On August 27, 2021, the Swiss Federal Data Protection and Information Commissioner (FDPIC) <a href="https://www.edoeb.admin.ch/edoeb/en/home/latest-news/aktuell_news.html#-1259254222" target="_blank" rel="noopener">informed</a> that it recognizes the <a href="https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?uri=CELEX:32021D0914&amp;locale=de" target="_blank" rel="noopener">new EU standard contractual clauses</a> published by the European Commission on June 4, 2021 as standard clauses under the Swiss Data Protection Act (DPA). Hence, companies exporting personal data from Switzerland may use the new SCC for their data exports from Switzerland. In the following, we summarize the key takeaways resulting from the FDPIC&#8217;s decision.
<h4>What follows from the FDPIC&#8217;s acknowledgment of August 27, 2021?</h4>
The FDPIC recognized the new SCC as standard clauses acceptable for data exports from Switzerland. This means that Swiss companies may in principle use the new SCC as basis for exports of personal data from Switzerland to third countries without adequate data protection laws. As a result of this acknowledgment, companies relying on the new SCC are exempt from the requirement to notify the FDPIC of the use of the new SCC for each transfer; instead, it will be sufficient for them to inform the FDPIC in a general manner that they rely on the new SCC when exporting personal data to third countries.
<h4>Is the transition to the new SCC mandatory for Swiss companies?</h4>
The new SCC, as well as the old SCC, are just one of several means to provide for sufficient safeguards when exporting personal data from Switzerland to third countries without adequate data protection laws. Hence, using the SCC is not mandatory per se. However, using alternative contractual safeguards requires a case-by-case notification to and examination by the FDPIC, which makes their use and administration burdensome. Thus, from a practical standpoint, using the new SCC will often be the only feasible basis for exports of personal data to third countries where no exception provided for in the DPA to justify the export without contractual safeguards applies.
Moreover, it is to be expected that the FDPIC will not accept the continued use of the old SCC as alternative contractual safeguards for exports of personal data to third countries. Thus, even if the transition to the new SCC is not as such mandatory, the old SCC will no longer be regarded as sufficient by the FDPIC. Hence, action will be required in any case where existing agreements that rely on the old SCC shall continue beyond the end of 2022 (cf. below re timeline).
<h4>What is the timeline to implement the new SCC?</h4>
The FDPIC&#8217;s acknowledgment comes right in time, as many companies are amidst the transition to the new SCC, which become binding in the EU as from September 27, 2021. Swiss companies will be relieved to hear that the Swiss timeline is largely aligned with the one applicable in the EU, simplifying the coordination of the transition activities in the EU and in Switzerland:
<ul>
<li>As from September 27, 2021, the old SCC will no longer be acknowledged by the FDPIC as standard clauses providing for sufficient safeguards for data exports to third countries from Switzerland. Accordingly, as from that date, new or amended agreements governing exports of personal data from Switzerland to third countries should no longer rely on the old SCC as basis to provide adequate data protection safeguards. The same applies with respect to other standard contractual safeguards previously acknowledged by the FDPIC – namely the Swiss Transborder Data Flow Agreement (for outsourcing of data processing) as well as the template agreement of the European Council – which were however not frequently used in practice.</li>
<li>There will be a transition period until the end of 2022 for existing agreements based on the old SCC, provided that the relevant processing activities they govern and the agreements as such remain substantially unchanged: Companies may continue to rely on such existing agreements until December 31, 2022. As from January 1, 2023, these agreements will have to be updated to incorporate the new SCC or, as the case may be, other acceptable safeguards.</li>
</ul>
<h4>Do the new SCC need to be adapted for use in Switzerland?</h4>
According to the FDPIC, the SCC require only minor clarifications to account for the DPA. In particular, the FDPIC asks for clarifications to be added (1) that references to EU member states in the SCC shall not be interpreted in such a way that data subjects in Switzerland are excluded from exercising their rights at their habitual residence in Switzerland,<a href="#_ftn1" name="_ftnref1">[1]</a> and (2) that the SCC also protect data pertaining to legal entities as long as the current Swiss DPA remains in force.<a href="#_ftn2" name="_ftnref2">[2]</a> In addition, companies need to clarify (3) that the FDPIC is the competent authority for the purposes of the DPA.
These clarifications may be included in an addendum to the SCC that applies insofar as the DPA is concerned. This way, the addition would not conflict with the general rule stipulated in the SCC that the SCC as such must not be amended in order to constitute a valid basis for transfers under the GDPR.
Beyond that, the FDPIC acknowledges in principle that the new SCC can be used unchanged for data transfers that are governed by the DPA and the GDPR at the same time. This will facilitate implementation work for Swiss companies.
<h4>Can we simply replace references to the old SCC in existing agreements to references to the new SCC?</h4>
The transition to the new SCC requires more complex adjustments to existing agreements than just this. This is because the new SCC are substantially different from the old SCC in terms of content and structure, so that they cannot simply be replaced in agreements by way of an addendum replacing references to the old SCC by such to the new SCC.
First, the new SCC implement a modular approach and replace all three previous sets of SCC (i.e., the two different sets of SCC for controller-to-controller transfers and the third set for controller-to-processor transfers). When implementing the new SCC, the parties will have to agree on which module(s) apply to the relevant data export. Specifically, the new SCC include four modules governing different types of transfers, as follows:
<ul>
<li>Module 1: controller-to-controller transfers;</li>
<li>Module 2: controller-to-processor (and potential sub-processors) transfers;</li>
<li>Module 3: processor-to-processor (and potential sub-processors) transfers; and</li>
<li>Module 4: processor-to-controller transfers.</li>
</ul>
Second, the new SCC include additional rules and govern further topics than the old SCC that need to be considered when adjusting existing agreements. In particular, modules 2 and 3 governing transfers to processors include processor terms, which may conflict with existing agreements. Further, the new SCC implement the requirement to perform a transfer impact assessment to help companies deal with the requirements resulting from last year&#8217;s Schrems II decision of the CJEU (cf. below and our <a href="https://www.homburger.ch/en/insights/cjeu-decision-schrems-ii-new-hurdles-data-transfers-usa" target="_blank" rel="noopener">Bulletin of July 16, 2020</a>). Moreover, the new SCC include provisions governing liability and certain representations to be made by the parties. All this means that existing agreements will often have to be reviewed one-by-one to assess the potential impact of the transition to the new SCC and to identify the specific adjustments needed.
Third, the new SCC will require additional information in their annexes, such as on the competent supervisory authority, on safeguards implemented when transferring sensitive personal data, and on the frequency of the transfer. For transfers to processors, they require the specification of the subject matter, the nature and the duration of the processing. In addition, the new SCC require a broader, more detailed and specific description of the technical and organizational measures to ensure data security than this was the case under the old SCC.
<h4>Do we need to perform a Swiss law transfer impact assessment when using the new SCC?</h4>
In its Schrems II decision, the CJEU held that the use of the SCC as a contractual basis to secure exports of personal data to third countries requires a case-by-case assessment, in particular with regard to data access rights of authorities in the country of destination (see our <a href="https://www.homburger.ch/en/insights/cjeu-decision-schrems-ii-new-hurdles-data-transfers-usa" target="_blank" rel="noopener">Bulletin of July 16, 2020</a>). As a result, the new SCC now also require the data exporter and the data importer to undertake and document a so-called transfer impact assessment (TIA). Further, the new SCC require the parties to warrant that they have no reasons to believe that the laws and practices in place in the country of destination prevents the data importer from complying with its obligations under the SCC, and they impose an obligation on the data importer to notify the data exporter in case of access requests by authorities. Failure to comply with these obligations, may result in liability.
However, it is important to note that the new SCC as such do not overcome the structural issue identified by the CJEU in the Schrems II decision, i.e., that mandatory surveillance and government access laws may overrule the contractual obligations under the SCC. Thus, if the TIA identifies risks that are not mitigated by the SCC, additional safeguards are required in order for the data export to go forward.
From a Swiss law perspective, the FDPIC also requests a TIA to be performed. The basis for this is each data exporter&#8217;s obligation to ensure that contractual safeguards provide adequate protection for the personality of the data subjects. According to its <a href="https://www.edoeb.admin.ch/dam/edoeb/en/dokumente/2021/Anleitung%20f%C3%BCr%20die%20Pr%C3%BCfung%20von%20Daten%C3%BCbermittlungen%20mit%20Auslandbezug%20EN.pdf.download.pdf/Anleitung%20f%C3%BCr%20die%20Pr%C3%BCfung%20von%20Daten%C3%BCbermittlungen%20mit%20Auslandbezug%20EN.pdf" target="_blank" rel="noopener">guidance on TIAs</a> released by the FDPIC earlier this year, companies performing a TIA need to consider (1) the specifics of the contemplated data transfer, in particular in terms of categories of personal data, data subjects, purpose of the transfer, processors and sub-processors involved (if any), and (2) the compliance of the third country&#8217;s surveillance and lawful access rights with the four essential guarantees of lawful basis, necessity and proportionality, effective legal remedies, and access to an independent and impartial court in relation to the contemplated data export. If the essential guarantees are complied with in the country of destination, the data exporter may in principle export the personal data based on the SCC. Otherwise, in addition to agreeing on the SCC, additional technical and organizational measures need to be implemented in order to ensure an adequate data protection level. In practice, it is to be expected that the Swiss law TIA will largely follow the one required by the SCC and EU data protection authorities, even though uncertainties as to regulatory practice continue to this date.
<h4>Do we need to inform the FDPIC about the transition to the new SCC?</h4>
Unlike the GDPR, the current Swiss DPA still requires companies to inform the FDPIC about their use of the SCC. While the use of non-standard contractual safeguards requires a case-by-case notification to and examination by the FDPIC, for the SCC, a general, one-time notification to the FDPIC is sufficient to cover all further uses of the SCC. This notification requirement for approved standard clauses will be abolished when the new DPA will enter into force. For the time being, however, it continues to apply.
In its August 27, 2021 communication, the FDPIC does not address the question of whether companies who have previously informed the FDPIC about their use of the old SCC need to renew this notification as they transition to the new SCC. Even though that the practical risk of fines imposed in case companies fail to notify the FDPIC of the transition from the old to the new SCC appears to be limited,<a href="#_ftn3" name="_ftnref3">[3]</a> it is advisable to inform the FDPIC of the use of the new SCC to avoid such risk.
<h4>Is there any update as to when the new Swiss DPA enters into force?</h4>
Interestingly, the FDPIC&#8217;s communication of August 27, 2021 also provides an update on the timeline for the new Swiss DPA to enter into force: While many expected this to be in the second half of 2022, the FDPIC indicates that the new Swiss DPA will enter into force only on January 1, 2023.
It is to be noted, however, that this view of the FDPIC is not binding upon the Federal Council who will decide when the new DPA enters into force. Thus, in theory at least, it is still possible that the new DPA enters into force still in 2022.
<h6><a href="#_ftnref1" name="_ftn1">[1]</a>        See in particular clause 18(c) of the SCC, which refers to the right of the data subject to bring legal proceedings against the data export and/or data importer before the courts of the &#8220;Member States&#8221; in which the data subject has his/her habitual residence. The FDPIC does not want this to be interpreted as limiting the rights of data subjects with their habitual residence in Switzerland.</h6>
<h6><a href="#_ftnref2" name="_ftn2">[2]</a>        The current DPA still protects data pertaining to legal entities as personal data. Under the new DPA, data pertaining to legal entities will no longer constitute personal data.</h6>
<h6><a href="#_ftnref3" name="_ftn3">[3]</a>        According to article 34(2)(a) DPA, the failure to inform the FDPIC about the contractual safeguards relied upon when exporting personal data to third countries is a criminal offence that may result in fines of up to CHF 10,000.</h6>

Homburger Bulletin

Switzerland Recognizes New EU Standard Contractual Clauses

Personal data is an omnipresent key value driver for businesses. The regulation governing its processing has tightened and continues to evolve dynamically, often making it challenging for companies to follow. Most recently, for instance, the CJEU&#8217;s decision in the Schrems II matter took many by surprise. However, data protection has a long history of constant evolution. Forty years ago, on January 28, 1981, the Council of Europe opened for signature what is nowadays known as the <a href="https://www.coe.int/en/web/conventions/full-list/-/conventions/treaty/108" target="_blank" rel="noopener">Convention 108</a> (the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data) and became the founding piece of European data protection regulation, kicking-off an exciting development that leads up to today. This year&#8217;s Data Protection Day commemorates the 40th anniversary of such landmark event in data protection!

<h4>Revision of the Swiss Data Protection Act: Implementation Work Ahead</h4>
On September 25, 2020, the Swiss Federal Parliament approved the revision of the Swiss Data Protection Act (DPA) after a long parliamentary debate (see our <a href="https://www.homburger.ch/en/insights/swiss-parliament-approves-revision-of-the-swiss-federal-act-data-protection" target="_blank" rel="noopener">Newsletter of September 25, 2020</a> summarizing the key changes of the revision). You may find the final text of the new DPA in <a href="https://cms.homburger.ch/wp-content/uploads/2021/01/Swiss-Data-Protection-Act-of-September-25-2020_02_682151_1.pdf" target="_blank" rel="noopener">our printable booklet</a>, which includes the German text and an English translation.
No public referendum has been called for. Hence, it is now certain that the new DPA will enter into force. The timeline however still remains to be confirmed. The federal administration&#8217;s work on the new implementing ordinance is underway and we expect the draft to be available to the public in Q2 of this year. The new DPA is scheduled to enter into force early or mid 2022.
Given that the new DPA will not provide for an implementation period once it enters into force, this year is the time to kick-off implementation projects. Typically, companies will have to start such projects by (1) identifying processing activities in scope of the new DPA and (2) existing documentation relating thereto, then assess (3) whether there is a need to change any of these processing activities to ensure compliance with the new DPA, (4) prepare inventories of in-scope processing activities, (5) update existing privacy notices and similar documents, (6) review and update intra-group and third party agreements (such as with third party processors) governing data transfers and third party processing activities, (7) perform data protection impact assessments where needed, and (8) review, update and, where appropriate, document governance processes (such as to deal with data subject rights and breach notification obligations).
Shortly, we will publish additional resources to facilitate implementation projects.
<h4>Recent Federal Supreme Court&#8217;s Decisions on Data Subject Access Requests</h4>
In November 2020, the Federal Supreme Court held that a data subject access request under the DPA which was made prior to filing a lawsuit to gather information about the other party and obtain evidence (a so-called «fishing expedition») is an abuse of rights.<a href="#_ftn1" name="_ftnref1">[1]</a> It is indeed established case law that an access request may be abusive if it is made only for this purpose. However, the award clarifies that an abuse of rights exists only if the sole purpose of the access request is to clarify the prospects of litigation. If the access request may also serve other purposes, the information cannot be refused for abusive exercise of rights.
In its reasoning, the Federal Supreme Court referred to the revised DPA, according to which the data subject requesting access to information must be provided with the information necessary to assert his or her rights under the DPA and to ensure a transparent data processing. Thus, the aforementioned decision is in fact the first decision on the revised DPA, indicating that the Federal Supreme Court will follow its previous case law on the data subject access right also under the new DPA.
In a decision of December 2020,<a href="#_ftn2" name="_ftnref2">[2]</a> the Federal Supreme Court further stated that the data subject access right only covers written or otherwise physically existing data. Data that merely exists in a person&#8217;s memory is not covered. In particular, the access right under the DPA does not include a general right to discover, by questioning parties and witnesses, between whom, when and about what a personal conversation took place. Furthermore, the access right only covers data that can be accessed by the controller. Thus, the controller does not have to make inquiries, such as about the origin of information, if such data is not retained by the controller.
<h4>Brexit – Mind the Gap</h4>
About a month ago, the United Kingdom left the European Union. With that, the EU General Data Protection Regulation (GDPR) has ceased to take effect in the UK. However, the UK has largely transitioned the substantive terms of the GDPR as domestic «UK-GDPR» into the law of England and Wales, Scotland and Northern Ireland.<a href="#_ftn3" name="_ftnref3">[3]</a>
Leaving the EU has implications for data exports to the UK from EU and EEA member states: in principle, the UK now qualifies as third country so that exports of personal data to the UK are subject to an adequacy decision by the European Commission or, absent such decision, the implementation of alternative safeguards or case-by-case exceptions as provided for under the GDPR. The EU and the UK, however, have agreed on a transition period of up to six months ending on June 30, 2021 at the latest, during which data transfers from EU and EEA member states to the UK may continue as if the UK were not qualified as third country. In order for data transfers to continue smoothly thereafter, an adequacy decision by the European Commission will be required.
For Swiss businesses, it is good to know that data exports from Switzerland to the UK are not impacted. The Swiss Federal Data Protection and Information Commissioner (FDPIC) continues to regard the UK as a country with adequate data protection laws.<a href="#_ftn4" name="_ftnref4">[4]</a>
<h4>Schrems II – Uncertainty Continues</h4>
The uncertainties caused by the CJEU&#8217;s landmark decision in the Schrems II matter handed down on July 16, 2020<a href="#_ftn5" name="_ftnref5">[5]</a> (see our <a href="https://www.homburger.ch/en/insights/cjeu-decision-schrems-ii-new-hurdles-data-transfers-usa" target="_blank" rel="noopener">Newsletter of July 16, 2020</a>) continue to impact businesses transferring personal data to the USA and other third countries. Guidance provided by supervisory authorities since the CJEU&#8217;s decision has been disparate.
The CJEU itself stressed that supplementary safeguards may be needed to continue using standard contractual clauses for exports to certain third countries such as the USA, but it did not specify which safeguards these might be. Recently, the European Data Protection Board (EDPB) adopted recommendations<a href="#_ftn6" name="_ftnref6">[6]</a> seeking to shed further light on the process to identify and adopt such safeguards. Not surprisingly, the EDPB propagates a strict view. It warns against relying on subjective factors, such as the perceived likelihood of foreign authorities seeking access to the relevant data. Further, it argues that contractual and organizational measures alone will often not be sufficient, but that they need to be combined with technical measures, such as encryption and de-identification. The EDPB goes far by stipulating that there may not be any sufficient safeguards available in case clear text access to personal data is required from a third country where contractual safeguards do not suffice, such as in case of clear text access by a cloud provider in the USA for processing operations or when using remote access to clear text data.
In a statement published on September 8, 2020,<a href="#_ftn7" name="_ftnref7">[7]</a> the Swiss FDPIC shares the CJEU&#8217;s concerns regarding data exports to countries where local laws deprive contractual safeguards of its effect, and it agrees that additional technical measures may have to be implemented to provide for sufficient safeguards. However, as far as potential clear text access is concerned, the FDPIC takes a slightly less restrictive approach than the EDPB, stipulating that the use of sufficient technical safeguards may prove to be challenging in such circumstances (but, hence, not outright impossible).
The recently published revised standard contractual clauses of the European Commission<a href="#_ftn8" name="_ftnref8">[8]</a> will, once adopted, not overcome the hurdles imposed by the Schrems II decision. Thus, uncertainty will continue for many businesses.
<h6><a name="_ftn1"></a><a href="https://www.homburger.ch/en/insights/data-protection-day-2021#_ftnref1">[1]</a> Federal Supreme Court decision 4A_277/2020 dated November 18, 2020 (<a href="https://www.bger.ch/ext/eurospider/live/de/php/aza/http/index.php?highlight_docid=aza%3A%2F%2Faza://18-11-2020-4A_277-2020&amp;lang=de&amp;zoom=&amp;type=show_document">https://www.bger.ch/ext/eurospider/live/de/php/aza/http/index.php?highlight_docid=aza%3A%2F%2Faza://18-11-2020-4A_277-2020&amp;lang=de&amp;zoom=&amp;type=show_document</a> 
(visited on January 27, 2021).</h6>
<h6><a name="_ftn2"></a><a href="https://www.homburger.ch/en/insights/data-protection-day-2021#_ftnref2">[2]</a> Federal Supreme Court decision 4A_125/2020 dated December 10, 2020 (<a href="https://www.bger.ch/ext/eurospider/live/de/php/aza/http/index.php?highlight_docid=aza%3A%2F%2Faza://10-12-2020-4A_125-2020&amp;lang=de&amp;zoom=&amp;type=show_document">https://www.bger.ch/ext/eurospider/live/de/php/aza/http/index.php?highlight_docid=aza%3A%2F%2Faza://10-12-2020-4A_125-2020&amp;lang=de&amp;zoom=&amp;type=show_document</a> 
(visited on January 27, 2021).</h6>
<h6><a name="_ftn3"></a><a href="https://www.homburger.ch/en/insights/data-protection-day-2021#_ftnref3">[3]</a> See: <a href="https://ico.org.uk/for-organisations/dp-at-the-end-of-the-transition-period/data-protection-now-the-transition-period-has-ended/the-gdpr/">https://ico.org.uk/for-organisations/dp-at-the-end-of-the-transition-period/data-protection-now-the-transition-period-has-ended/the-gdpr/</a> (visited on January 27, 2021).</h6>
<h6><a name="_ftn4"></a><a href="https://www.homburger.ch/en/insights/data-protection-day-2021#_ftnref4">[4]</a> See: <a href="https://www.edoeb.admin.ch/edoeb/de/home/aktuell/aktuell_news.html#-181656549">https://www.edoeb.admin.ch/edoeb/de/home/aktuell/aktuell_news.html#-181656549</a> (visited on January 27, 2021).</h6>
<h6><a name="_ftn5"></a><a href="https://www.homburger.ch/en/insights/data-protection-day-2021#_ftnref5">[5]</a> See: <a href="http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=228677&amp;pageIndex=0&amp;doclang=EN&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=9729736">http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=228677&amp;pageIndex=0&amp;doclang=EN&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=9729736</a> 
(visited on January 27, 2021).</h6>
<h6><a name="_ftn6"></a><a href="https://www.homburger.ch/en/insights/data-protection-day-2021#_ftnref6">[6]</a> See: <a href="https://edpb.europa.eu/sites/edpb/files/consultation/edpb_recommendations_202001_supplementarymeasurestransferstools_en.pdf">https://edpb.europa.eu/sites/edpb/files/consultation/edpb_recommendations_202001_supplementarymeasurestransferstools_en.pdf</a> 
(visited on January 27, 2021).</h6>
<h6><a name="_ftn7"></a><a href="https://www.homburger.ch/en/insights/data-protection-day-2021#_ftnref7">[7]</a> See: <a href="https://www.edoeb.admin.ch/dam/edoeb/de/dokumente/2020/Positionspapier_PS_%20ED%C3%96B_DE.pdf.download.pdf/Positionspapier_PS_%20ED%C3%96B_DE.pdf">https://www.edoeb.admin.ch/dam/edoeb/de/dokumente/2020/Positionspapier_PS_%20ED%C3%96B_DE.pdf.download.pdf/Positionspapier_PS_%20ED%C3%96B_DE.pdf</a> 
(visited on January 27, 2021).</h6>
<h6><a name="_ftn8"></a><a href="https://www.homburger.ch/en/insights/data-protection-day-2021#_ftnref8">[8]</a> See: <a href="https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/12741-Commission-Implementing-Decision-on-standard-contractual-clauses-for-the-transfer-of-personal-data-to-third-countries">https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/12741-Commission-Implementing-Decision-on-standard-contractual-clauses-for-the-transfer-of-personal-data-to-third-countries</a> 
(visited on January 27, 2021).</h6>

Homburger Bulletin Data Protection Day

Data Protection Day 2021

<h4>The main findings of the decision</h4>
<ul>
<li>The EU-U.S. Privacy Shield can no longer serve as a basis for the transfer of personal data from the EU to the USA. The reason for this are the comprehensive surveillance measures of the USA, which according to the CJEU are not sufficiently limited by the Privacy Shield.</li>
<li>In contrast, the standard contractual clauses approved by the EU Commission are valid and can in principle be used for data exports to countries without an adequate level of data protection.</li>
<li>However, the CJEU makes an important reservation concerning standard contractual clauses: The data exporter cannot use the standard contractual clauses indiscriminately, but must verify on a case-by-case basis whether compliance with the standard contractual clauses is guaranteed in the recipient country. In particular, governmental access rights must be taken into account: Provided that these rights do not go beyond what is necessary in a democratic society to safeguard public security, such access rights are unproblematic. However, if it turns out that despite agreeing on the standard contractual clauses with the data importer, an adequate level of data protection is not achieved in the country of destination, the export should be suspended. This may be the case, in particular, if mass surveillance is carried out in the country of destination, which is not compatible with the principles of a democratic society.</li>
<li>The CJEU decision raises doubts as to whether the standard contractual clauses can be used in the future as a basis for data transfers to the USA. The CJEU has not ruled on this question. However, it argues that the U.S., surveillance measures conflict with European data protection law, as the U.S. surveillance programs are not limited to what is absolutely necessary.</li>
</ul>
<h4>Effects of the decision</h4>
In addition to the obvious consequence of the abolition of the privacy shield, the CJEU&#8217;s decision also makes data exporters and supervisory authorities responsible: data exporters may continue to use the standard contractual clauses, but they can no longer use them indiscriminately for exports to any country of destination. Instead, they must verify on a case-by-case basis whether the standard contractual clauses can be complied with. The CJEU is thereby creating new hurdles and uncertainties for data transfers to third countries, in particular to the USA. It can be assumed that data exports under the standard contractual clauses will require more attention in the future.
However, due to the importance of the standard contractual clauses for the transfer of data to third countries, it is above all the supervisory authorities who are called upon to act: They must now quickly clarify whether, in which cases and, if necessary, with which additional measures the standard contractual clauses can still be used in the medium term for data transfers to the USA and other countries with comparable surveillance programs. A coordinated approach at European level seems urgently necessary here.
Finally, the CJEU&#8217;s decision also sends a signal to the USA: The CJEU is not willing to settle for the limited improvements of the Privacy Shield compared to the former Safe Harbor Framework. The CJEU is thus increasing the pressure on the USA to make further concessions with regard to the protection of the personal rights of individuals in the EU in order to guarantee the transatlantic transfer of data, which is important for the economy.
<h4>Relevance for Swiss companies</h4>
The CJEU decision also has implications for Swiss companies. These too base their data exports largely on the standard contractual clauses also recognized by the Federal Data Protection and Information Commissioner (FDPIC). Switzerland also has the Swiss-U.S. Privacy Shield, which corresponds to the EU-U.S. Privacy Shield, which has now been declared invalid.
With regard to the Privacy Shield, it can be assumed that the FDPIC will also declare data exports on the basis of the Swiss-U.S. Privacy Shield to be inadmissible and adapt its list of countries with adequate data protection laws accordingly. It can therefore be assumed that in the short to medium term Swiss companies will no longer be able to rely on the Swiss-U.S. Privacy Shield for data exports.
With regard to standard contractual clauses, the situation in Switzerland under the Data Protection Act (DPA) is comparable to the one under the EU General Data Protection Regulation (GDPR): data transfers to third countries are permitted under art. 6 para. 2 lit. a DPA if «sufficient safeguards, in particular contractual clauses, ensure an adequate level of protection abroad». Swiss companies can therefore generally rely on the standard contractual clauses when exporting personal data to third countries. However, here too, intervention is required if there is reasonable doubt as to whether the data importer is complying with the standard contractual clauses.
<h4>Need for action</h4>
Companies that base data transfers to the USA on the EU-U.S. Privacy Shield will have to put these transfers on a new basis. The same is recommended to companies in Switzerland who base their data transfers to the USA on the Swiss-U.S. Privacy Shield.
The standard contractual clauses are an alternative. Here, the concerns of the CJEU must be taken into account: If the standard contractual clauses cannot be complied with by the data importer, the export must be suspended.
We advise companies that base their data exports from Switzerland to the USA on the standard contractual clauses to adopt a cautious approach in the short term. It is hardly imaginable to stop all these data exports from one day to the next, and in our opinion there is no immediate need for this either from a Swiss perspective or under the GDPR. It can be assumed that the European supervisory authorities and the FDPIC will soon issue guidance on the matter. Consequently, developments must be monitored and a reaction will be necessary if there is a change in practice. To this end, it must be made clear which contracts would have to be adapted, if need be, if there were any changes in practice with regard to the standard contract clauses and their application.
<h4>The background to the decision</h4>
The background to the decision is a dispute between Facebook and Maximilian Schrems regarding data transfers from Facebook Ireland to the USA. Facebook Ireland has based its data transfers to the USA on the standard contractual clauses since the CJEU&#8217;s annulment of the Safe Harbor Framework.2 This means that the U.S. Facebook entity has committed itself to Facebook Ireland to respect European data protection laws. Maximilian Schrems applied to the Irish data protection authority to prohibit the further transfer of his personal data by Facebook Ireland to the USA. He argued that the standard contractual clauses cannot serve as a basis for such transfer due to conflicting U.S. law.
<h4>Footnotes:</h4>
1 Judgment of the CJEU of July 16, 2020, Case C-311/18, available here: <a href="https://bit.ly/2ZADzY4">https://bit.ly/2ZADzY4</a> (visited on July 16, 2020).
2 Judgment of the CJEU of October 6, 2015, Case C-362/14, available here: <a href="https://bit.ly/3exrXcD">https://bit.ly/3exrXcD</a> (visited on July 16, 2020).

Homburger_Illu_DatentransferUSA_Preview_2020_09_V2

CJEU Decision in re Schrems II

Corporate / M&A

Competition

Regulatory

IP / IT

Data Protection

Financing and Investment Products

Avaloq_bw

On December 22, 2020, Avaloq Group (Avaloq), a Swiss-based global leader in digital banking solutions, core banking software and wealth management technology, announced that Japan-based NEC Corporation (NEC, TSE:6701) had completed its acquisition of Avaloq. In the transaction, NEC acquired all outstanding shares from the existing shareholders, which includes the founders, current and former employees as well as private equity firm Warburg Pincus, at an enterprise value exceeding CHF 2 bn.
Homburger acted as global transaction counsel to Avaloq and the majority shareholders. The Homburger team was led by partner Heinz Schärer and included partner David Oser, associates Philippe Baumann and Angela Oppliger and junior associate Cédric Berger (all Corporate / M&amp;A), partner Marcel Dietrich and associates Allegra Arnold and David Waldmeier (all Competition, Regulatory), partners Georg Rauber and Luca Dal Molin and associates Valentin Fluor and Kirsten Wesiak-Schmidt (all IP / IT and Data Protection), partner Jürg Frick and associate Pierina Janett-Seiler (both Financing and Investment Products), as well as associate Marc Vogelsang (Tax).

Homburger advised Avaloq Group and majority shareholders in the completion of NEC Corporation's acquisition of Avaloq Group

Litigation

Liberty Global

On November 11, 2020, the all-cash public tender offer by UPC Schweiz GmbH (UPC), a subsidiary of Liberty Global plc, for all publicly held shares of Sunrise Communications Group AG (Sunrise) has been settled. UPC has acquired a 98% stake in Sunrise. The transaction values Sunrise’s equity at CHF 5.0 bn.
Homburger AG is advising Liberty Global on the transaction. The Homburger team is led by partners Daniel Daeniker and Daniel Hasler (Corporate / M&amp;A) and includes partners Richard Stäuber, Franz Hoffet (Competition, Regulatory), Stefan Oesterhelt (Tax), Luca Dal Molin (IP / IT) and Roman Baechler (Litigation), counsel Micha Fankhauser (Corporate / M&amp;A), associates Daniel Häusermann, Karin Mattle, Mirko Stiefel and Stefan Luginbühl (all Corporate / M&amp;A), Yves Bianchi, Ramin Gohari and Jonas J. Krull (Competition, Regulatory), David Borer and Pierina Janett-Seiler (Financing and Investment Products), Marc Vogelsang and Raphaël Fellay (both Tax), Kirsten Wesiak-Schmidt (IP / IT), as well as junior associates Cédric Berger, Géraldine Danuser, Daniel Madani (all Corporate / M&amp;A) and Urs Stürmer (Competition, Regulatory).

Homburger advises Liberty Global on successful settlement of public tender offer for Sunrise

On October 28, 2020, Winemaker World SA (Winemaker) launched its digital marketplace for wine connoisseurs and discoverers. The digital marketplace enables direct encounters between winemakers and wine lovers.
Winemaker&#8217;s first goal is to create an experience on winemaker.com that is as close as possible to a real visit to the wineries. Winemaker&#8217;s second goal is to significantly increase the share of direct sales of wine and thus create a platform for winemakers to find new customers.
Homburger AG acted as a legal counsel to Winemaker in connection with the setting-up of its business. The Homburger team was led by partners Claude Lambert (Corporate / M&amp;A), Luca Dal Molin (IP / IT) and Reto Heuberger (Tax) and included associates Karin Mattle (Corporate / M&amp;A), Laetitia Fracheboud (Tax), Kirsten Schmidt (IP / IT) and Francesco Bernasconi (Corporate / M&amp;A) and junior associate Vincent Croisier (Corporate / M&amp;A).

Kirsten
Wesiak-Schmidt

Homburger advised Avaloq Group and majority shareholders in the completion of NEC Corporation's acquisition of Avaloq Group

Homburger advises Liberty Global on successful settlement of public tender offer for Sunrise

Homburger advised Winemaker World in the set-up of its digital marketplace

Switzerland Recognizes New EU Standard Contractual Clauses

Data Protection Day 2021

CJEU Decision in re Schrems II

AIPPI Law Series: Law of Raw Data – Switzerland

Switzerland: Data Protection Laws and Regulations

Switzerland: Data Protection Laws and Regulations

Join the Team

Kirsten Wesiak-Schmidt

Career

Languages

Bar Registration

Teams

KirstenWesiak-Schmidt

Homburger advised Avaloq Group and majority shareholders in the completion of NEC Corporation's acquisition of Avaloq Group

Homburger advises Liberty Global on successful settlement of public tender offer for Sunrise

Homburger advised Winemaker World in the set-up of its digital marketplace

Switzerland Recognizes New EU Standard Contractual Clauses

Data Protection Day 2021

CJEU Decision in re Schrems II

AIPPI Law Series: Law of Raw Data – Switzerland

Switzerland: Data Protection Laws and Regulations

Switzerland: Data Protection Laws and Regulations

Join the Team

Kirsten Wesiak-Schmidt

Career

Languages

Bar Registration

Teams

Kirsten
Wesiak-Schmidt