<p>By way of a note published on its <a href="https://www.bj.admin.ch/bj/de/home/staat/gesetzgebung/datenschutzstaerkung.html" target="_blank" rel="noopener">website</a>, the Swiss Federal Office of Justice (<strong>FOJ</strong>) has just informed that the new Swiss Data Protection Act (<strong>DPA</strong>) is scheduled to enter into force on September 1, 2023. While the FOJ is cautious to caveat that the final date has yet to be confirmed and decided by the Swiss Federal Council, many companies will be relieved to hear that they will have more time than previously anticipated in order to prepare for the advent of the new DPA. This is even more important considering that the new DPA will not provide for a general transition period, so that companies will have to complete their implementation activities by the time the new DPA enters into force.</p>
<p>Previously, it was anticipated that the new DPA would enter into force already at the beginning of 2023. With the new ordinance on the DPA still not being in final form, this timing would have been tight.</p>
<p>You may find further information on the new DPA in our <a href="https://www.homburger.ch/en/insights/swiss-parliament-approves-revision-of-the-swiss-federal-act-data-protection">Bulletin of September 25, 2020</a> and the text of the new DPA, including an English translation in our <a href="https://cms.homburger.ch/wp-content/uploads/2021/01/Swiss-Data-Protection-Act-of-September-25-2020_02_682151_1.pdf">printable booklet</a>.</p>


New Swiss Data Protection Act Enters Into Force in September 2023

<p>On August 27, 2021, the Swiss Federal Data Protection and Information Commissioner (<strong>FDPIC</strong>) <a href="https://www.edoeb.admin.ch/edoeb/en/home/latest-news/aktuell_news.html#-1259254222" target="_blank" rel="noopener">informed</a> that it recognizes the <a href="https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?uri=CELEX:32021D0914&amp;locale=de" target="_blank" rel="noopener">new EU standard contractual clauses</a> published by the European Commission on June 4, 2021 as standard clauses under the Swiss Data Protection Act (<strong>DPA</strong>). Hence, companies exporting personal data from Switzerland may use the new SCC for their data exports from Switzerland. In the following, we summarize the key takeaways resulting from the FDPIC&#8217;s decision.</p>
<h4>What follows from the FDPIC&#8217;s acknowledgment of August 27, 2021?</h4>
<p>The FDPIC recognized the new SCC as standard clauses acceptable for data exports from Switzerland. This means that Swiss companies may in principle use the new SCC as basis for exports of personal data from Switzerland to third countries without adequate data protection laws. As a result of this acknowledgment, companies relying on the new SCC are exempt from the requirement to notify the FDPIC of the use of the new SCC for each transfer; instead, it will be sufficient for them to inform the FDPIC in a general manner that they rely on the new SCC when exporting personal data to third countries.</p>
<h4>Is the transition to the new SCC mandatory for Swiss companies?</h4>
<p>The new SCC, as well as the old SCC, are just one of several means to provide for sufficient safeguards when exporting personal data from Switzerland to third countries without adequate data protection laws. Hence, using the SCC is not mandatory per se. However, using alternative contractual safeguards requires a case-by-case notification to and examination by the FDPIC, which makes their use and administration burdensome. Thus, from a practical standpoint, using the new SCC will often be the only feasible basis for exports of personal data to third countries where no exception provided for in the DPA to justify the export without contractual safeguards applies.</p>
<p>Moreover, it is to be expected that the FDPIC will not accept the continued use of the old SCC as alternative contractual safeguards for exports of personal data to third countries. Thus, even if the transition to the new SCC is not as such mandatory, the old SCC will no longer be regarded as sufficient by the FDPIC. Hence, action will be required in any case where existing agreements that rely on the old SCC shall continue beyond the end of 2022 (cf. below re timeline).</p>
<h4>What is the timeline to implement the new SCC?</h4>
<p>The FDPIC&#8217;s acknowledgment comes right in time, as many companies are amidst the transition to the new SCC, which become binding in the EU as from September 27, 2021. Swiss companies will be relieved to hear that the Swiss timeline is largely aligned with the one applicable in the EU, simplifying the coordination of the transition activities in the EU and in Switzerland:</p>
<ul>
<li>As from September 27, 2021, the old SCC will no longer be acknowledged by the FDPIC as standard clauses providing for sufficient safeguards for data exports to third countries from Switzerland. Accordingly, as from that date, new or amended agreements governing exports of personal data from Switzerland to third countries should no longer rely on the old SCC as basis to provide adequate data protection safeguards. The same applies with respect to other standard contractual safeguards previously acknowledged by the FDPIC – namely the Swiss Transborder Data Flow Agreement (for outsourcing of data processing) as well as the template agreement of the European Council – which were however not frequently used in practice.</li>
<li>There will be a transition period until the end of 2022 for existing agreements based on the old SCC, provided that the relevant processing activities they govern and the agreements as such remain substantially unchanged: Companies may continue to rely on such existing agreements until December 31, 2022. As from January 1, 2023, these agreements will have to be updated to incorporate the new SCC or, as the case may be, other acceptable safeguards.</li>
</ul>
<h4>Do the new SCC need to be adapted for use in Switzerland?</h4>
<p>According to the FDPIC, the SCC require only minor clarifications to account for the DPA. In particular, the FDPIC asks for clarifications to be added (1) that references to EU member states in the SCC shall not be interpreted in such a way that data subjects in Switzerland are excluded from exercising their rights at their habitual residence in Switzerland,<a href="#_ftn1" name="_ftnref1">[1]</a> and (2) that the SCC also protect data pertaining to legal entities as long as the current Swiss DPA remains in force.<a href="#_ftn2" name="_ftnref2">[2]</a> In addition, companies need to clarify (3) that the FDPIC is the competent authority for the purposes of the DPA.</p>
<p>These clarifications may be included in an addendum to the SCC that applies insofar as the DPA is concerned. This way, the addition would not conflict with the general rule stipulated in the SCC that the SCC as such must not be amended in order to constitute a valid basis for transfers under the GDPR.</p>
<p>Beyond that, the FDPIC acknowledges in principle that the new SCC can be used unchanged for data transfers that are governed by the DPA and the GDPR at the same time. This will facilitate implementation work for Swiss companies.</p>
<h4>Can we simply replace references to the old SCC in existing agreements to references to the new SCC?</h4>
<p>The transition to the new SCC requires more complex adjustments to existing agreements than just this. This is because the new SCC are substantially different from the old SCC in terms of content and structure, so that they cannot simply be replaced in agreements by way of an addendum replacing references to the old SCC by such to the new SCC.</p>
<p><em>First,</em> the new SCC implement a modular approach and replace all three previous sets of SCC (i.e., the two different sets of SCC for controller-to-controller transfers and the third set for controller-to-processor transfers). When implementing the new SCC, the parties will have to agree on which module(s) apply to the relevant data export. Specifically, the new SCC include four modules governing different types of transfers, as follows:</p>
<ul>
<li>Module 1: controller-to-controller transfers;</li>
<li>Module 2: controller-to-processor (and potential sub-processors) transfers;</li>
<li>Module 3: processor-to-processor (and potential sub-processors) transfers; and</li>
<li>Module 4: processor-to-controller transfers.</li>
</ul>
<p><em>Second,</em> the new SCC include additional rules and govern further topics than the old SCC that need to be considered when adjusting existing agreements. In particular, modules 2 and 3 governing transfers to processors include processor terms, which may conflict with existing agreements. Further, the new SCC implement the requirement to perform a transfer impact assessment to help companies deal with the requirements resulting from last year&#8217;s <em>Schrems II</em> decision of the CJEU (cf. below and our <a href="https://www.homburger.ch/en/insights/cjeu-decision-schrems-ii-new-hurdles-data-transfers-usa" target="_blank" rel="noopener">Bulletin of July 16, 2020</a>). Moreover, the new SCC include provisions governing liability and certain representations to be made by the parties. All this means that existing agreements will often have to be reviewed one-by-one to assess the potential impact of the transition to the new SCC and to identify the specific adjustments needed.</p>
<p><em>Third,</em> the new SCC will require additional information in their annexes, such as on the competent supervisory authority, on safeguards implemented when transferring sensitive personal data, and on the frequency of the transfer. For transfers to processors, they require the specification of the subject matter, the nature and the duration of the processing. In addition, the new SCC require a broader, more detailed and specific description of the technical and organizational measures to ensure data security than this was the case under the old SCC.</p>
<h4>Do we need to perform a Swiss law transfer impact assessment when using the new SCC?</h4>
<p>In its <em>Schrems II</em> decision, the CJEU held that the use of the SCC as a contractual basis to secure exports of personal data to third countries requires a case-by-case assessment, in particular with regard to data access rights of authorities in the country of destination (see our <a href="https://www.homburger.ch/en/insights/cjeu-decision-schrems-ii-new-hurdles-data-transfers-usa" target="_blank" rel="noopener">Bulletin of July 16, 2020</a>). As a result, the new SCC now also require the data exporter and the data importer to undertake and document a so-called transfer impact assessment (<strong>TIA</strong>). Further, the new SCC require the parties to warrant that they have no reasons to believe that the laws and practices in place in the country of destination prevents the data importer from complying with its obligations under the SCC, and they impose an obligation on the data importer to notify the data exporter in case of access requests by authorities. Failure to comply with these obligations, may result in liability.</p>
<p>However, it is important to note that the new SCC as such do not overcome the structural issue identified by the CJEU in the <em>Schrems II </em>decision, i.e., that mandatory surveillance and government access laws may overrule the contractual obligations under the SCC. Thus, if the TIA identifies risks that are not mitigated by the SCC, additional safeguards are required in order for the data export to go forward.</p>
<p>From a Swiss law perspective, the FDPIC also requests a TIA to be performed. The basis for this is each data exporter&#8217;s obligation to ensure that contractual safeguards provide adequate protection for the personality of the data subjects. According to its <a href="https://www.edoeb.admin.ch/dam/edoeb/en/dokumente/2021/Anleitung%20f%C3%BCr%20die%20Pr%C3%BCfung%20von%20Daten%C3%BCbermittlungen%20mit%20Auslandbezug%20EN.pdf.download.pdf/Anleitung%20f%C3%BCr%20die%20Pr%C3%BCfung%20von%20Daten%C3%BCbermittlungen%20mit%20Auslandbezug%20EN.pdf" target="_blank" rel="noopener">guidance on TIAs</a> released by the FDPIC earlier this year, companies performing a TIA need to consider (1) the specifics of the contemplated data transfer, in particular in terms of categories of personal data, data subjects, purpose of the transfer, processors and sub-processors involved (if any), and (2) the compliance of the third country&#8217;s surveillance and lawful access rights with the four essential guarantees of lawful basis, necessity and proportionality, effective legal remedies, and access to an independent and impartial court in relation to the contemplated data export. If the essential guarantees are complied with in the country of destination, the data exporter may in principle export the personal data based on the SCC. Otherwise, in addition to agreeing on the SCC, additional technical and organizational measures need to be implemented in order to ensure an adequate data protection level. In practice, it is to be expected that the Swiss law TIA will largely follow the one required by the SCC and EU data protection authorities, even though uncertainties as to regulatory practice continue to this date.</p>
<h4>Do we need to inform the FDPIC about the transition to the new SCC?</h4>
<p>Unlike the GDPR, the current Swiss DPA still requires companies to inform the FDPIC about their use of the SCC. While the use of non-standard contractual safeguards requires a case-by-case notification to and examination by the FDPIC, for the SCC, a general, one-time notification to the FDPIC is sufficient to cover all further uses of the SCC. This notification requirement for approved standard clauses will be abolished when the new DPA will enter into force. For the time being, however, it continues to apply.</p>
<p>In its August 27, 2021 communication, the FDPIC does not address the question of whether companies who have previously informed the FDPIC about their use of the old SCC need to renew this notification as they transition to the new SCC. Even though that the practical risk of fines imposed in case companies fail to notify the FDPIC of the transition from the old to the new SCC appears to be limited,<a href="#_ftn3" name="_ftnref3">[3]</a> it is advisable to inform the FDPIC of the use of the new SCC to avoid such risk.</p>
<h4>Is there any update as to when the new Swiss DPA enters into force?</h4>
<p>Interestingly, the FDPIC&#8217;s communication of August 27, 2021 also provides an update on the timeline for the new Swiss DPA to enter into force: While many expected this to be in the second half of 2022, the FDPIC indicates that the new Swiss DPA will enter into force only on January 1, 2023.</p>
<p>It is to be noted, however, that this view of the FDPIC is not binding upon the Federal Council who will decide when the new DPA enters into force. Thus, in theory at least, it is still possible that the new DPA enters into force still in 2022.</p>
<h6><a href="#_ftnref1" name="_ftn1">[1]</a>        See in particular clause 18(c) of the SCC, which refers to the right of the data subject to bring legal proceedings against the data export and/or data importer before the courts of the &#8220;Member States&#8221; in which the data subject has his/her habitual residence. The FDPIC does not want this to be interpreted as limiting the rights of data subjects with their habitual residence in Switzerland.</h6>
<h6><a href="#_ftnref2" name="_ftn2">[2]</a>        The current DPA still protects data pertaining to legal entities as personal data. Under the new DPA, data pertaining to legal entities will no longer constitute personal data.</h6>
<h6><a href="#_ftnref3" name="_ftn3">[3]</a>        According to article 34(2)(a) DPA, the failure to inform the FDPIC about the contractual safeguards relied upon when exporting personal data to third countries is a criminal offence that may result in fines of up to CHF 10,000.</h6>


Homburger Bulletin

Switzerland Recognizes New EU Standard Contractual Clauses

<p>Personal data is an omnipresent key value driver for businesses. The regulation governing its processing has tightened and continues to evolve dynamically, often making it challenging for companies to follow. Most recently, for instance, the CJEU&#8217;s decision in the <em>Schrems II</em> matter took many by surprise. However, data protection has a long history of constant evolution. Forty years ago, on January 28, 1981, the Council of Europe opened for signature what is nowadays known as the <a href="https://www.coe.int/en/web/conventions/full-list/-/conventions/treaty/108" target="_blank" rel="noopener">Convention 108</a> (the <em>Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data</em>) and became the founding piece of European data protection regulation, kicking-off an exciting development that leads up to today. This year&#8217;s Data Protection Day commemorates the 40<sup>th</sup> anniversary of such landmark event in data protection!</p>


<h4>Revision of the Swiss Data Protection Act: Implementation Work Ahead</h4>
<p>On September 25, 2020, the Swiss Federal Parliament approved the revision of the Swiss Data Protection Act (<strong>DPA</strong>) after a long parliamentary debate (see our <a href="https://www.homburger.ch/en/insights/swiss-parliament-approves-revision-of-the-swiss-federal-act-data-protection" target="_blank" rel="noopener">Newsletter of September 25, 2020</a> summarizing the key changes of the revision). You may find the final text of the new DPA in <a href="https://cms.homburger.ch/wp-content/uploads/2021/01/Swiss-Data-Protection-Act-of-September-25-2020_02_682151_1.pdf" target="_blank" rel="noopener"><strong>our printable booklet</strong></a>, which includes the German text and an English translation.</p>
<p>No public referendum has been called for. Hence, it is now certain that the new DPA will enter into force. The timeline however still remains to be confirmed. The federal administration&#8217;s work on the new implementing ordinance is underway and we expect the draft to be available to the public in Q2 of this year. The new DPA is scheduled to enter into force early or mid 2022.</p>
<p>Given that the new DPA will not provide for an implementation period once it enters into force, this year is the time to kick-off implementation projects. Typically, companies will have to start such projects by <strong>(1)</strong> identifying <strong>processing activities</strong> in scope of the new DPA and <strong>(2)</strong> existing <strong>documentation</strong> relating thereto, then assess <strong>(3)</strong> whether there is a need to <strong>change any of these processing activities</strong> to ensure compliance with the new DPA, <strong>(4)</strong> prepare <strong>inventories</strong> of in-scope processing activities, <strong>(5)</strong> update existing <strong>privacy notices</strong> and similar documents, <strong>(6)</strong> review and update <strong>intra-group and third party agreements</strong> (such as with third party processors) governing data transfers and third party processing activities, <strong>(7)</strong> perform <strong>data protection impact assessments</strong> where needed, and <strong>(8) </strong>review, update and, where appropriate, document <strong>governance processes</strong> (such as to deal with data subject rights and breach notification obligations).</p>
<p>Shortly, we will publish additional resources to facilitate implementation projects.</p>
<h4>Recent Federal Supreme Court&#8217;s Decisions on Data Subject Access Requests</h4>
<p>In November 2020, the Federal Supreme Court held that a data subject access request under the DPA which was made prior to filing a lawsuit to <strong>gather information</strong> about the other party and <strong>obtain evidence</strong> (a so-called «<em>fishing expedition»</em>) is an <strong>abuse of rights</strong>.<a href="#_ftn1" name="_ftnref1"><sup>[1]</sup></a> It is indeed established case law that an access request may be abusive if it is made only for this purpose. However, the award clarifies that an abuse of rights exists only if the <em>sole</em> purpose of the access request is to clarify the prospects of litigation. If the access request may also serve other purposes, the information cannot be refused for abusive exercise of rights.</p>
<p>In its reasoning, the Federal Supreme Court referred to the revised DPA, according to which the data subject requesting access to information must be provided with the information necessary to assert his or her rights under the DPA and to ensure a transparent data processing. Thus, the aforementioned decision is in fact the first decision on the revised DPA, indicating that the Federal Supreme Court will follow its previous case law on the data subject access right also under the new DPA.</p>
<p>In a decision of December 2020,<a href="#_ftn2" name="_ftnref2"><sup>[2]</sup></a> the Federal Supreme Court further stated that the data subject access right only covers <strong>written or otherwise physically existing data</strong>. Data that merely exists in a person&#8217;s memory is not covered. In particular, the access right under the DPA does not include a general right to discover, by questioning parties and witnesses, between whom, when and about what a personal conversation took place. Furthermore, the access right only covers data that can be accessed by the controller. Thus, the controller does not have to make inquiries, such as about the origin of information, if such data is not retained by the controller.</p>
<h4>Brexit – Mind the Gap</h4>
<p>About a month ago, the United Kingdom left the European Union. With that, the EU General Data Protection Regulation (<strong>GDPR</strong>) has ceased to take effect in the UK. However, the UK has largely transitioned the substantive terms of the GDPR as domestic «UK-GDPR<em>»</em> into the law of England and Wales, Scotland and Northern Ireland.<a href="#_ftn3" name="_ftnref3">[3]</a></p>
<p>Leaving the EU has <strong>implications for data exports to the UK from EU and EEA</strong> member states: in principle, the UK now qualifies as third country so that exports of personal data to the UK are subject to an adequacy decision by the European Commission or, absent such decision, the implementation of alternative safeguards or case-by-case exceptions as provided for under the GDPR. The EU and the UK, however, have agreed on a transition period of up to six months ending on June 30, 2021 at the latest, during which data transfers from EU and EEA member states to the UK may continue as if the UK were not qualified as third country. In order for data transfers to continue smoothly thereafter, an adequacy decision by the European Commission will be required.</p>
<p>For Swiss businesses, it is good to know that <strong>data exports from Switzerland to the UK are not impacted</strong>. The Swiss Federal Data Protection and Information Commissioner (<strong>FDPIC</strong>) continues to regard the UK as a country with adequate data protection laws.<a href="#_ftn4" name="_ftnref4">[4]</a></p>
<h4>Schrems II – Uncertainty Continues</h4>
<p>The uncertainties caused by the CJEU&#8217;s landmark decision in the <em>Schrems II</em> matter handed down on July 16, 2020<a href="#_ftn5" name="_ftnref5">[5]</a> (see our <a href="https://www.homburger.ch/en/insights/cjeu-decision-schrems-ii-new-hurdles-data-transfers-usa" target="_blank" rel="noopener">Newsletter of July 16, 2020</a>) continue to impact businesses transferring personal data to the USA and other third countries. Guidance provided by supervisory authorities since the CJEU&#8217;s decision has been disparate.</p>
<p>The CJEU itself stressed that <strong>supplementary safeguards</strong> may be needed to continue using standard contractual clauses for exports to certain third countries such as the USA, but it did not specify which safeguards these might be. Recently, the <strong>European Data Protection Board</strong> (<strong>EDPB</strong>) adopted recommendations<a href="#_ftn6" name="_ftnref6">[6]</a> seeking to shed further light on the process to identify and adopt such safeguards. Not surprisingly, the EDPB propagates a strict view. It warns against relying on subjective factors, such as the perceived likelihood of foreign authorities seeking access to the relevant data. Further, it argues that <strong>contractual and organizational measures</strong> alone will often not be sufficient, but that they need to be combined with <strong>technical measures</strong>, such as encryption and de-identification. The EDPB goes far by stipulating that there may not be any sufficient safeguards available in case clear text access to personal data is required from a third country where contractual safeguards do not suffice, such as in case of clear text access by a cloud provider in the USA for processing operations or when using remote access to clear text data.</p>
<p>In a statement published on September 8, 2020,<a href="#_ftn7" name="_ftnref7">[7]</a> the <strong>Swiss FDPIC</strong> shares the CJEU&#8217;s concerns regarding data exports to countries where local laws deprive contractual safeguards of its effect, and it agrees that additional technical measures may have to be implemented to provide for sufficient safeguards. However, as far as potential clear text access is concerned, the FDPIC takes a slightly less restrictive approach than the EDPB, stipulating that the use of sufficient technical safeguards may prove to be challenging in such circumstances (but, hence, not outright impossible).</p>
<p>The recently published <strong>revised standard contractual clauses</strong> of the European Commission<a href="#_ftn8" name="_ftnref8">[8]</a> will, once adopted, not overcome the hurdles imposed by the Schrems II decision. Thus, uncertainty will continue for many businesses.</p>
<h6><a name="_ftn1"></a><a href="https://www.homburger.ch/en/insights/data-protection-day-2021#_ftnref1">[1]</a> Federal Supreme Court decision 4A_277/2020 dated November 18, 2020 (<a href="https://www.bger.ch/ext/eurospider/live/de/php/aza/http/index.php?highlight_docid=aza%3A%2F%2Faza://18-11-2020-4A_277-2020&amp;lang=de&amp;zoom=&amp;type=show_document">https://www.bger.ch/ext/eurospider/live/de/php/aza/http/index.php?highlight_docid=aza%3A%2F%2Faza://18-11-2020-4A_277-2020&amp;lang=de&amp;zoom=&amp;type=show_document</a><br />
(visited on January 27, 2021).</h6>
<h6><a name="_ftn2"></a><a href="https://www.homburger.ch/en/insights/data-protection-day-2021#_ftnref2">[2]</a> Federal Supreme Court decision 4A_125/2020 dated December 10, 2020 (<a href="https://www.bger.ch/ext/eurospider/live/de/php/aza/http/index.php?highlight_docid=aza%3A%2F%2Faza://10-12-2020-4A_125-2020&amp;lang=de&amp;zoom=&amp;type=show_document">https://www.bger.ch/ext/eurospider/live/de/php/aza/http/index.php?highlight_docid=aza%3A%2F%2Faza://10-12-2020-4A_125-2020&amp;lang=de&amp;zoom=&amp;type=show_document</a><br />
(visited on January 27, 2021).</h6>
<h6><a name="_ftn3"></a><a href="https://www.homburger.ch/en/insights/data-protection-day-2021#_ftnref3">[3]</a> See: <a href="https://ico.org.uk/for-organisations/dp-at-the-end-of-the-transition-period/data-protection-now-the-transition-period-has-ended/the-gdpr/">https://ico.org.uk/for-organisations/dp-at-the-end-of-the-transition-period/data-protection-now-the-transition-period-has-ended/the-gdpr/</a> (visited on January 27, 2021).</h6>
<h6><a name="_ftn4"></a><a href="https://www.homburger.ch/en/insights/data-protection-day-2021#_ftnref4">[4]</a> See: <a href="https://www.edoeb.admin.ch/edoeb/de/home/aktuell/aktuell_news.html#-181656549">https://www.edoeb.admin.ch/edoeb/de/home/aktuell/aktuell_news.html#-181656549</a> (visited on January 27, 2021).</h6>
<h6><a name="_ftn5"></a><a href="https://www.homburger.ch/en/insights/data-protection-day-2021#_ftnref5">[5]</a> See: <a href="http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=228677&amp;pageIndex=0&amp;doclang=EN&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=9729736">http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=228677&amp;pageIndex=0&amp;doclang=EN&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=9729736</a><br />
(visited on January 27, 2021).</h6>
<h6><a name="_ftn6"></a><a href="https://www.homburger.ch/en/insights/data-protection-day-2021#_ftnref6">[6]</a> See: <a href="https://edpb.europa.eu/sites/edpb/files/consultation/edpb_recommendations_202001_supplementarymeasurestransferstools_en.pdf">https://edpb.europa.eu/sites/edpb/files/consultation/edpb_recommendations_202001_supplementarymeasurestransferstools_en.pdf</a><br />
(visited on January 27, 2021).</h6>
<h6><a name="_ftn7"></a><a href="https://www.homburger.ch/en/insights/data-protection-day-2021#_ftnref7">[7]</a> See: <a href="https://www.edoeb.admin.ch/dam/edoeb/de/dokumente/2020/Positionspapier_PS_%20ED%C3%96B_DE.pdf.download.pdf/Positionspapier_PS_%20ED%C3%96B_DE.pdf">https://www.edoeb.admin.ch/dam/edoeb/de/dokumente/2020/Positionspapier_PS_%20ED%C3%96B_DE.pdf.download.pdf/Positionspapier_PS_%20ED%C3%96B_DE.pdf</a><br />
(visited on January 27, 2021).</h6>
<h6><a name="_ftn8"></a><a href="https://www.homburger.ch/en/insights/data-protection-day-2021#_ftnref8">[8]</a> See: <a href="https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/12741-Commission-Implementing-Decision-on-standard-contractual-clauses-for-the-transfer-of-personal-data-to-third-countries">https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/12741-Commission-Implementing-Decision-on-standard-contractual-clauses-for-the-transfer-of-personal-data-to-third-countries</a><br />
(visited on January 27, 2021).</h6>


Homburger Bulletin Data Protection Day

Data Protection Day 2021

Corporate / M&A

IP / IT

Ginkgo Bioworks

<p>On March 14, 2022, Ginkgo Bioworks (NYSE: DNA), the leading horizontal platform for cell programming, announced that it entered into a definitive purchase agreement to acquire FGen AG, a Swiss company specializing in strain development and optimization.</p>
<p>Homburger has advised Ginkgo Bioworks with regard to all Swiss legal aspects of the transaction. The Homburger Team has been led by partner Daniel Hasler and includes associates Angela Oppliger, Karin Mattle and junior associate Benjamin Camavdic (all Corporate / M&amp;A), partner Reto Heuberger and associate Philippe Weber (both Tax) as well as associate Kirsten Wesiak-Schmidt (IP / IT).</p>


Homburger advises Ginkgo Bioworks in its acquisition of FGen AG

Robert Bosch

<p>On December 16, 2021, Bosch Service Solutions, a leading provider of technology-based services, announced that it planned to acquire Elpro Group AG, headquartered in Buchs, Switzerland. Founded in 1986, the company develops monitoring solutions for the pharmaceutical, biotech, life science and healthcare industries. This includes, for example, uninterrupted monitoring of the cold chain for pharmaceuticals. With the acquisition of the Elpro Group, Bosch Service Solutions is expanding its portfolio and entering the pharmaceutical services sector. Bosch and Elpro signed agreements on the planned acquisition on December 15, 2021. The parties have agreed not to disclose the purchase price. The transaction is subject to approval by the competent antitrust authorities.</p>
<p>Partner David Oser (Corporate / M&amp;A) is leading the Homburger team, which includes partner Reto Heuberger (Tax), associate Claudine Schär, associate Olivier Bühlmann, junior associates Benjamin Camavdic and Lars Schöni (all Corporate / M&amp;A) and associates Philippe Baumann and Kirsten Wesiak-Schmidt (both IP / IT).</p>


Homburger is advising Bosch Service Solutions in its planned acquisition of Elpro Group AG

Competition

Regulatory

Data Protection

Financing and Investment Products

Avaloq_bw

<p>On December 22, 2020, Avaloq Group (<strong>Avaloq</strong>), a Swiss-based global leader in digital banking solutions, core banking software and wealth management technology, announced that Japan-based NEC Corporation (<strong>NEC</strong>, TSE:6701) had completed its acquisition of Avaloq. In the transaction, NEC acquired all outstanding shares from the existing shareholders, which includes the founders, current and former employees as well as private equity firm Warburg Pincus, at an enterprise value exceeding CHF 2 bn.</p>
<p>Homburger acted as global transaction counsel to Avaloq and the majority shareholders. The Homburger team was led by partner Heinz Schärer and included partner David Oser, associates Philippe Baumann and Angela Oppliger and junior associate Cédric Berger (all Corporate / M&amp;A), partner Marcel Dietrich and associates Allegra Arnold and David Waldmeier (all Competition, Regulatory), partners Georg Rauber and Luca Dal Molin and associates Valentin Fluor and Kirsten Wesiak-Schmidt (all IP / IT and Data Protection), partner Jürg Frick and associate Pierina Janett-Seiler (both Financing and Investment Products), as well as associate Marc Vogelsang (Tax).</p>


Kirsten
Wesiak-Schmidt

Homburger advises Ginkgo Bioworks in its acquisition of FGen AG

Homburger is advising Bosch Service Solutions in its planned acquisition of Elpro Group AG

Homburger advised Avaloq Group and majority shareholders in the completion of NEC Corporation's acquisition of Avaloq Group

New Swiss Data Protection Act Enters Into Force in September 2023

Switzerland Recognizes New EU Standard Contractual Clauses

Data Protection Day 2021

AIPPI Law Series: Law of Raw Data – Switzerland

Switzerland: Data Protection Laws and Regulations

Switzerland: Data Protection Laws and Regulations

Join the Team

Kirsten Wesiak-Schmidt

Career

Languages

Bar Registration

Teams

KirstenWesiak-Schmidt

Homburger advises Ginkgo Bioworks in its acquisition of FGen AG

Homburger is advising Bosch Service Solutions in its planned acquisition of Elpro Group AG

Homburger advised Avaloq Group and majority shareholders in the completion of NEC Corporation's acquisition of Avaloq Group

New Swiss Data Protection Act Enters Into Force in September 2023

Switzerland Recognizes New EU Standard Contractual Clauses

Data Protection Day 2021

AIPPI Law Series: Law of Raw Data – Switzerland

Switzerland: Data Protection Laws and Regulations

Switzerland: Data Protection Laws and Regulations

Join the Team

Kirsten Wesiak-Schmidt

Career

Languages

Bar Registration

Teams

Kirsten
Wesiak-Schmidt