<h4>The main findings of the decision</h4>
<ul>
<li>The EU-U.S. Privacy Shield can no longer serve as a basis for the transfer of personal data from the EU to the USA. The reason for this are the comprehensive surveillance measures of the USA, which according to the CJEU are not sufficiently limited by the Privacy Shield.</li>
<li>In contrast, the standard contractual clauses approved by the EU Commission are valid and can in principle be used for data exports to countries without an adequate level of data protection.</li>
<li>However, the CJEU makes an important reservation concerning standard contractual clauses: The data exporter cannot use the standard contractual clauses indiscriminately, but must verify on a case-by-case basis whether compliance with the standard contractual clauses is guaranteed in the recipient country. In particular, governmental access rights must be taken into account: Provided that these rights do not go beyond what is necessary in a democratic society to safeguard public security, such access rights are unproblematic. However, if it turns out that despite agreeing on the standard contractual clauses with the data importer, an adequate level of data protection is not achieved in the country of destination, the export should be suspended. This may be the case, in particular, if mass surveillance is carried out in the country of destination, which is not compatible with the principles of a democratic society.</li>
<li>The CJEU decision raises doubts as to whether the standard contractual clauses can be used in the future as a basis for data transfers to the USA. The CJEU has not ruled on this question. However, it argues that the U.S., surveillance measures conflict with European data protection law, as the U.S. surveillance programs are not limited to what is absolutely necessary.</li>
</ul>
<h4>Effects of the decision</h4>
In addition to the obvious consequence of the abolition of the privacy shield, the CJEU&#8217;s decision also makes data exporters and supervisory authorities responsible: data exporters may continue to use the standard contractual clauses, but they can no longer use them indiscriminately for exports to any country of destination. Instead, they must verify on a case-by-case basis whether the standard contractual clauses can be complied with. The CJEU is thereby creating new hurdles and uncertainties for data transfers to third countries, in particular to the USA. It can be assumed that data exports under the standard contractual clauses will require more attention in the future.
However, due to the importance of the standard contractual clauses for the transfer of data to third countries, it is above all the supervisory authorities who are called upon to act: They must now quickly clarify whether, in which cases and, if necessary, with which additional measures the standard contractual clauses can still be used in the medium term for data transfers to the USA and other countries with comparable surveillance programs. A coordinated approach at European level seems urgently necessary here.
Finally, the CJEU&#8217;s decision also sends a signal to the USA: The CJEU is not willing to settle for the limited improvements of the Privacy Shield compared to the former Safe Harbor Framework. The CJEU is thus increasing the pressure on the USA to make further concessions with regard to the protection of the personal rights of individuals in the EU in order to guarantee the transatlantic transfer of data, which is important for the economy.
<h4>Relevance for Swiss companies</h4>
The CJEU decision also has implications for Swiss companies. These too base their data exports largely on the standard contractual clauses also recognized by the Federal Data Protection and Information Commissioner (FDPIC). Switzerland also has the Swiss-U.S. Privacy Shield, which corresponds to the EU-U.S. Privacy Shield, which has now been declared invalid.
With regard to the Privacy Shield, it can be assumed that the FDPIC will also declare data exports on the basis of the Swiss-U.S. Privacy Shield to be inadmissible and adapt its list of countries with adequate data protection laws accordingly. It can therefore be assumed that in the short to medium term Swiss companies will no longer be able to rely on the Swiss-U.S. Privacy Shield for data exports.
With regard to standard contractual clauses, the situation in Switzerland under the Data Protection Act (DPA) is comparable to the one under the EU General Data Protection Regulation (GDPR): data transfers to third countries are permitted under art. 6 para. 2 lit. a DPA if «sufficient safeguards, in particular contractual clauses, ensure an adequate level of protection abroad». Swiss companies can therefore generally rely on the standard contractual clauses when exporting personal data to third countries. However, here too, intervention is required if there is reasonable doubt as to whether the data importer is complying with the standard contractual clauses.
<h4>Need for action</h4>
Companies that base data transfers to the USA on the EU-U.S. Privacy Shield will have to put these transfers on a new basis. The same is recommended to companies in Switzerland who base their data transfers to the USA on the Swiss-U.S. Privacy Shield.
The standard contractual clauses are an alternative. Here, the concerns of the CJEU must be taken into account: If the standard contractual clauses cannot be complied with by the data importer, the export must be suspended.
We advise companies that base their data exports from Switzerland to the USA on the standard contractual clauses to adopt a cautious approach in the short term. It is hardly imaginable to stop all these data exports from one day to the next, and in our opinion there is no immediate need for this either from a Swiss perspective or under the GDPR. It can be assumed that the European supervisory authorities and the FDPIC will soon issue guidance on the matter. Consequently, developments must be monitored and a reaction will be necessary if there is a change in practice. To this end, it must be made clear which contracts would have to be adapted, if need be, if there were any changes in practice with regard to the standard contract clauses and their application.
<h4>The background to the decision</h4>
The background to the decision is a dispute between Facebook and Maximilian Schrems regarding data transfers from Facebook Ireland to the USA. Facebook Ireland has based its data transfers to the USA on the standard contractual clauses since the CJEU&#8217;s annulment of the Safe Harbor Framework.2 This means that the U.S. Facebook entity has committed itself to Facebook Ireland to respect European data protection laws. Maximilian Schrems applied to the Irish data protection authority to prohibit the further transfer of his personal data by Facebook Ireland to the USA. He argued that the standard contractual clauses cannot serve as a basis for such transfer due to conflicting U.S. law.
<h4>Footnotes:</h4>
1 Judgment of the CJEU of July 16, 2020, Case C-311/18, available here: <a href="https://bit.ly/2ZADzY4">https://bit.ly/2ZADzY4</a> (visited on July 16, 2020).
2 Judgment of the CJEU of October 6, 2015, Case C-362/14, available here: <a href="https://bit.ly/3exrXcD">https://bit.ly/3exrXcD</a> (visited on July 16, 2020).

Homburger_Illu_DatentransferUSA_Preview_2020_09_V2

CJEU Decision in re Schrems II

<h4>What will not change?</h4>
Most importantly, the core principles of Swiss data protection law will not change. As already under the current DPA, the revised DPA will require compliance with a number of processing principles (such as transparency, purpose limitation, proportionality, data security, etc.), and the processing of personal data continues to be lawful if these processing principles are complied with.
In this respect, the revised DPA continues to differ from the EU General Data Protection Regulation (the GDPR). There will not be a need for a legal basis for each processing activity. Rather, a processing activity must only be justified based on consent, legal requirements or overriding private or public interests if any processing principle is not complied with, or if personal data is processed against the data subject&#8217;s wish. Thus, the need for justification continues to be an exception rather than the default under the revised DPA.
In practice, we do not expect the revision of the DPA to have a major impact on how companies process personal data in Switzerland. Rather, the new DPA will have an impact on data protection governance and documentation needed to ensure compliance.
<h4>What will change?</h4>
Nevertheless, the revised DPA also brings a number of relevant changes. Largely, and not surprisingly, many of these changes are inspired by the GDPR and they will be familiar to data protection professionals working with the GDPR. The following changes are worth to be highlighted:
<ul>
<li>Data relating to legal entities will no longer be protected by the DPA. As under the GDPR, only data relating to individuals will fall within the scope of the revised DPA.</li>
<li>The data controller&#8217;s information duties will be broadened. The controller will have to inform the data subjects at least about its identity and contact details, the purpose of processing and recipients or categories of recipients. The list provided in the DPA is however not comprehensive, and controllers will have to consider whether additional information needs to be provided to data subjects, so that they provide the «information needed for the data subjects to exercise their rights» under the DPA and to «ensure a transparent processing», as rather vaguely required by the revised DPA.</li>
<li>There will be an increased need to document processing activities and to implement governance processes. Subject to certain exceptions applying to companies with less than 250 employees, data controllers and data processors will have to maintain inventories of their processing activities. For high risk processing activities, data controllers will have to perform a data protection impact assessment.</li>
<li>The new DPA introduces a data breach notification obligation into Swiss law: The data controller will have to report any data breach that is expected to trigger a high risk for the personality rights of data subjects to the Swiss Federal Data Protection and Information Commissioner (the FDPIC); the notification is to be made as soon as possible. Thus, the threshold for a notification obligation to be triggered is slightly higher than under the GDPR. If needed to protect the data subjects, or if requested by the FDPIC, the data controller must also inform the affected data subjects.</li>
<li>While the data subject rights will remain unchanged for most part, the revised DPA will introduce certain modifications regarding the data subject access right. In particular, it will likely be clarified that transfers among affiliates within the same group will not deprive the data controller from its right to refuse to provide information insofar as justified by its own overriding interests. Further, the revised DPA will introduce a right to data portability that is inspired by (but differs from) the GDPR.</li>
<li>The revised DPA will regulate automated individual decision making. Subject to certain exceptions, an information duty applies to the extent that decisions are exclusively based on automated processing and have legal consequences for, or otherwise significantly impair the data subject. There will not be a prohibition of such decision making, but a right of the data subject to escalate to a human being for review.</li>
<li>The new DPA will govern profiling, but the details are not yet resolved between the two parliamentary chambers. As it currently stands, the proposed regulation would be limited to certain restrictions with respect to performing credit checks and not have a relevant impact for most private companies.</li>
<li>The revised DPA will distinguish between controllers and processors, essentially in the same way as the GDPR does. While the distinction already exists under the current DPA, it will now be expressly introduced into the new DPA. In substance, the new DPA does not provide for detailed requirements regarding processor terms, so that GDPR-compliant processor terms continue to be compliant also with the new DPA. Further, the new DPA expressly states that the appointment of subprocessors requires the approval of the data controller.</li>
<li>The obligation to register data files is abolished.</li>
<li>The FDPIC is granted more extensive enforcement powers. Under the new DPA, the FDPIC will be empowered to conduct investigations ex officio or upon complaint, to collect evidence and to issue orders. The FDPIC&#8217;s orders will be binding, unless they are successfully appealed by the addressee. This deviates from the current law, that does not empower the FDPIC to issue binding orders to remedy non-compliance.</li>
<li>The new DPA will significantly broaden the range of sanctions for non-compliance with the DPA. Under the new DPA, sanctions of up to CHF 250,000 can be triggered by a broad range of infringements of the DPA.</li>
</ul>
<h4>Will there be relevant changes regarding the export of personal data?</h4>
The core principles governing data exports will remain unchanged under the new DPA. Thus, data exports continue to be permitted to countries that have adequate data protection laws in place. Conversely, exports to third countries either require justification (such as the performance of an agreement with or in the interest of the data subject, overriding public interests, the enforcement of claims, etc.) or the implementation of other remedies to maintain an adequate level of data protection (e.g., by implementing standard contractual clauses, binding corporate rules, or other contractual arrangements, etc.).
However, there will be a few amendments with relevance for day-to-day business activities. First, the new DPA empowers the Federal Council to render binding adequacy decisions on the data protection level of foreign jurisdictions; the current non-binding FDPIC list of whitelisted countries will no longer be maintained. Second, the use of approved standard contractual clauses will no longer have to be notified to the FDPIC. Third, the possible justifications for exports to non-whitelisted countries are broadened in the context of foreign proceedings, given that the revised DPA will also allow exports to exercise or enforce claims in proceedings at foreign authorities (and not only courts, as under the current DPA). This will facilitate data exports for the purpose of foreign regulatory proceedings in front of administrative authorities rather than courts, which triggered a number of litigations under the current DPA. Fourth, the information duties of the data controller under the revised DPA will require the data controller to inform the data subject about the country to where the data will be exported, and the applicable justification or other remedy in case of exports to non-whitelisted countries.
<h4>Will the new DPA have extra-territorial reach?</h4>
Already the current DPA has a limited extra-territorial reach, which is the result of Swiss international private law that allows data subjects to choose Swiss law to apply in certain situations with respect to claims under data protection law. Going beyond that, the revised DPA will apply to processing activities outside of Switzerland that take effect in Switzerland. Further, data controllers domiciled outside of Switzerland will have to appoint a representative in Switzerland in case they process personal data of individuals in Switzerland and the processing (i) occurs in the context of the offering of products or services in Switzerland or to monitor the conduct of individuals in Switzerland, (ii) is extensive and regular and (iii) implies a high risk for the data subjects. The representative has to maintain an inventory of the relevant processing activities.
<h4>Will there be a Swiss Finish?</h4>
In general, the requirements under the revised DPA will not go beyond the level of protection of the GDPR. Most «Swiss finishes» that were included in the first draft of the DPA have been removed. As already mentioned, however, there are differences to be taken into account. For instance, the scope of the information duty of the data controller will not be delimited by a comprehensive list of information, but leave room for interpretation as to what specific information has to be provided.
<h4>Are there other differences to the GDPR?</h4>
There are a number of other differences compared to the GDPR. For instance, consent continues to be a viable means of justification for breach of privacy under the revised DPA as under the current DPA. In particular, and unlike under the GDPR, there will not be any unbundling requirements introduced into Swiss law. Differences also exist with respect to data subject rights.
<h4>What are the sanctions under the DPA?</h4>
While the sanctions for breaches of the new DPA will be more severe compared with the current law, they are still moderate when compared to the GDPR. It is important to note, however, that the revised DPA will not provide for administrative sanctions against companies, but continue to target responsible individuals based on criminal liability. Accordingly, an individual&#8217;s non-compliance with the new DPA may be fined with up to CHF 250,000. If it would require a disproportionate effort to identify the individual offender acting within a company and the expected fine does not exceed CHF 50,000, the company can be fined instead.
<h4>What are the next steps?</h4>
A few differences remain to be resolved in parliament. In substance, these relate to the regulation of profiling activities and to details regarding the information duties, the data subject access right, and the justification of processing activities in the context of credit checks. Likely, the remaining differences will be resolved during Q1 of 2020. While a public referendum on the revised DPA is a possibility, no calls for a referendum have been made so far.
<h4>When will the DPA enter into force?</h4>
As it currently stands, the revised DPA will likely enter into force early 2021.
<h4>Will there be a general transitional period?</h4>
No, the revised DPA will not provide for a general transitional period. It will apply going forward as from its entry into force, with limited exceptions (e.g., in respect of ongoing proceedings, and the application of the principle of privacy-by-design).
<h4>How do companies prepare for the new DPA?</h4>
For businesses that have already implemented GDPR compliance, only limited changes are to be expected. For instance, they may have to review and update their documentation – such as privacy policies – to address the DPA requirements, extend their inventories to cover Swiss processing activities that were previously carved-out, and implement processes to comply with Swiss data breach notification obligations.
For businesses that have not yet complied with the GDPR, major implications are to be expected. In particular, they will have to review their data protection organization, governance and documentation, and their agreements with third parties.
In particular, the following steps and activities are to be considered in view of the new DPA:
<ul>
<li>Review the organization. Consider establishing a data protection competence center for governance purposes and as internal and external point of contact for related questions.</li>
<li>Identify and document processing activities. Understanding and documenting processing activities is key to enable an appropriate data protection governance. This applies even if there may not be a formal obligation to maintain an inventory, as may be the case for small and medium companies.</li>
<li>Assess compliance of the processing activities. Check whether the requirements under the new DPA will be complied with. If not, implement necessary changes. Prioritize high risk processing activities and non-compliances that may have a high impact.</li>
<li>Implement appropriate processes. Assess whether appropriate processes are in place to deal with data subject rights. There is no need to have a formal process in all circumstances, but processes should facilitate compliance. For instance, companies need to be in a position to adequately deal with data subject rights and data breach notification obligations.</li>
<li>Update relevant documentation. For a large part, data protection compliance relies on up-to date and appropriate documentation. For instance, privacy policies need to be in place to inform employees, business partners and the public about processing activities, cross-border transfers may have to be secured by means of contractual arrangements with the data importer, and appropriate processor terms have to be implemented with third party processors. In view of the implementation of the revised DPA, this documentation needs to be reviewed and updated.</li>
<li>Review data security measures. Companies will continue to have to make sure that personal data is appropriately secured to avoid data breaches. Thus, security measures need to be reviewed and updated from time to time.</li>
<li>Consider whether a representative in Switzerland needs to be appointed. For certain foreign companies, the revised DPA will require the appointment of a representative in Switzerland.</li>
<li>Prepare for inquiries. The obligation to demonstrate compliance with the DPA rests upon data controllers. Thus, be prepared to answer inquiries from authorities and to demonstrate compliance.</li>
</ul>

Revision of the Swiss Federal Act on Data Protection

Corporate / M&A

Regulatory

Competition

IP / IT

Litigation

Financing and Investment Products

Liberty Global

On November 11, 2020, the all-cash public tender offer by UPC Schweiz GmbH (UPC), a subsidiary of Liberty Global plc, for all publicly held shares of Sunrise Communications Group AG (Sunrise) has been settled. UPC has acquired a 98% stake in Sunrise. The transaction values Sunrise’s equity at CHF 5.0 bn.
Homburger AG is advising Liberty Global on the transaction. The Homburger team is led by partners Daniel Daeniker and Daniel Hasler (Corporate / M&amp;A) and includes partners Richard Stäuber, Franz Hoffet (Competition, Regulatory), Stefan Oesterhelt (Tax), Luca Dal Molin (IP / IT) and Roman Baechler (Litigation), counsel Micha Fankhauser (Corporate / M&amp;A), associates Daniel Häusermann, Karin Mattle, Mirko Stiefel and Stefan Luginbühl (all Corporate / M&amp;A), Yves Bianchi, Ramin Gohari and Jonas J. Krull (Competition, Regulatory), David Borer and Pierina Janett-Seiler (Financing and Investment Products), Marc Vogelsang and Raphaël Fellay (both Tax), Kirsten Wesiak-Schmidt (IP / IT), as well as junior associates Cédric Berger, Géraldine Danuser, Daniel Madani (all Corporate / M&amp;A) and Urs Stürmer (Competition, Regulatory).

Homburger advises Liberty Global on successful settlement of public tender offer for Sunrise

On October 28, 2020, Winemaker World SA (Winemaker) launched its digital marketplace for wine connoisseurs and discoverers. The digital marketplace enables direct encounters between winemakers and wine lovers.
Winemaker&#8217;s first goal is to create an experience on winemaker.com that is as close as possible to a real visit to the wineries. Winemaker&#8217;s second goal is to significantly increase the share of direct sales of wine and thus create a platform for winemakers to find new customers.
Homburger AG acted as a legal counsel to Winemaker in connection with the setting-up of its business. The Homburger team was led by partners Claude Lambert (Corporate / M&amp;A), Luca Dal Molin (IP / IT) and Reto Heuberger (Tax) and included associates Karin Mattle (Corporate / M&amp;A), Laetitia Fracheboud (Tax), Kirsten Schmidt (IP / IT) and Francesco Bernasconi (Corporate / M&amp;A) and junior associate Vincent Croisier (Corporate / M&amp;A).

Homburger advised Winemaker World in the set-up of its digital marketplace

Employment and Executive Compensation

Vectivio

On October 15, 2020, VectivBio AG, a clinical-stage biotechnology company developing transformational medicines for patients with serious rare diseases, announced that it has closed a USD 110 m crossover financing from new investors Surveyor Capital (a Citadel company), Cormorant Capital and Eventide Asset Management, with participation from existing investors Versant Ventures, OrbiMed, Novo Holdings, BPI France, Tekla Healthcare Investors, Inserm Transfert Initiative and Cowen Healthcare Investments.
Proceeds from the financing will be used to support the further clinical development of VectivBio&#8217;s lead investigational product, apraglutide, to treat short bowel syndrome (SBS), early commercialization activities and further development of the pipeline through business development initiatives.
The Homburger team was led by partner Andreas Müller and included lead associate Margrit Marti, associates Angela Oppliger and Mirko Stiefel and transaction and corporate support specialist Carolina Rodriguez (all Corporate / M&amp;A), partner Luca Dal Molin and associate Kirsten Schmidt (both IP / IT) as well as partner Stefan Oesterhelt and associates Joël Gyger and Raphaël Fellay (all Tax).

Kirsten
Wesiak-Schmidt

CJEU Decision in re Schrems II

Revision of the Swiss Federal Act on Data Protection

Homburger advises Liberty Global on successful settlement of public tender offer for Sunrise

Homburger advised Winemaker World in the set-up of its digital marketplace

Homburger advises VectivBio on USD 110 m Crossover Financing

Switzerland: Data Protection Laws and Regulations

Datenschutz als Vermögensrecht

Datenmärkte ohne "Dateneigentum"

Join the Team

Kirsten Wesiak-Schmidt

Career

Languages

Bar Registration

Teams

KirstenWesiak-Schmidt

CJEU Decision in re Schrems II

Revision of the Swiss Federal Act on Data Protection

Homburger advises Liberty Global on successful settlement of public tender offer for Sunrise

Homburger advised Winemaker World in the set-up of its digital marketplace

Homburger advises VectivBio on USD 110 m Crossover Financing

Switzerland: Data Protection Laws and Regulations

Datenschutz als Vermögensrecht

Datenmärkte ohne "Dateneigentum"

Join the Team

Kirsten Wesiak-Schmidt

Career

Languages

Bar Registration

Teams

Kirsten
Wesiak-Schmidt