<h3>New DPA enters into force on September 1, 2023</h3>
<h4><strong><em>What did the Federal Council decide today?</em></strong></h4>
<p>While Parliament had approved the new Swiss Data Protection Act (<strong>DPA</strong>) already in September 2020 (see our <a href="https://www.homburger.ch/en/insights/swiss-parliament-approves-revision-of-the-swiss-federal-act-data-protection">Bulletin of September 25, 2020</a> and the text of the DPA available <a href="https://cms.homburger.ch/wp-content/uploads/2021/01/Swiss-Data-Protection-Act-of-September-25-2020_02_682151_1.pdf" target="_blank" rel="noopener">here</a>), the revision of the Data Protection Ordinance (<strong>DPO</strong>) continued until today. On August 31, 2022, the Federal Council now adopted the new DPO (available <a href="https://www.bj.admin.ch/dam/bj/de/data/staat/gesetzgebung/datenschutzstaerkung/vdsg/vo.pdf.download.pdf/vo-d.pdf" target="_blank" rel="noopener">here</a>)<a href="#_ftn1" name="_ftnref1">[1]</a> and decided that the new DPA and the new DPO shall enter into force on September 1, 2023. At the same time, the Federal Council also adopted the new Ordinance on Data Protection Certifications. With this, the legislative work on the revision of the Swiss data protection law is complete.</p>
<h4><strong><em>What is the impact of today&#8217;s decisions of the Federal Council?</em></strong></h4>
<p>With today&#8217;s decisions by the Federal Council, it is clear which implementing provisions must be taken into account in addition to the DPA and when the revision will enter into force. Companies are now required to take the necessary steps to ensure compliance with the requirements of the new DPA and the DPO by September 1, 2023.</p>
<h4><strong><em>What are the most important regulations of the Data Protection Ordinance?</em></strong></h4>
<p>The following provisions of the DPO are to be highlighted for companies:</p>
<ul>
<li>In the area of <strong>data security</strong>, the DPO specifies the principle of the adequacy of data security in that the <strong>need to protect </strong>personal data and the <strong>risks </strong>to the personality and fundamental rights of the data subject must be assessed on the basis of the criteria set out in the DPO. In addition, the DPO defines the <strong>protection goals </strong>and certain <strong>technical and organizational measures </strong>that should allow these goals to be achieved.</li>
<li>The obligation to <strong>log </strong>certain data processing activities, which was heavily criticized in the consultation, remains in place despite calls to the contrary. Although the obligation has been restricted compared to the draft released for consultation a year ago, the requirement has not become any clearer. Private data controllers and data processors who <strong>process sensitive personal data on a large scale by automated means </strong>or who carry out <strong>high-risk profiling </strong>must now log the storage, modification, reading, disclosure, deletion and destruction of the data if the preventive measures taken are not sufficient to guarantee data protection. The log must be kept for at least one year, separately from the system in which the personal data is stored. The scope of this requirement, which is far-reaching for both data controllers and data processors, remains unclear. In particular, it will have to be clarified when sensitive personal data is processed «on a large scale» and when «preventive measures do not guarantee data protection». In the explanatory report, the Federal Office of Justice takes the position – surprisingly and without reasoning – that the latter is only rarely the case. This is not convincing, since ensuring data protection is a fundamental premise for all data processing activities.</li>
<li>Furthermore, the DPA provides for an obligation of private data controllers and data processors to issue and regularly update <strong>regulations for automated data processing </strong>if they process particularly sensitive personal data on a large scale by automated means or carry out high-risk profiling.</li>
<li>For data processing through processors, the clarification that the <strong>authorization of subcontractors </strong>can be granted both specifically (i.e. in relation to a specific subcontractor) and generally is welcome. In the latter case, the DPA requires information about intended changes and a right of objection in favor of the controller.</li>
<li>The DPA then specifies further obligations of the controller, in particular the <strong>modalities of the duty to inform</strong> data subjects, the duration of the <strong>retention of the data protection impact assessment</strong>, as well as the requirements for the <strong>notification of data breaches </strong>to the FDPIC. Furthermore, certain <strong>modalities of the data subject&#8217;s right to information as </strong>well as the <strong>right to data surrender and transfer </strong>are regulated.</li>
<li>Finally, the DPA states that the obligation to keep a <strong>processing record </strong>does not apply to companies that employ fewer than 250 people on January 1 of any given year (whereby the level of employment should not play a role) and that neither process particularly sensitive personal data on a large scale nor carry out high-risk profiling.</li>
</ul>
<h4><strong><em>Which countries does the Federal Council acknowledge to have an adequate level of data protection?</em></strong></h4>
<p>Annex 1 of the DPO lists those countries which have appropriate data protection legislation. In principle, the disclosure of personal data to these countries is permitted. In particular, the list includes all member states of the EU and the EEA and the United Kingdom, as well as Canada in certain areas. Furthermore, the list includes: Andorra, Argentina, Faroe Islands, Gibraltar, Guernsey, Iceland, Isle of Man, Israel, Jersey, Monaco, New Zealand and Uruguay.</p>
<p>Disclosures of personal data to other countries – including in particular to the USA – require either the application of a specific exemption set forth in the DPA or the implementation of alternative protective measures to ensure adequate data protection.</p>
<h4><strong><em>Why is there a need for the Data Protection Ordinance in addition to the DPA?</em></strong></h4>
<p>The DPA empowers the Federal Council to issue certain implementing regulations, which is why the Federal Council adopts the DPO.</p>
<h4><strong><em>Has the new Data Protection Ordinance been toned down from the June 2021 draft?</em></strong></h4>
<p>The draft of the new DPO published in June 2021 was sharply criticized in the public consultation process. This is because the draft contained numerous provisions that would have had a significant impact on the companies subject to the DPA, and which, in terms of content, went far beyond mere implementing provisions. Fortunately, the Federal Council has at least taken partial account of the criticism from the consultation. The final DPO that is now available has been toned down compared to the draft. For example, the Federal Council has considerably streamlined the regulation of the modalities of the duty to inform as well as the requirements for the role of the data protection advisor compared to the draft and has also waived certain written form requirements. However, the final DPO still appears to be excessive in the area of data security requirements, where in particular the implementation of the obligation to log certain data processing appears to be challenging.</p>
<h4><strong><em>What measures are to be undertaken in view of the entry into force of the new DPA?</em></strong></h4>
<p>Projects for implementation of the new DPA in companies should now be tackled promptly so that companies are DPA-compliant on September 1, 2023. For many companies, it will be particularly necessary to review internal processes and documentation (such as data protection declarations, processing records, data protection impact assessments, contracts regarding the processing of personal data, etc.) and, if necessary, update them or introduce new ones. A short checklist giving an overview on implementation work is available for download <a href="https://cms.homburger.ch/wp-content/uploads/2022/08/Summary-Checklist-Implementation-of-the-New-Swiss-Data-Protection-Act-2022-08-3113880971.2.pdf">here</a>.</p>
<h6><a href="#_ftnref1" name="_ftn1">[1]</a>        An English translation is not yet available.</h6>


RZ_Preview_Ritter_Data Protection_SS_02

Revision of the Swiss Data Protection Law is Complete

<p>By way of a note published on its <a href="https://www.bj.admin.ch/bj/de/home/staat/gesetzgebung/datenschutzstaerkung.html" target="_blank" rel="noopener">website</a>, the Swiss Federal Office of Justice (<strong>FOJ</strong>) has just informed that the new Swiss Data Protection Act (<strong>DPA</strong>) is scheduled to enter into force on September 1, 2023. While the FOJ is cautious to caveat that the final date has yet to be confirmed and decided by the Swiss Federal Council, many companies will be relieved to hear that they will have more time than previously anticipated in order to prepare for the advent of the new DPA. This is even more important considering that the new DPA will not provide for a general transition period, so that companies will have to complete their implementation activities by the time the new DPA enters into force.</p>
<p>Previously, it was anticipated that the new DPA would enter into force already at the beginning of 2023. With the new ordinance on the DPA still not being in final form, this timing would have been tight.</p>
<p>You may find further information on the new DPA in our <a href="https://www.homburger.ch/en/insights/swiss-parliament-approves-revision-of-the-swiss-federal-act-data-protection">Bulletin of September 25, 2020</a> and the text of the new DPA, including an English translation in our <a href="https://cms.homburger.ch/wp-content/uploads/2021/01/Swiss-Data-Protection-Act-of-September-25-2020_02_682151_1.pdf">printable booklet</a>.</p>


New Swiss Data Protection Act Enters Into Force in September 2023

<p>On August 27, 2021, the Swiss Federal Data Protection and Information Commissioner (<strong>FDPIC</strong>) <a href="https://www.edoeb.admin.ch/edoeb/en/home/latest-news/aktuell_news.html#-1259254222" target="_blank" rel="noopener">informed</a> that it recognizes the <a href="https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?uri=CELEX:32021D0914&amp;locale=de" target="_blank" rel="noopener">new EU standard contractual clauses</a> published by the European Commission on June 4, 2021 as standard clauses under the Swiss Data Protection Act (<strong>DPA</strong>). Hence, companies exporting personal data from Switzerland may use the new SCC for their data exports from Switzerland. In the following, we summarize the key takeaways resulting from the FDPIC&#8217;s decision.</p>
<h4>What follows from the FDPIC&#8217;s acknowledgment of August 27, 2021?</h4>
<p>The FDPIC recognized the new SCC as standard clauses acceptable for data exports from Switzerland. This means that Swiss companies may in principle use the new SCC as basis for exports of personal data from Switzerland to third countries without adequate data protection laws. As a result of this acknowledgment, companies relying on the new SCC are exempt from the requirement to notify the FDPIC of the use of the new SCC for each transfer; instead, it will be sufficient for them to inform the FDPIC in a general manner that they rely on the new SCC when exporting personal data to third countries.</p>
<h4>Is the transition to the new SCC mandatory for Swiss companies?</h4>
<p>The new SCC, as well as the old SCC, are just one of several means to provide for sufficient safeguards when exporting personal data from Switzerland to third countries without adequate data protection laws. Hence, using the SCC is not mandatory per se. However, using alternative contractual safeguards requires a case-by-case notification to and examination by the FDPIC, which makes their use and administration burdensome. Thus, from a practical standpoint, using the new SCC will often be the only feasible basis for exports of personal data to third countries where no exception provided for in the DPA to justify the export without contractual safeguards applies.</p>
<p>Moreover, it is to be expected that the FDPIC will not accept the continued use of the old SCC as alternative contractual safeguards for exports of personal data to third countries. Thus, even if the transition to the new SCC is not as such mandatory, the old SCC will no longer be regarded as sufficient by the FDPIC. Hence, action will be required in any case where existing agreements that rely on the old SCC shall continue beyond the end of 2022 (cf. below re timeline).</p>
<h4>What is the timeline to implement the new SCC?</h4>
<p>The FDPIC&#8217;s acknowledgment comes right in time, as many companies are amidst the transition to the new SCC, which become binding in the EU as from September 27, 2021. Swiss companies will be relieved to hear that the Swiss timeline is largely aligned with the one applicable in the EU, simplifying the coordination of the transition activities in the EU and in Switzerland:</p>
<ul>
<li>As from September 27, 2021, the old SCC will no longer be acknowledged by the FDPIC as standard clauses providing for sufficient safeguards for data exports to third countries from Switzerland. Accordingly, as from that date, new or amended agreements governing exports of personal data from Switzerland to third countries should no longer rely on the old SCC as basis to provide adequate data protection safeguards. The same applies with respect to other standard contractual safeguards previously acknowledged by the FDPIC – namely the Swiss Transborder Data Flow Agreement (for outsourcing of data processing) as well as the template agreement of the European Council – which were however not frequently used in practice.</li>
<li>There will be a transition period until the end of 2022 for existing agreements based on the old SCC, provided that the relevant processing activities they govern and the agreements as such remain substantially unchanged: Companies may continue to rely on such existing agreements until December 31, 2022. As from January 1, 2023, these agreements will have to be updated to incorporate the new SCC or, as the case may be, other acceptable safeguards.</li>
</ul>
<h4>Do the new SCC need to be adapted for use in Switzerland?</h4>
<p>According to the FDPIC, the SCC require only minor clarifications to account for the DPA. In particular, the FDPIC asks for clarifications to be added (1) that references to EU member states in the SCC shall not be interpreted in such a way that data subjects in Switzerland are excluded from exercising their rights at their habitual residence in Switzerland,<a href="#_ftn1" name="_ftnref1">[1]</a> and (2) that the SCC also protect data pertaining to legal entities as long as the current Swiss DPA remains in force.<a href="#_ftn2" name="_ftnref2">[2]</a> In addition, companies need to clarify (3) that the FDPIC is the competent authority for the purposes of the DPA.</p>
<p>These clarifications may be included in an addendum to the SCC that applies insofar as the DPA is concerned. This way, the addition would not conflict with the general rule stipulated in the SCC that the SCC as such must not be amended in order to constitute a valid basis for transfers under the GDPR.</p>
<p>Beyond that, the FDPIC acknowledges in principle that the new SCC can be used unchanged for data transfers that are governed by the DPA and the GDPR at the same time. This will facilitate implementation work for Swiss companies.</p>
<h4>Can we simply replace references to the old SCC in existing agreements to references to the new SCC?</h4>
<p>The transition to the new SCC requires more complex adjustments to existing agreements than just this. This is because the new SCC are substantially different from the old SCC in terms of content and structure, so that they cannot simply be replaced in agreements by way of an addendum replacing references to the old SCC by such to the new SCC.</p>
<p><em>First,</em> the new SCC implement a modular approach and replace all three previous sets of SCC (i.e., the two different sets of SCC for controller-to-controller transfers and the third set for controller-to-processor transfers). When implementing the new SCC, the parties will have to agree on which module(s) apply to the relevant data export. Specifically, the new SCC include four modules governing different types of transfers, as follows:</p>
<ul>
<li>Module 1: controller-to-controller transfers;</li>
<li>Module 2: controller-to-processor (and potential sub-processors) transfers;</li>
<li>Module 3: processor-to-processor (and potential sub-processors) transfers; and</li>
<li>Module 4: processor-to-controller transfers.</li>
</ul>
<p><em>Second,</em> the new SCC include additional rules and govern further topics than the old SCC that need to be considered when adjusting existing agreements. In particular, modules 2 and 3 governing transfers to processors include processor terms, which may conflict with existing agreements. Further, the new SCC implement the requirement to perform a transfer impact assessment to help companies deal with the requirements resulting from last year&#8217;s <em>Schrems II</em> decision of the CJEU (cf. below and our <a href="https://www.homburger.ch/en/insights/cjeu-decision-schrems-ii-new-hurdles-data-transfers-usa" target="_blank" rel="noopener">Bulletin of July 16, 2020</a>). Moreover, the new SCC include provisions governing liability and certain representations to be made by the parties. All this means that existing agreements will often have to be reviewed one-by-one to assess the potential impact of the transition to the new SCC and to identify the specific adjustments needed.</p>
<p><em>Third,</em> the new SCC will require additional information in their annexes, such as on the competent supervisory authority, on safeguards implemented when transferring sensitive personal data, and on the frequency of the transfer. For transfers to processors, they require the specification of the subject matter, the nature and the duration of the processing. In addition, the new SCC require a broader, more detailed and specific description of the technical and organizational measures to ensure data security than this was the case under the old SCC.</p>
<h4>Do we need to perform a Swiss law transfer impact assessment when using the new SCC?</h4>
<p>In its <em>Schrems II</em> decision, the CJEU held that the use of the SCC as a contractual basis to secure exports of personal data to third countries requires a case-by-case assessment, in particular with regard to data access rights of authorities in the country of destination (see our <a href="https://www.homburger.ch/en/insights/cjeu-decision-schrems-ii-new-hurdles-data-transfers-usa" target="_blank" rel="noopener">Bulletin of July 16, 2020</a>). As a result, the new SCC now also require the data exporter and the data importer to undertake and document a so-called transfer impact assessment (<strong>TIA</strong>). Further, the new SCC require the parties to warrant that they have no reasons to believe that the laws and practices in place in the country of destination prevents the data importer from complying with its obligations under the SCC, and they impose an obligation on the data importer to notify the data exporter in case of access requests by authorities. Failure to comply with these obligations, may result in liability.</p>
<p>However, it is important to note that the new SCC as such do not overcome the structural issue identified by the CJEU in the <em>Schrems II </em>decision, i.e., that mandatory surveillance and government access laws may overrule the contractual obligations under the SCC. Thus, if the TIA identifies risks that are not mitigated by the SCC, additional safeguards are required in order for the data export to go forward.</p>
<p>From a Swiss law perspective, the FDPIC also requests a TIA to be performed. The basis for this is each data exporter&#8217;s obligation to ensure that contractual safeguards provide adequate protection for the personality of the data subjects. According to its <a href="https://www.edoeb.admin.ch/dam/edoeb/en/dokumente/2021/Anleitung%20f%C3%BCr%20die%20Pr%C3%BCfung%20von%20Daten%C3%BCbermittlungen%20mit%20Auslandbezug%20EN.pdf.download.pdf/Anleitung%20f%C3%BCr%20die%20Pr%C3%BCfung%20von%20Daten%C3%BCbermittlungen%20mit%20Auslandbezug%20EN.pdf" target="_blank" rel="noopener">guidance on TIAs</a> released by the FDPIC earlier this year, companies performing a TIA need to consider (1) the specifics of the contemplated data transfer, in particular in terms of categories of personal data, data subjects, purpose of the transfer, processors and sub-processors involved (if any), and (2) the compliance of the third country&#8217;s surveillance and lawful access rights with the four essential guarantees of lawful basis, necessity and proportionality, effective legal remedies, and access to an independent and impartial court in relation to the contemplated data export. If the essential guarantees are complied with in the country of destination, the data exporter may in principle export the personal data based on the SCC. Otherwise, in addition to agreeing on the SCC, additional technical and organizational measures need to be implemented in order to ensure an adequate data protection level. In practice, it is to be expected that the Swiss law TIA will largely follow the one required by the SCC and EU data protection authorities, even though uncertainties as to regulatory practice continue to this date.</p>
<h4>Do we need to inform the FDPIC about the transition to the new SCC?</h4>
<p>Unlike the GDPR, the current Swiss DPA still requires companies to inform the FDPIC about their use of the SCC. While the use of non-standard contractual safeguards requires a case-by-case notification to and examination by the FDPIC, for the SCC, a general, one-time notification to the FDPIC is sufficient to cover all further uses of the SCC. This notification requirement for approved standard clauses will be abolished when the new DPA will enter into force. For the time being, however, it continues to apply.</p>
<p>In its August 27, 2021 communication, the FDPIC does not address the question of whether companies who have previously informed the FDPIC about their use of the old SCC need to renew this notification as they transition to the new SCC. Even though that the practical risk of fines imposed in case companies fail to notify the FDPIC of the transition from the old to the new SCC appears to be limited,<a href="#_ftn3" name="_ftnref3">[3]</a> it is advisable to inform the FDPIC of the use of the new SCC to avoid such risk.</p>
<h4>Is there any update as to when the new Swiss DPA enters into force?</h4>
<p>Interestingly, the FDPIC&#8217;s communication of August 27, 2021 also provides an update on the timeline for the new Swiss DPA to enter into force: While many expected this to be in the second half of 2022, the FDPIC indicates that the new Swiss DPA will enter into force only on January 1, 2023.</p>
<p>It is to be noted, however, that this view of the FDPIC is not binding upon the Federal Council who will decide when the new DPA enters into force. Thus, in theory at least, it is still possible that the new DPA enters into force still in 2022.</p>
<h6><a href="#_ftnref1" name="_ftn1">[1]</a>        See in particular clause 18(c) of the SCC, which refers to the right of the data subject to bring legal proceedings against the data export and/or data importer before the courts of the &#8220;Member States&#8221; in which the data subject has his/her habitual residence. The FDPIC does not want this to be interpreted as limiting the rights of data subjects with their habitual residence in Switzerland.</h6>
<h6><a href="#_ftnref2" name="_ftn2">[2]</a>        The current DPA still protects data pertaining to legal entities as personal data. Under the new DPA, data pertaining to legal entities will no longer constitute personal data.</h6>
<h6><a href="#_ftnref3" name="_ftn3">[3]</a>        According to article 34(2)(a) DPA, the failure to inform the FDPIC about the contractual safeguards relied upon when exporting personal data to third countries is a criminal offence that may result in fines of up to CHF 10,000.</h6>


Homburger Bulletin

Switzerland Recognizes New EU Standard Contractual Clauses

Corporate / M&A

IP / IT

Data Protection

HIG Capital

<p>On November 3, 2022, H.I.G. Capital, a leading global investment firm with USD 52 bn of equity capital under management, announced that one of its affiliates has completed the acquisition of Celerion Holdings Inc., a leading full-service provider of outsourced clinical research services to the pharmaceutical industry.</p>
<p>The Homburger team comprised partner Andreas Müller, lead associate Sarah Chevalley, associate Oliver Kneubühl and junior associate Michele Fazari (all Corporate / M&amp;A), associates Joel Fink (IP / IT) and Kirsten Wesiak-Schmidt (Data Protection).</p>


Homburger advised H.I.G. Capital on its acquisition of Celerion

Technology and Digital Economy

Insurance

Capital Markets

Employment and Executive Compensation

wefox

<p>On July 12, 2022, the Berlin-based insurtech wefox Holding AG announced that it has successfully reached an agreement for its Series D funding round, increasing its post-money valuation to USD 4.5 bn. The equity round was led by Mubadala Investment Company with participation from Eurazeo, LGT, Horizons Ventures, OMERS Ventures and Target Global.</p>
<p>wefox is a fully licensed digital insurance company that sells insurance through intermediaries and not directly to customers. wefox intends to use the funding for product development and to further expand across Europe and thereafter Asia and the US.</p>
<p>Homburger AG advises wefox Holding AG as Swiss counsel in this Series D funding round. The Homburger team comprises partner Andreas Müller (Corporate / M&amp;A; Technology and Digital Economy), lead associate Kevin M. Hubacher (Corporate / M&amp;A; Insurance), associates Oriana Schöni (Corporate / M&amp;A; Technology and Digital Economy) and Oliver Kneubühl (Corporate / M&amp;A), and junior associates Alexander Cochardt, Nicolas Wetzel and Michele Fazari (all Corporate / M&amp;A), counsel Eduard De Zordi (Capital Markets), partner Stefan Oesterhelt and associate Laetitia Fracheboud (both Tax), partner Balz Gross and associate Anissa Kern (both Employment and Executive Compensation), and associate Kirsten Wesiak-Schmidt (Data Protection).</p>


Homburger advises wefox in its Series D funding round resulting in a post-money valuation of USD 4.5 bn

Ginkgo Bioworks

<p>On March 14, 2022, Ginkgo Bioworks (NYSE: DNA), the leading horizontal platform for cell programming, announced that it entered into a definitive purchase agreement to acquire FGen AG, a Swiss company specializing in strain development and optimization.</p>
<p>Homburger has advised Ginkgo Bioworks with regard to all Swiss legal aspects of the transaction. The Homburger Team has been led by partner Daniel Hasler and includes associates Angela Oppliger, Karin Mattle and junior associate Benjamin Camavdic (all Corporate / M&amp;A), partner Reto Heuberger and associate Philippe Weber (both Tax) as well as associate Kirsten Wesiak-Schmidt (IP / IT).</p>


Kirsten
Wesiak-Schmidt

Homburger advised H.I.G. Capital on its acquisition of Celerion

Homburger advises wefox in its Series D funding round resulting in a post-money valuation of USD 4.5 bn

Homburger advises Ginkgo Bioworks in its acquisition of FGen AG

Revision of the Swiss Data Protection Law is Complete

New Swiss Data Protection Act Enters Into Force in September 2023

Switzerland Recognizes New EU Standard Contractual Clauses

Switzerland: Data Protection Laws and Regulations

AIPPI Law Series: Law of Raw Data – Switzerland

Switzerland: Data Protection Laws and Regulations

Join the Team

Kirsten Wesiak-Schmidt

Career

Languages

Bar Registration

Teams

KirstenWesiak-Schmidt

Homburger advised H.I.G. Capital on its acquisition of Celerion

Homburger advises wefox in its Series D funding round resulting in a post-money valuation of USD 4.5 bn

Homburger advises Ginkgo Bioworks in its acquisition of FGen AG

Revision of the Swiss Data Protection Law is Complete

New Swiss Data Protection Act Enters Into Force in September 2023

Switzerland Recognizes New EU Standard Contractual Clauses

Switzerland: Data Protection Laws and Regulations

AIPPI Law Series: Law of Raw Data – Switzerland

Switzerland: Data Protection Laws and Regulations

Join the Team

Kirsten Wesiak-Schmidt

Career

Languages

Bar Registration

Teams

Kirsten
Wesiak-Schmidt