<h3>As from September 15, 2024, the New Framework will Facilitate the Disclosure of Personal Data from Switzerland to the U.S.</h3>
<h3>What Is New?</h3>
<p>By way of its decision of August 14, 2024, the Swiss Federal Council has recognized that the Swiss-U.S. DPF provides for an adequate level of data protection when private companies or public authorities in Switzerland disclose personal data to U.S. companies that participate in the Swiss-U.S. DPF. <a href="https://www.fedlex.admin.ch/eli/cc/2022/568/en#annex_1" target="_blank" rel="noopener">Annex 1</a> of the Swiss Federal Ordinance on Data Protection will be updated to include such disclosures under the Swiss-U.S. DPF as guaranteeing an adequate level of data protection.</p>
<p>Switzerland thus follows the approach taken earlier by the EU with the adoption of the EU-U.S. Data Privacy Framework (<strong>EU-U.S. DPF</strong>) (see our <a href="https://www.homburger.ch/en/insights/are-data-transfers-to-the-united-states-safe-again" target="_blank" rel="noopener">Bulletin of July 11, 2023</a>). The new Swiss-U.S. DPF substantially corresponds to the EU-U.S. DPF, which marked the (preliminary) end of a period of uncertainty for disclosures of personal data to the U.S. after the «Schrems II» landmark decision of the Court of Justice of the European Union (<strong>CJEU</strong>) struck down the predecessor of the EU-U.S. DPF (see our <a href="https://homburger.ch/de/insights/eugh-urteil-im-fall-schrems-ii" target="_blank" rel="noopener">Bulletin of July 16, 2020</a>).</p>
<p>Most importantly, the Swiss-U.S. DPF provides for the following:</p>
<ul>
<li>The U.S. aligns its legal system with fundamental principles of Swiss law by way of the <a href="https://www.federalregister.gov/documents/2022/10/14/2022-22531/enhancing-safeguards-for-united-states-signals-intelligence-activities" target="_blank" rel="noopener">U.S. Executive Order 14086</a> executed by President Biden on October 7, 2022 (<strong>EO 14086</strong>). The changes include a limitation of U.S. intelligence activities to what is proportionate, oversight of U.S. intelligence services, and effective redress. Earlier this year on June 13, 2024, the <a href="https://www.justice.gov/opcl/executive-order-14086" target="_blank" rel="noopener">U.S. Attorney General has designated Switzerland as a qualifying state</a> for purposes of implementing the redress mechanism.</li>
<li>U.S. companies may self-certify that they adhere to a defined set of privacy principles. Certified U.S. companies must ensure in particular the rights for data subjects as known from the DPA and redress options, including a free of charge independent dispute resolution mechanism and an arbitration panel. Compliance with these principles is monitored by the U.S. Department of Commerce (<strong>DoC</strong>) and enforced by the U.S. Federal Trade Commission.</li>
</ul>
<h3>When Will the Swiss-U.S. DPF Enter Into Force?</h3>
<p>The new Swiss-U.S. DPF will be effective from September 15, 2024.</p>
<h3>What Are the Consequences of the New Swiss-U.S. DPF?</h3>
<p>The Swiss-U.S. DPF will facilitate disclosures of personal data from Switzerland to the U.S.: Once effective, Swiss data exporters will be able to disclose personal data to recipients in the U.S. who participate in the Swiss-U.S. DPF without having to enter into SCC and performing a data transfer impact assessment.</p>
<p>Even for companies continuing to rely on SCC, the new Swiss-U.S. DPF will facilitate their data disclosure to the U.S. and the data transfer impact assessment, given that the limitations imposed by the U.S. EO 14086 apply irrespective of whether personal data is disclosed under the Swiss-U.S. DPF or based on a different transfer instrument, such as the SCC.</p>
<h3>Is There a List of U.S. Companies Participating in the Swiss-U.S. DPF?</h3>
<p>The DoC maintains and publishes a list of U.S. companies that have self-certified and declared to comply with the Swiss-U.S. DPF (<strong>DPF List</strong>, accessible <a href="https://www.dataprivacyframework.gov/list" target="_blank" rel="noopener">here</a>). There are exceptions as to which U.S. companies are eligible to participate in the Swiss-U.S. DPF, but Swiss data exporters can rely on the fact that companies on the list published by the DoC are certified.</p>
<h3>Is There Still a Need to Execute a Data Transfer Agreement Under the Swiss-U.S. DPF?</h3>
<p>Even when disclosing personal data under the Swiss-U.S. DPF, it is typically advisable for data exporters to enter into a suitable data transfer agreement with the data importer. This agreement should include the following, in addition to any other terms governing the relevant data disclosure in the specific circumstances:</p>
<ul>
<li>Obligation to comply with the principles of the Swiss-U.S. DPF;</li>
<li>Obligation to remain duly certified under the Swiss-U.S. DPF;</li>
<li>Obligation to notify data exporter immediately of a removal of the DPF List and the reason for such removal;</li>
<li>Mechanism to tackle the consequences of a removal from the DPF List.</li>
</ul>
<h3>What to Do with Existing SCC or Binding Corporate Rules?</h3>
<p>In principle, SCC or binding corporate rules that were concluded earlier are no longer necessary for data disclosures to a U.S. data importer who participates in the Swiss-U.S. DPF. Companies should however carefully consider whether to fully migrate their disclosures of personal data to the U.S. to the Swiss-U.S. DPF as there may be valid reasons to continue relying on the SCC or binding corporate rules:</p>
<ul>
<li>If the U.S. data importer is removed from the DPF List, the data disclosure is no longer considered to be covered by an adequate level of protection. Existing SCC or binding corporate rules could still serve as a fallback to ensure adequate protection; and</li>
<li>The validity of the EU-U.S. DPF is already being challenged through lawsuits in the EU, as its predecessors were. Should the CJEU ultimately decide to invalidate the EU-U.S. DPF, this will in all likelihood also impact the Swiss-U.S. DPF and companies relying exclusively on the Swiss-U.S. DPF may be left unprotected. Thus, maintaining existing SCC or binding corporate rules may serve as a protection should the Swiss-U.S. DPF be invalidated at some point.</li>
</ul>
<h3>What Are the Consequences of a Removal from the DPF List?</h3>
<p>U.S. companies may fall off the DPF List of participating companies if:</p>
<ul>
<li>They voluntarily withdraw from the Swiss-U.S. DPF;</li>
<li>They fail to complete their annual re-certification; or</li>
<li>They persistently fail to comply with the principles.</li>
</ul>
<p>For data disclosures that occurred <em>prior</em> to the removal of the U.S. company from the DPF List, the Swiss data exporter may argue that these disclosures were made lawfully under the adequacy decision.</p>
<p>For data disclosures that occurred <em>after</em> the removal of the U.S. company from the DPF List, the Swiss Federal Council’s adequacy decision does not apply. Instead, the parties must guarantee an adequate level of data protection by other means recognized by the law, including SCC or binding corporate rules. If no such guarantees can be put in place, the U.S. data importer should return or delete the personal data.</p>
<h3>Is the Swiss-U.S. DPF a Permanent Solution for Swiss-U.S. Data Disclosures?</h3>
<p>In principle, the Swiss-U.S. DPF is intended to be a permanent solution. However, it marks the third attempt of Swiss and U.S. authorities to facilitate transatlantic disclosure of personal data, after the CJEU struck down first the EU-U.S. Safe Harbor Framework, and then the EU-U.S. Privacy Shield (with the so-called «Schrems II» decision, see our <a href="https://www.homburger.ch/en/insights/cjeu-decision-schrems-ii-new-hurdles-data-transfers-usa" target="_blank" rel="noopener">Bulletin of July 16, 2020</a>), which in each case also ended the corresponding arrangements between Switzerland and the U.S. Given that the EU-U.S. DPF is already being challenged through lawsuits in the EU, time will tell whether the EU-U.S. DPF and the Swiss-U.S. DPF will withstand the judicial review.</p>
<p>In addition, the U.S. legislation may change. The Swiss Federal Council will constantly monitor the relevant U.S. decisions and review the adequacy decision on a regular basis. The first review will take place one year from now. If the Swiss-U.S. DPF malfunctions, the adequacy decision will be adjusted or withdrawn.</p>


RZ_Preview_Lock_SB_01

New Swiss-U.S. Data Privacy Framework

<p>On January 15, 2024, the EU Commission published its <a href="https://ec.europa.eu/commission/presscorner/detail/en/ip_24_161" target="_blank" rel="noopener">report</a> on the results of its first review of the adequacy decisions previously taken under the old EU Data Protection Directive. The EU Commission concludes that <strong>Switzerland continues to provide an adequate level of protection for personal data</strong> transferred from the EU.</p>
<p>According to its report, the EU Commission welcomes the developments in the Swiss legal framework since the adoption of the first adequacy decision in July 2000, including in particular the modernization of the Swiss Data Protection Act (cf. our <a href="https://www.homburger.ch/en/insights/revision-of-the-swiss-data-protection-law-is-complete" target="_blank" rel="noopener">Bulletin</a> of August 31, 2022). These developments have contributed to an increased level of data protection, in a manner sufficient for the EU Commission to maintain its adequacy decision.</p>
<p>Maintaining the EU adequacy decision was one of the main objectives of the revision of the Swiss Data Protection Act, which entered into force on September 1, 2023: Without the EU&#8217;s recognition of the adequacy of Swiss data protection law, the export of personal data from the EU to Switzerland would have become much more burdensome. Today&#8217;s confirmation by the EU Commission thus marks the achievement of a key goal in the efforts to modernize Swiss data protection law in a manner consistent with the EU General Data Protection Regulation (GDPR).</p>
<p>The review of adequacy decisions by the EU Commission, which has now been completed, is the first such review since the GDPR came into force in 2018. The GDPR calls for regular reviews, and the EU underlines its intention to further intensify dialogue and cooperation with like-minded international partners on data flows and digital issues in general.</p>


EU Confirms Adequacy of Swiss Data Protection Law

<h3>Here is what companies need to know now about the EU Commission&#8217;s adequacy decision and its impact on Switzerland:</h3>
<h3>1. What did the European Commission decide on July 10, 2023?</h3>
<p>In its adequacy decision of July 10, 2023, the European Commission decided that the EU-U.S. DPF provides for an adequate level of data protection when private companies or public authorities in the EU and the EEA disclose personal data to U.S. companies that participate in the EU-U.S. DPF. This will contribute significantly to facilitating the disclosure of personal data from the EU and the EEA to data importers in the United States, provided that they participate in the EU-U.S. DPF.</p>
<p>The approval of the EU-U.S. DPF marks the third attempt of EU and U.S. authorities to facilitate transatlantic disclosure of personal data, after the Court of Justice of the European Union (<strong>CJEU</strong>) struck down first the EU-U.S. Safe Harbor Framework, and then the EU-U.S. Privacy Shield (the so-called «Schrems II» decision, cf. our <a href="https://www.homburger.ch/en/insights/cjeu-decision-schrems-ii-new-hurdles-data-transfers-usa">Bulletin of July 16, 2020</a>)</p>
<p>Under the EU-U.S. DPF, certain U.S. companies may self-certify that they adhere to a defined set of privacy principles issued by the U.S. Department of Commerce, with the aim of committing to an adequate level of data protection in relation to their processing of personal data received from data exporters in the EU and the EEA. In addition, the EU-U.S. DPF relies on the terms of the <a href="https://www.federalregister.gov/documents/2022/10/14/2022-22531/enhancing-safeguards-for-united-states-signals-intelligence-activities">U.S. Executive Order 14086</a> executed by President Biden on October 7, 2022 (<strong>EO 14086</strong>). This EO 14086 establishes certain safeguards for U.S. signals intelligence activities, aiming to align these with fundamental principles of European law, including proportionality, oversight, and effective redress for affected data subjects. In order to benefit from that redress mechanism, a complaint must be submitted through a qualifying state. To date, the U.S. Attorney General has <a href="https://www.justice.gov/d9/2023-07/Attorney%20General%20Designation%20Pursuant%20to%20Section%203%28f%29%20of%20Executive%20Order%2014086%20of%20the%20EU%20EEA.pdf">designated</a> the EU and EEA member states as such qualifying states, but not yet Switzerland.</p>
<h3>2. What are the consequences of this decision for data exports to the United States?</h3>
<p>As the EU Commission considers that the protection under the privacy principles of the EU-U.S. DPF is adequate, data exporters may transfer personal data under the GDPR from the EU and the EEA to U.S. companies certified under the EU-U.S. DPF without further safeguards and without having to conduct a transfer impact assessment.</p>
<p>Companies should however carefully consider whether to fully migrate their disclosures of personal data to the United States to the EU-U.S. DPF: Even where companies continue to rely on EU SCC, the adequacy decision will simplify the transfer impact assessment in practice (see section 3 below) and there may be valid reasons to continue to rely on the EU SCC or binding corporate rules. Thus, a case-by-case decision is required. In this respect it is to be considered that the EU-U.S. DPF will in all likelihood be challenged in court, as its predecessors (see section 1 above). Should the CJEU decide to invalidate even the third attempt to build a framework for transatlantic data disclosures, companies relying exclusively on the EU-U.S. DPF may be left unprotected.</p>
<h3>3. Can Swiss companies benefit from the EU-U.S. DPF?</h3>
<p>To date, Swiss companies only benefit to a limited extent from the EU-U.S. DPF:</p>
<ul>
<li>The EU-U.S. DPF and the EU adequacy decision do not cover data exporters in Switzerland that disclose personal data to self-certified companies in the United States. The EU adequacy decision only applies to data exporters in the EU and the EEA that disclose personal data to organization in the United States.</li>
<li>The new Swiss DPA requires an adequacy decision from the Swiss Federal Council, published in an annex to the new Data Protection Ordinance. Until the Federal Council adds the United States to this list, the United States continues to be viewed as country without adequate protection under the DPA. Thus, data exporters in Switzerland who wish to lawfully disclose personal data to recipients in the United States will still need to either rely on statutory exemptions, or implement alternative safeguards to ensure an adequate level of data protection, e.g., by way of the EU SCC, which require a transfer impact assessment to be conducted (cf. our <a href="https://www.homburger.ch/en/insights/switzerland-recognizes-new-eu-standard-contractual-clauses">Bulletin of August 30, 2021</a>).</li>
<li>For Swiss companies, however, performing the transfer impact assessment for disclosing personal data to recipients in the United States based on the EU SCC has become easier with the adoption of the EU Commission&#8217;s adequacy decision: The limitations on signals intelligence provided by EO 14086 (e.g., that signals intelligence activities must be proportionate to validated intelligence priorities) are not limited to data disclosed by data exporters in the EU and the EEA, so that also data disclosed by Swiss data exporters benefits from the limitations provided by EO 14086. Hence, U.S. authorities would have to adhere to the relevant safeguards, even in respect of Swiss personal data. With the EU commission having in principle acknowledged the adequacy of these safeguards, there is no reason why that should be viewed differently from a Swiss perspective. Thus, for the purpose of performing a transfer impact assessment, Swiss companies may argue that U.S. signals intelligence activities are reasonably limited in a manner also acceptable from the perspective of Swiss law.</li>
<li>For the time being, however, Swiss data subjects are excluded from the redress mechanism provided for by EO 14086: This mechanism only applies to complaints logged in a qualifying state, the list of which states does not yet include Switzerland. This will have to be considered as a risk factor in performing the transfer impact assessment until Switzerland is acknowledged as a qualifying state by the U.S. Attorney General.</li>
<li>To that end, the Swiss Federal Data Protection and Information Commissioner (<strong>FDPIC</strong>) has already confirmed that Switzerland is engaged in discussions regarding a «Swiss-U.S. Data Privacy Framework» and that the discussions about such framework are well advanced. Until the adoption of a «Swiss-U.S. Data Privacy Framework», however, the list of countries with adequate protection will stay the same. Thus, Swiss companies must remain patient for the time being until the Federal Council decides to add the United States to the list of countries with adequate protection.</li>
</ul>
<h3>4. What do Swiss companies need to consider until a Swiss-U.S. Data Privacy Framework is adopted?</h3>
<p>For the time being, Swiss companies must continue to regard the United States as country without adequate data protection laws. Thus, disclosure of personal data to the United States continues to be permissible only if either an adequate level of data protection is guaranteed through appropriate contractual safeguards, or an exception provided for by the DPA applies. However, conducting the transfer impact assessment becomes easier with respect to the assessment of local surveillance legislation (see section 3 above). If a U.S. company is certified under the EU-U.S. DPF, this can be considered as an additional layer of protection.</p>
<p>When delegating processing activities to data processors in the United States, Swiss companies may consider doing so through a data processor in the EU or the EEA. Data transfers from Switzerland to data processors in the EU and the EEA are permitted without additional safeguards. The onward-transfer from the EU or EEA processor to the U.S. sub-processor may benefit from the EU Commission&#8217;s adequacy decision if the sub-processor in the United States is certified under the EU-U.S. DPF. In practice, it is already common for service providers in the United States to conduct their business with European customers through affiliates in the EU or the EEA.</p>
<h3>5. When will the EU-U.S. DPF enter in force?</h3>
<p>The EU-U.S. DPF is in force now – the adequacy decision relating to the EU-U.S. DPF entered into force immediately with its adoption on July 10, 2023.</p>
<h3>6. What is new?</h3>
<p>The EU-U.S. DPF provides for limitations and safeguards applicable to personal data transferred to the United States from a data exporter in the EU and the EEA under the GDPR:</p>
<ul>
<li>Several rights for data subjects, e.g., to obtain access to their data, to obtain correction or deletion of incorrect or unlawfully handled data.</li>
<li>A set of redress avenues in case personal data is processed against the EU-U.S. DPF principles, including a free of charge independent dispute resolution mechanism and an arbitration panel.</li>
<li>The U.S. Department of Commerce will process applications for certification, and monitor whether participating companies continue to meet certification requirements.</li>
<li>Compliance by U.S. companies will be enforced by the U.S. Federal Trade Commission.</li>
</ul>
<p>The EO 14086 provides for limitations and safeguards with respect to U.S. intelligence agencies:</p>
<ul>
<li>Binding safeguards that limit access to data by U.S. intelligence authorities to what is necessary and proportionate to protect national security.</li>
<li>Enhanced oversight of activities by U.S. intelligence services to ensure compliance with limitations on surveillance activities.</li>
<li>Establishment of an independent and impartial redress mechanism, including a new Data Protection Review Court to investigate and resolve complaints.</li>
</ul>
<h3>7. What if U.S. law changes?</h3>
<p>The EU Commission has announced that it will continuously monitor the relevant U.S. decisions, and regularly review the adequacy decision to verify that all relevant elements of the new framework are working effectively in practice. The first review is scheduled to take place after one year, i.e., in July 2024.</p>
<p>In the event of developments affecting the level of protection under the EU-U.S. DPF, the adequacy decision may be adjusted or even withdrawn.</p>
<h3>8. Which U.S. companies may participate in the EU-U.S. DPF?</h3>
<p>To be eligible for certification under the EU-U.S. DPF, a U.S. company must be subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission, the U.S. Department of Transportation, or another statutory body that will effectively ensure compliance with the principles (cf. section 2.1.1 and Annex I, section I. 2. of the European Commission&#8217;s adequacy decision). Thus, there may be certain exceptions regarding which U.S. companies may participate in the EU-U.S. DPF.</p>
<h3>9. How can data exporters check whether the envisaged data importer is duly certified under the EU-U.S. DPF?</h3>
<p>The U.S. Department of Commerce will maintain and publish a list of U.S. companies that have self-certified to the U.S. Department of Commerce and declared their commitment to adhere to the principles of the EU-U.S. DPF (the <strong>Data Privacy Framework List</strong>). Only companies on the Data Privacy Framework List may benefit from the EU Commission&#8217;s adequacy decision. Thanks to the list, however, data exporters do not have to check themselves whether a U.S. company is eligible to participate in the EU-U.S. DPF.</p>
<p>The U.S. Department of Commerce will remove companies from the Data Privacy Framework List that voluntarily withdraw from the EU-U.S. DPF, fail to complete their annual re-certification, or persistently fail to comply with the principles.</p>
<h3>10. What are the consequences of a removal from the Data Privacy Framework List?</h3>
<p>If a company is removed from the Data Privacy Framework List, it may no longer benefit from the EU Commission&#8217;s adequacy decision regarding the EU-U.S. DPF. Thus, European data exporters may no longer transfer personal data to these U.S. companies without additional safeguards guaranteeing adequate protection under the GDPR. As the Data Privacy Framework List is an authoritative list, it can be assumed that European data exporters can generally rely on it and argue that all previous data exports to the U.S. company before its removal were made lawfully under the adequacy decision.</p>
<p>The further consequences regarding the personal data already received under the EU-U.S. DPF, depend on the reason for the removal of the U.S. company from the Data Privacy Framework List:</p>
<ul>
<li>U.S. companies that voluntarily withdraw from the EU-U.S. DPF, or that fail to complete their annual re-certification may choose to either (i) continue to apply the principles of the EU-U.S. DPF to the personal data they received under the EU-U.S. DPF and affirm to the U.S. Department of Commerce their commitment to do so on an annual basis, for as long as they retain such data, (ii) provide adequate protection for the data by other means, e.g., by using the EU SCC, or (iii) return or delete the data.</li>
<li>Companies that were removed from the Data Privacy Framework List due to their persistent failure to comply with the principles of the EU-U.S. DPF must return or delete the personal data they received under the EU-U.S. DPF.</li>
</ul>
<h3>11. What should data exporters consider when transferring personal data to U.S. companies participating in the EU-U.S. DPF?</h3>
<p>Data exporters should include the following in the data transfer agreement with the U.S. data importer, in addition to any other terms governing the relevant data transfer in the specific circumstances:</p>
<ul>
<li>Obligation to comply with the principles of the EU-U.S. DPF;</li>
<li>Obligation to remain duly certified under the EU-U.S. DPF;</li>
<li>Obligation to notify data exporter immediately of a removal of the Data Privacy Framework List and the reason for such removal;</li>
<li>Mechanism to tackle the consequences of a removal from the Data Privacy Framework List.</li>
</ul>
<h3>12. Is the EU-U.S. DPF here to stay?</h3>
<p>NOYB, the non-profit organization launched by Max Schrems, announced that it is prepared to challenge the EU Commission&#8217;s adequacy decision with the CJEU. <a href="https://noyb.eu/en/european-commission-gives-eu-us-data-transfers-third-round-cjeu">NOYB criticizes</a>, alleging, in particular, that the fundamental problems with respect to mass surveillance by U.S. intelligence under FISA 702 were not solved, and that the EU-U.S. DPF is <em>«largely a copy of the failed &#8216;Privacy Shield&#8217;»</em>.</p>
<p>Thus, time will tell whether the EU-U.S. DPF will withstand the review by the CJEU that will inevitably follow.</p>


Homburger Bulletin

Are Data Transfers to the United States Safe Again?

Corporate / M&A

Employment and Executive Compensation

IP / IT

Competition

Regulatory

Cadence-webnews

Homburger News

Candence Design Systems Inc. aquires BETA CAE Systems

Homburger advises Cadence on its  USD 1.24 bn acquisition of BETA CAE Systems

<p>On March 5, 2024, Cadence Design Systems Inc. (Nasdaq: CDNS), a leading global EDA and Intelligent System Design provider, announced that it has signed a definitive agreement to acquire BETA CAE Systems International AG, a leading provider of multi-domain, engineering simulation solutions headquartered in Switzerland.</p>
<p>Under the terms of the definitive agreement, Cadence will pay approximately USD 1.24 bn for the transaction, with 60 percent of the consideration to be paid in cash and 40 percent to be paid through the issuance of Cadence common stock to current BETA CAE shareholders. The transaction, which is subject to customary conditions, is expected to close in the second quarter of this year.</p>
<p>Homburger advises Cadence Design Systems Inc. on the Swiss aspects of the transaction. The Homburger team is led by Daniel Hasler and includes Léonard Aeschlimann, Bianca Nedwed, Daniel Bötticher, Paula Delissen and Luc Huber (all Corporate / M&amp;A), Gregor Bühler and Kimberly Amrein (both Employment and Executive Compensation), Kirsten Wesiak-Schmidt and Marc Wang (both IP / IT), Jonas Krull (Competition, Regulatory), as well as Peter Müller (Tax).</p>


Homburger advises Cadence on its USD 1.24 bn acquisition of BETA CAE Systems

Data Protection

HIG Capital

<p>On November 3, 2022, H.I.G. Capital, a leading global investment firm with USD 52 bn of equity capital under management, announced that one of its affiliates has completed the acquisition of Celerion Holdings Inc., a leading full-service provider of outsourced clinical research services to the pharmaceutical industry.</p>
<p>The Homburger team comprised partner Andreas Müller, lead associate Sarah Chevalley, associate Oliver Kneubühl and junior associate Michele Fazari (all Corporate / M&amp;A), associates Joel Fink (IP / IT) and Kirsten Wesiak-Schmidt (Data Protection).</p>


Homburger advised H.I.G. Capital on its acquisition of Celerion

Technology and Digital Economy

Insurance

Capital Markets

wefox

<p>On July 12, 2022, the Berlin-based insurtech wefox Holding AG announced that it has successfully reached an agreement for its Series D funding round, increasing its post-money valuation to USD 4.5 bn. The equity round was led by Mubadala Investment Company with participation from Eurazeo, LGT, Horizons Ventures, OMERS Ventures and Target Global.</p>
<p>wefox is a fully licensed digital insurance company that sells insurance through intermediaries and not directly to customers. wefox intends to use the funding for product development and to further expand across Europe and thereafter Asia and the US.</p>
<p>Homburger AG advises wefox Holding AG as Swiss counsel in this Series D funding round. The Homburger team comprises partner Andreas Müller (Corporate / M&amp;A; Technology and Digital Economy), lead associate Kevin M. Hubacher (Corporate / M&amp;A; Insurance), associates Oriana Schöni (Corporate / M&amp;A; Technology and Digital Economy) and Oliver Kneubühl (Corporate / M&amp;A), and junior associates Alexander Cochardt, Nicolas Wetzel and Michele Fazari (all Corporate / M&amp;A), counsel Eduard De Zordi (Capital Markets), partner Stefan Oesterhelt and associate Laetitia Fracheboud (both Tax), partner Balz Gross and associate Anissa Kern (both Employment and Executive Compensation), and associate Kirsten Wesiak-Schmidt (Data Protection).</p>


Kirsten
Wesiak-Schmidt

Homburger advises Cadence on its USD 1.24 bn acquisition of BETA CAE Systems

Homburger advised H.I.G. Capital on its acquisition of Celerion

Homburger advises wefox in its Series D funding round resulting in a post-money valuation of USD 4.5 bn

New Swiss-U.S. Data Privacy Framework

EU Confirms Adequacy of Swiss Data Protection Law

Are Data Transfers to the United States Safe Again?

§8 Datenschutz bei Marketingaktivitäten

§5 Rechtsdurchsetzung durch den Eidgenössischen Datenschutz- und Öffentlichkeitsbeauftragten

§2 Unternehmensübergreifende Zusammenarbeit und Bekanntgabe von Personendaten ins Ausland

Join the Team

Kirsten Wesiak-Schmidt

Career

Languages

Bar Registration

Teams

KirstenWesiak-Schmidt

Homburger advises Cadence on its USD 1.24 bn acquisition of BETA CAE Systems

Homburger advised H.I.G. Capital on its acquisition of Celerion

Homburger advises wefox in its Series D funding round resulting in a post-money valuation of USD 4.5 bn

New Swiss-U.S. Data Privacy Framework

EU Confirms Adequacy of Swiss Data Protection Law

Are Data Transfers to the United States Safe Again?

§8 Datenschutz bei Marketingaktivitäten

§5 Rechtsdurchsetzung durch den Eidgenössischen Datenschutz- und Öffentlichkeitsbeauftragten

§2 Unternehmensübergreifende Zusammenarbeit und Bekanntgabe von Personendaten ins Ausland

Join the Team

Kirsten Wesiak-Schmidt

Career

Languages

Bar Registration

Teams

Kirsten
Wesiak-Schmidt