC maintains and publishes a list of U.S. companies that have self-certified and declared to comply with the Swiss-U.S. DPF (<strong>DPF List</strong>, accessible <a href="https://www.dataprivacyframework.gov/list" target="_blank" rel="noopener">here</a>). There are exceptions as to which U.S. companies are eligible to participate in the Swiss-U.S. DPF, but Swiss data exporters can rely on the fact that companies on the list published by the DoC are certified.</p>
<h3>Is There Still a Need to Execute a Data Transfer Agreement Under the Swiss-U.S. DPF?</h3>
<p>Even when disclosing personal data under the Swiss-U.S. DPF, it is typically advisable for data exporters to enter into a suitable data transfer agreement with the data importer. This agreement should include the following, in addition to any other terms governing the relevant data disclosure in the specific circumstances:</p>
<ul>
<li>Obligation to comply with the principles of the Swiss-U.S. DPF;</li>
<li>Obligation to remain duly certified under the Swiss-U.S. DPF;</li>
<li>Obligation to notify data exporter immediately of a removal of the DPF List and the reason for such removal;</li>
<li>Mechanism to tackle the consequences of a removal from the DPF List.</li>
</ul>
<h3>What to Do with Existing SCC or Binding Corporate Rules?</h3>
<p>In principle, SCC or binding corporate rules that were concluded earlier are no longer necessary for data disclosures to a U.S. data importer who participates in the Swiss-U.S. DPF. Companies should however carefully consider whether to fully migrate their disclosures of personal data to the U.S. to the Swiss-U.S. DPF as there may be valid reasons to continue relying on the SCC or binding corporate rules:</p>
<ul>
<li>If the U.S. data importer is removed from the DPF List, the data disclosure is no longer considered to be covered by an adequate level of protection. Existing SCC or binding corporate rules could still serve as a fallback to ensure adequate protection; and</li>
<li>The validity of the EU-U.S. DPF is already being challenged through lawsuits in the EU, as its predecessors were. Should the CJEU ultimately decide to invalidate the EU-U.S. DPF, this will in all likelihood also impact the Swiss-U.S. DPF and companies relying exclusively on the Swiss-U.S. DPF may be left unprotected. Thus, maintaining existing SCC or binding corporate rules may serve as a protection should the Swiss-U.S. DPF be invalidated at some point.</li>
</ul>
<h3>What Are the Consequences of a Removal from the DPF List?</h3>
<p>U.S. companies may fall off the DPF List of participating companies if:</p>
<ul>
<li>They voluntarily withdraw from the Swiss-U.S. DPF;</li>
<li>They fail to complete their annual re-certification; or</li>
<li>They persistently fail to comply with the principles.</li>
</ul>
<p>For data disclosures that occurred <em>prior</em> to the removal of the U.S. company from the DPF List, the Swiss data exporter may argue that these disclosures were made lawfully under the adequacy decision.</p>
<p>For data disclosures that occurred <em>after</em> the removal of the U.S. company from the DPF List, the Swiss Federal Council’s adequacy decision does not apply. Instead, the parties must guarantee an adequate level of data protection by other means recognized by the law, including SCC or binding corporate rules. If no such guarantees can be put in place, the U.S. data importer should return or delete the personal data.</p>
<h3>Is the Swiss-U.S. DPF a Permanent Solution for Swiss-U.S. Data Disclosures?</h3>
<p>In principle, the Swiss-U.S. DPF is intended to be a permanent solution. However, it marks the third attempt of Swiss and U.S. authorities to facilitate transatlantic disclosure of personal data, after the CJEU struck down first the EU-U.S. Safe Harbor Framework, and then the EU-U.S. Privacy Shield (with the so-called «Schrems II» decision, see our <a href="https://www.homburger.ch/en/insights/cjeu-decision-schrems-ii-new-hurdles-data-transfers-usa" target="_blank" rel="noopener">Bulletin of July 16, 2020</a>), which in each case also ended the corresponding arrangements between Switzerland and the U.S. Given that the EU-U.S. DPF is already being challenged through lawsuits in the EU, time will tell whether the EU-U.S. DPF and the Swiss-U.S. DPF will withstand the judicial review.</p>
<p>In addition, the U.S. legislation may change. The Swiss Federal Council will constantly monitor the relevant U.S. decisions and review the adequacy decision on a regular basis. The first review will take place one year from now. If the Swiss-U.S. DPF malfunctions, the adequacy decision will be adjusted or withdrawn.</p>


RZ_Preview_Lock_SB_01

New Swiss-U.S. Data Privacy Framework

<p>On January 15, 2024, the EU Commission published its <a href="https://commission.europa.eu/system/files/2024-01/JUST_template_comingsoon_Report%20on%20the%20first%20review%20of%20the%20functioning.pdf">report</a> on the results of its first review of the adequacy decisions previously taken under the old EU Data Protection Directive. The EU Commission concludes that <strong>Switzerland continues to provide an adequate level of protection for personal data</strong> transferred from the EU.</p>
<p>According to its report, the EU Commission welcomes the developments in the Swiss legal framework since the adoption of the first adequacy decision in July 2000, including in particular the modernization of the Swiss Data Protection Act (cf. our <a href="https://www.homburger.ch/en/insights/revision-of-the-swiss-data-protection-law-is-complete">Bulletin</a> of August 31, 2022). These developments have contributed to an increased level of data protection, in a manner sufficient for the EU Commission to maintain its adequacy decision.</p>
<p>Maintaining the EU adequacy decision was one of the main objectives of the revision of the Swiss Data Protection Act, which entered into force on September 1, 2023: Without the EU&#8217;s recognition of the adequacy of Swiss data protection law, the export of personal data from the EU to Switzerland would have become much more burdensome. Today&#8217;s confirmation by the EU Commission thus marks the achievement of a key goal in the efforts to modernize Swiss data protection law in a manner consistent with the EU General Data Protection Regulation (GDPR).</p>
<p>The review of adequacy decisions by the EU Commission, which has now been completed, is the first such review since the GDPR came into force in 2018. The GDPR calls for regular reviews, and the EU underlines its intention to further intensify dialogue and cooperation with like-minded international partners on data flows and digital issues in general.</p>


EU Confirms Adequacy of Swiss Data Protection Law

<h3>New DPA enters into force on September 1, 2023</h3>
<h4><strong><em>What did the Federal Council decide today?</em></strong></h4>
<p>While Parliament had approved the new Swiss Data Protection Act (<strong>DPA</strong>) already in September 2020 (see our <a href="https://www.homburger.ch/en/insights/swiss-parliament-approves-revision-of-the-swiss-federal-act-data-protection">Bulletin of September 25, 2020</a> and the text of the DPA available <a href="https://cms.homburger.ch/wp-content/uploads/2021/01/Swiss-Data-Protection-Act-of-September-25-2020_02_682151_1.pdf" target="_blank" rel="noopener">here</a>), the revision of the Data Protection Ordinance (<strong>DPO</strong>) continued until today. On August 31, 2022, the Federal Council now adopted the new DPO (available <a href="https://www.bj.admin.ch/dam/bj/de/data/staat/gesetzgebung/datenschutzstaerkung/vdsg/vo.pdf.download.pdf/vo-d.pdf" target="_blank" rel="noopener">here</a>)<a href="#_ftn1" name="_ftnref1">[1]</a> and decided that the new DPA and the new DPO shall enter into force on September 1, 2023. At the same time, the Federal Council also adopted the new Ordinance on Data Protection Certifications. With this, the legislative work on the revision of the Swiss data protection law is complete.</p>
<h4><strong><em>What is the impact of today&#8217;s decisions of the Federal Council?</em></strong></h4>
<p>With today&#8217;s decisions by the Federal Council, it is clear which implementing provisions must be taken into account in addition to the DPA and when the revision will enter into force. Companies are now required to take the necessary steps to ensure compliance with the requirements of the new DPA and the DPO by September 1, 2023.</p>
<h4><strong><em>What are the most important regulations of the Data Protection Ordinance?</em></strong></h4>
<p>The following provisions of the DPO are to be highlighted for companies:</p>
<ul>
<li>In the area of <strong>data security</strong>, the DPO specifies the principle of the adequacy of data security in that the <strong>need to protect </strong>personal data and the <strong>risks </strong>to the personality and fundamental rights of the data subject must be assessed on the basis of the criteria set out in the DPO. In addition, the DPO defines the <strong>protection goals </strong>and certain <strong>technical and organizational measures </strong>that should allow these goals to be achieved.</li>
<li>The obligation to <strong>log </strong>certain data processing activities, which was heavily criticized in the consultation, remains in place despite calls to the contrary. Although the obligation has been restricted compared to the draft released for consultation a year ago, the requirement has not become any clearer. Private data controllers and data processors who <strong>process sensitive personal data on a large scale by automated means </strong>or who carry out <strong>high-risk profiling </strong>must now log the storage, modification, reading, disclosure, deletion and destruction of the data if the preventive measures taken are not sufficient to guarantee data protection. The log must be kept for at least one year, separately from the system in which the personal data is stored. The scope of this requirement, which is far-reaching for both data controllers and data processors, remains unclear. In particular, it will have to be clarified when sensitive personal data is processed «on a large scale» and when «preventive measures do not guarantee data protection». In the explanatory report, the Federal Office of Justice takes the position – surprisingly and without reasoning – that the latter is only rarely the case. This is not convincing, since ensuring data protection is a fundamental premise for all data processing activities.</li>
<li>Furthermore, the DPA provides for an obligation of private data controllers and data processors to issue and regularly update <strong>regulations for automated data processing </strong>if they process particularly sensitive personal data on a large scale by automated means or carry out high-risk profiling.</li>
<li>For data processing through processors, the clarification that the <strong>authorization of subcontractors </strong>can be granted both specifically (i.e. in relation to a specific subcontractor) and generally is welcome. In the latter case, the DPA requires information about intended changes and a right of objection in favor of the controller.</li>
<li>The DPA then specifies further obligations of the controller, in particular the <strong>modalities of the duty to inform</strong> data subjects, the duration of the <strong>retention of the data protection impact assessment</strong>, as well as the requirements for the <strong>notification of data breaches </strong>to the FDPIC. Furthermore, certain <strong>modalities of the data subject&#8217;s right to information as </strong>well as the <strong>right to data surrender and transfer </strong>are regulated.</li>
<li>Finally, the DPA states that the obligation to keep a <strong>processing record </strong>does not apply to companies that employ fewer than 250 people on January 1 of any given year (whereby the level of employment should not play a role) and that neither process particularly sensitive personal data on a large scale nor carry out high-risk profiling.</li>
</ul>
<h4><strong><em>Which countries does the Federal Council acknowledge to have an adequate level of data protection?</em></strong></h4>
<p>Annex 1 of the DPO lists those countries which have appropriate data protection legislation. In principle, the disclosure of personal data to these countries is permitted. In particular, the list includes all member states of the EU and the EEA and the United Kingdom, as well as Canada in certain areas. Furthermore, the list includes: Andorra, Argentina, Faroe Islands, Gibraltar, Guernsey, Iceland, Isle of Man, Israel, Jersey, Monaco, New Zealand and Uruguay.</p>
<p>Disclosures of personal data to other countries – including in particular to the USA – require either the application of a specific exemption set forth in the DPA or the implementation of alternative protective measures to ensure adequate data protection.</p>
<h4><strong><em>Why is there a need for the Data Protection Ordinance in addition to the DPA?</em></strong></h4>
<p>The DPA empowers the Federal Council to issue certain implementing regulations, which is why the Federal Council adopts the DPO.</p>
<h4><strong><em>Has the new Data Protection Ordinance been toned down from the June 2021 draft?</em></strong></h4>
<p>The draft of the new DPO published in June 2021 was sharply criticized in the public consultation process. This is because the draft contained numerous provisions that would have had a significant impact on the companies subject to the DPA, and which, in terms of content, went far beyond mere implementing provisions. Fortunately, the Federal Council has at least taken partial account of the criticism from the consultation. The final DPO that is now available has been toned down compared to the draft. For example, the Federal Council has considerably streamlined the regulation of the modalities of the duty to inform as well as the requirements for the role of the data protection advisor compared to the draft and has also waived certain written form requirements. However, the final DPO still appears to be excessive in the area of data security requirements, where in particular the implementation of the obligation to log certain data processing appears to be challenging.</p>
<h4><strong><em>What measures are to be undertaken in view of the entry into force of the new DPA?</em></strong></h4>
<p>Projects for implementation of the new DPA in companies should now be tackled promptly so that companies are DPA-compliant on September 1, 2023. For many companies, it will be particularly necessary to review internal processes and documentation (such as data protection declarations, processing records, data protection impact assessments, contracts regarding the processing of personal data, etc.) and, if necessary, update them or introduce new ones. A short checklist giving an overview on implementation work is available for download <a href="https://cms.homburger.ch/wp-content/uploads/2022/08/Summary-Checklist-Implementation-of-the-New-Swiss-Data-Protection-Act-2022-08-3113880971.2.pdf">here</a>.</p>
<h6><a href="#_ftnref1" name="_ftn1">[1]</a>        An English translation is not yet available.</h6>


RZ_Preview_Ritter_Data Protection_SS_02

Revision of the Swiss Data Protection Law is Complete

Corporate / M&A

Capital Markets

Employment and Executive Compensation

Competition

Regulatory

IP / IT

Financing and Investment Products

Real Estate

Homburger News

Share-Image Teamplate Deals-and-Cases

<p>On October 16, 2024, Liberty Global Ltd. (NASDAQ: LBTYA, LBTYB and LBTYK) and Sunrise Communications AG (Sunrise) announced the key dates of the spin-off of Sunrise from Liberty Global. After the spin-off, Sunrise, which is Switzerland&#8217;s largest private telecommunications provider, will be an independent, separate publicly traded Swiss company.</p>
<p>As part of the spin-off, Liberty Global shareholders will receive Sunrise Class A shares and Sunrise Class B shares in the form of Sunrise Class A ADSs and Sunrise Class B ADSs. The Sunrise Class A shares will be listed on the SIX Swiss Exchange (SIX) and the Sunrise Class A ADSs will be listed on the Nasdaq Global Select Market (NASDAQ). The spin-off is subject to approval by Liberty Global&#8217;s shareholders. The first day of trading on the NASDAQ and the SIX is scheduled for November 13 and 15, 2024, respectively.</p>
<p>Homburger AG acts as Swiss counsel to Liberty Global and Sunrise. The Homburger team is led by Daniel Daeniker and Daniel (Danny) Häusermann and includes, among others, Carlo Sulser, Patrick Schmidt, Michael Lüchinger, Marilena Balthasar, Felix Beltle and Paula Delissen (all Corporate / M&amp;A, Capital Markets), Stefan Oesterhelt, Laetitia Fracheboud, Juliette Buob and Tanja Niederer (all Tax), Andreas Müller, Jeremy Reichlin and Daniel Bötticher (all Employment and Executive Compensation), Richard Stäuber and Christoph Grüninger (all Competition, Regulatory), Gabriel Kasper (IP / IT), Sarah Fasel (Financing and Investment Products) and Daniel Junginger (Real Estate).</p>


Homburger advises Liberty Global and Sunrise on the Spin-off and Listing of Sunrise on the SIX and NASDAQ

Data Protection

Litigation

<p>Homburger advises high-growth, global alternative asset manager Apollo Global Management, Inc. (Apollo; NYSE: APO) on the acquisition of The Travel Corporation (TTC), a leading international travel group. TTC, which has been privately owned and operated for more than a century, is a global portfolio of 18 market leading travel brands, including Trafalgar, a leading escorted tour operator, Uniworld Boutique River Cruises, a luxury all-inclusive river cruise line, Contiki, youth travel specialist tour company, premium guided vacation company Insight Vacations, as well as other global travel brands and supporting business entities.</p>
<p>The Homburger team is led by Daniel Hasler and includes Marco Rostetter, Nicola Togni, Léonard Aeschlimann, Isabelle Cordey and Luc Huber (all Corporate / M&amp;A), Gabriel Kasper (Data Protection and IP / IT) and Manuel Adassery (Regulatory and Litigation).</p>


Homburger advises Apollo Global Management, Inc. on the acquisition of The Travel Corporation

NZZ_web_640x140

<p>On May 30, 2024, Aktiengesellschaft für die Neue Zürcher Zeitung (<strong>NZZ</strong>) announced the acquisition of a 25%-stake in APG SGA SA (<strong>APG|SGA</strong>) from the two anchor shareholders JCDecaux SE and Pargesa Asset Management S.A. for a total consideration of CHF 165 m. The transaction is expected to close in the coming days. JCDecaux SE and Pargesa Asset Management S.A. will remain shareholders in APG|SGA with respective stakes of 16.44% and 13.86%.</p>
<p>The Homburger team advising NZZ is led by Anna Peter and Daniel Daeniker and includes Héloïse de Jamblinne, Matthias Müller, Norina Tröhler and Micha Fankhauser (all Corporate / M&amp;A), Jürg Frick and Stefan Bindschedler (both Financing), Richard Stäuber and Katharina Bratvogel-Wilk (both Competition), Gregor Bühler and Gabriel Kasper (both IP / IT), Frédéric Fitzi (Employment), as well as Dieter Grünblatt and Philippe Weber (both Tax).</p>


Gabriel
Kasper

Homburger advises Liberty Global and Sunrise on the Spin-off and Listing of Sunrise on the SIX and NASDAQ

Homburger advises Apollo Global Management, Inc. on the acquisition of The Travel Corporation

Homburger advised NZZ on the acquisition of a strategic 25%-stake in APG|SGA, a leading Out-of-Home Media company in Switzerland

New Swiss-U.S. Data Privacy Framework

EU Confirms Adequacy of Swiss Data Protection Law

Revision of the Swiss Data Protection Law is Complete

Extraterritorial Scope of EU Digital Strategy

Extraterritorialer Geltungsbereich der EU-Digitalstrategie

Verbotene KI-Praktiken und Deepfakes

Join the Team

Gabriel Kasper

Career

Languages

Bar Registration

Teams

GabrielKasper

Homburger advises Liberty Global and Sunrise on the Spin-off and Listing of Sunrise on the SIX and NASDAQ

Homburger advises Apollo Global Management, Inc. on the acquisition of The Travel Corporation

Homburger advised NZZ on the acquisition of a strategic 25%-stake in APG|SGA, a leading Out-of-Home Media company in Switzerland

New Swiss-U.S. Data Privacy Framework

EU Confirms Adequacy of Swiss Data Protection Law

Revision of the Swiss Data Protection Law is Complete

Extraterritorial Scope of EU Digital Strategy

Extraterritorialer Geltungsbereich der EU-Digitalstrategie

Verbotene KI-Praktiken und Deepfakes

Join the Team

Gabriel Kasper

Career

Languages

Bar Registration

Teams

Gabriel
Kasper