Personal data is an omnipresent key value driver for businesses. The regulation governing its processing has tightened and continues to evolve dynamically, often making it challenging for companies to follow. Most recently, for instance, the CJEU&#8217;s decision in the Schrems II matter took many by surprise. However, data protection has a long history of constant evolution. Forty years ago, on January 28, 1981, the Council of Europe opened for signature what is nowadays known as the <a href="https://www.coe.int/en/web/conventions/full-list/-/conventions/treaty/108" target="_blank" rel="noopener">Convention 108</a> (the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data) and became the founding piece of European data protection regulation, kicking-off an exciting development that leads up to today. This year&#8217;s Data Protection Day commemorates the 40th anniversary of such landmark event in data protection!

<h4>Revision of the Swiss Data Protection Act: Implementation Work Ahead</h4>
On September 25, 2020, the Swiss Federal Parliament approved the revision of the Swiss Data Protection Act (DPA) after a long parliamentary debate (see our <a href="https://www.homburger.ch/en/insights/swiss-parliament-approves-revision-of-the-swiss-federal-act-data-protection" target="_blank" rel="noopener">Newsletter of September 25, 2020</a> summarizing the key changes of the revision). You may find the final text of the new DPA in <a href="https://cms.homburger.ch/wp-content/uploads/2021/01/Swiss-Data-Protection-Act-of-September-25-2020_02_682151_1.pdf" target="_blank" rel="noopener">our printable booklet</a>, which includes the German text and an English translation.
No public referendum has been called for. Hence, it is now certain that the new DPA will enter into force. The timeline however still remains to be confirmed. The federal administration&#8217;s work on the new implementing ordinance is underway and we expect the draft to be available to the public in Q2 of this year. The new DPA is scheduled to enter into force early or mid 2022.
Given that the new DPA will not provide for an implementation period once it enters into force, this year is the time to kick-off implementation projects. Typically, companies will have to start such projects by (1) identifying processing activities in scope of the new DPA and (2) existing documentation relating thereto, then assess (3) whether there is a need to change any of these processing activities to ensure compliance with the new DPA, (4) prepare inventories of in-scope processing activities, (5) update existing privacy notices and similar documents, (6) review and update intra-group and third party agreements (such as with third party processors) governing data transfers and third party processing activities, (7) perform data protection impact assessments where needed, and (8) review, update and, where appropriate, document governance processes (such as to deal with data subject rights and breach notification obligations).
Shortly, we will publish additional resources to facilitate implementation projects.
<h4>Recent Federal Supreme Court&#8217;s Decisions on Data Subject Access Requests</h4>
In November 2020, the Federal Supreme Court held that a data subject access request under the DPA which was made prior to filing a lawsuit to gather information about the other party and obtain evidence (a so-called «fishing expedition») is an abuse of rights.<a href="#_ftn1" name="_ftnref1">[1]</a> It is indeed established case law that an access request may be abusive if it is made only for this purpose. However, the award clarifies that an abuse of rights exists only if the sole purpose of the access request is to clarify the prospects of litigation. If the access request may also serve other purposes, the information cannot be refused for abusive exercise of rights.
In its reasoning, the Federal Supreme Court referred to the revised DPA, according to which the data subject requesting access to information must be provided with the information necessary to assert his or her rights under the DPA and to ensure a transparent data processing. Thus, the aforementioned decision is in fact the first decision on the revised DPA, indicating that the Federal Supreme Court will follow its previous case law on the data subject access right also under the new DPA.
In a decision of December 2020,<a href="#_ftn2" name="_ftnref2">[2]</a> the Federal Supreme Court further stated that the data subject access right only covers written or otherwise physically existing data. Data that merely exists in a person&#8217;s memory is not covered. In particular, the access right under the DPA does not include a general right to discover, by questioning parties and witnesses, between whom, when and about what a personal conversation took place. Furthermore, the access right only covers data that can be accessed by the controller. Thus, the controller does not have to make inquiries, such as about the origin of information, if such data is not retained by the controller.
<h4>Brexit – Mind the Gap</h4>
About a month ago, the United Kingdom left the European Union. With that, the EU General Data Protection Regulation (GDPR) has ceased to take effect in the UK. However, the UK has largely transitioned the substantive terms of the GDPR as domestic «UK-GDPR» into the law of England and Wales, Scotland and Northern Ireland.<a href="#_ftn3" name="_ftnref3">[3]</a>
Leaving the EU has implications for data exports to the UK from EU and EEA member states: in principle, the UK now qualifies as third country so that exports of personal data to the UK are subject to an adequacy decision by the European Commission or, absent such decision, the implementation of alternative safeguards or case-by-case exceptions as provided for under the GDPR. The EU and the UK, however, have agreed on a transition period of up to six months ending on June 30, 2021 at the latest, during which data transfers from EU and EEA member states to the UK may continue as if the UK were not qualified as third country. In order for data transfers to continue smoothly thereafter, an adequacy decision by the European Commission will be required.
For Swiss businesses, it is good to know that data exports from Switzerland to the UK are not impacted. The Swiss Federal Data Protection and Information Commissioner (FDPIC) continues to regard the UK as a country with adequate data protection laws.<a href="#_ftn4" name="_ftnref4">[4]</a>
<h4>Schrems II – Uncertainty Continues</h4>
The uncertainties caused by the CJEU&#8217;s landmark decision in the Schrems II matter handed down on July 16, 2020<a href="#_ftn5" name="_ftnref5">[5]</a> (see our <a href="https://www.homburger.ch/en/insights/cjeu-decision-schrems-ii-new-hurdles-data-transfers-usa" target="_blank" rel="noopener">Newsletter of July 16, 2020</a>) continue to impact businesses transferring personal data to the USA and other third countries. Guidance provided by supervisory authorities since the CJEU&#8217;s decision has been disparate.
The CJEU itself stressed that supplementary safeguards may be needed to continue using standard contractual clauses for exports to certain third countries such as the USA, but it did not specify which safeguards these might be. Recently, the European Data Protection Board (EDPB) adopted recommendations<a href="#_ftn6" name="_ftnref6">[6]</a> seeking to shed further light on the process to identify and adopt such safeguards. Not surprisingly, the EDPB propagates a strict view. It warns against relying on subjective factors, such as the perceived likelihood of foreign authorities seeking access to the relevant data. Further, it argues that contractual and organizational measures alone will often not be sufficient, but that they need to be combined with technical measures, such as encryption and de-identification. The EDPB goes far by stipulating that there may not be any sufficient safeguards available in case clear text access to personal data is required from a third country where contractual safeguards do not suffice, such as in case of clear text access by a cloud provider in the USA for processing operations or when using remote access to clear text data.
In a statement published on September 8, 2020,<a href="#_ftn7" name="_ftnref7">[7]</a> the Swiss FDPIC shares the CJEU&#8217;s concerns regarding data exports to countries where local laws deprive contractual safeguards of its effect, and it agrees that additional technical measures may have to be implemented to provide for sufficient safeguards. However, as far as potential clear text access is concerned, the FDPIC takes a slightly less restrictive approach than the EDPB, stipulating that the use of sufficient technical safeguards may prove to be challenging in such circumstances (but, hence, not outright impossible).
The recently published revised standard contractual clauses of the European Commission<a href="#_ftn8" name="_ftnref8">[8]</a> will, once adopted, not overcome the hurdles imposed by the Schrems II decision. Thus, uncertainty will continue for many businesses.
<h6><a name="_ftn1"></a><a href="https://www.homburger.ch/en/insights/data-protection-day-2021#_ftnref1">[1]</a> Federal Supreme Court decision 4A_277/2020 dated November 18, 2020 (<a href="https://www.bger.ch/ext/eurospider/live/de/php/aza/http/index.php?highlight_docid=aza%3A%2F%2Faza://18-11-2020-4A_277-2020&amp;lang=de&amp;zoom=&amp;type=show_document">https://www.bger.ch/ext/eurospider/live/de/php/aza/http/index.php?highlight_docid=aza%3A%2F%2Faza://18-11-2020-4A_277-2020&amp;lang=de&amp;zoom=&amp;type=show_document</a> 
(visited on January 27, 2021).</h6>
<h6><a name="_ftn2"></a><a href="https://www.homburger.ch/en/insights/data-protection-day-2021#_ftnref2">[2]</a> Federal Supreme Court decision 4A_125/2020 dated December 10, 2020 (<a href="https://www.bger.ch/ext/eurospider/live/de/php/aza/http/index.php?highlight_docid=aza%3A%2F%2Faza://10-12-2020-4A_125-2020&amp;lang=de&amp;zoom=&amp;type=show_document">https://www.bger.ch/ext/eurospider/live/de/php/aza/http/index.php?highlight_docid=aza%3A%2F%2Faza://10-12-2020-4A_125-2020&amp;lang=de&amp;zoom=&amp;type=show_document</a> 
(visited on January 27, 2021).</h6>
<h6><a name="_ftn3"></a><a href="https://www.homburger.ch/en/insights/data-protection-day-2021#_ftnref3">[3]</a> See: <a href="https://ico.org.uk/for-organisations/dp-at-the-end-of-the-transition-period/data-protection-now-the-transition-period-has-ended/the-gdpr/">https://ico.org.uk/for-organisations/dp-at-the-end-of-the-transition-period/data-protection-now-the-transition-period-has-ended/the-gdpr/</a> (visited on January 27, 2021).</h6>
<h6><a name="_ftn4"></a><a href="https://www.homburger.ch/en/insights/data-protection-day-2021#_ftnref4">[4]</a> See: <a href="https://www.edoeb.admin.ch/edoeb/de/home/aktuell/aktuell_news.html#-181656549">https://www.edoeb.admin.ch/edoeb/de/home/aktuell/aktuell_news.html#-181656549</a> (visited on January 27, 2021).</h6>
<h6><a name="_ftn5"></a><a href="https://www.homburger.ch/en/insights/data-protection-day-2021#_ftnref5">[5]</a> See: <a href="http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=228677&amp;pageIndex=0&amp;doclang=EN&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=9729736">http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=228677&amp;pageIndex=0&amp;doclang=EN&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=9729736</a> 
(visited on January 27, 2021).</h6>
<h6><a name="_ftn6"></a><a href="https://www.homburger.ch/en/insights/data-protection-day-2021#_ftnref6">[6]</a> See: <a href="https://edpb.europa.eu/sites/edpb/files/consultation/edpb_recommendations_202001_supplementarymeasurestransferstools_en.pdf">https://edpb.europa.eu/sites/edpb/files/consultation/edpb_recommendations_202001_supplementarymeasurestransferstools_en.pdf</a> 
(visited on January 27, 2021).</h6>
<h6><a name="_ftn7"></a><a href="https://www.homburger.ch/en/insights/data-protection-day-2021#_ftnref7">[7]</a> See: <a href="https://www.edoeb.admin.ch/dam/edoeb/de/dokumente/2020/Positionspapier_PS_%20ED%C3%96B_DE.pdf.download.pdf/Positionspapier_PS_%20ED%C3%96B_DE.pdf">https://www.edoeb.admin.ch/dam/edoeb/de/dokumente/2020/Positionspapier_PS_%20ED%C3%96B_DE.pdf.download.pdf/Positionspapier_PS_%20ED%C3%96B_DE.pdf</a> 
(visited on January 27, 2021).</h6>
<h6><a name="_ftn8"></a><a href="https://www.homburger.ch/en/insights/data-protection-day-2021#_ftnref8">[8]</a> See: <a href="https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/12741-Commission-Implementing-Decision-on-standard-contractual-clauses-for-the-transfer-of-personal-data-to-third-countries">https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/12741-Commission-Implementing-Decision-on-standard-contractual-clauses-for-the-transfer-of-personal-data-to-third-countries</a> 
(visited on January 27, 2021).</h6>

Homburger Bulletin Data Protection Day

Data Protection Day 2021

<h4>The main findings of the decision</h4>
<ul>
<li>The EU-U.S. Privacy Shield can no longer serve as a basis for the transfer of personal data from the EU to the USA. The reason for this are the comprehensive surveillance measures of the USA, which according to the CJEU are not sufficiently limited by the Privacy Shield.</li>
<li>In contrast, the standard contractual clauses approved by the EU Commission are valid and can in principle be used for data exports to countries without an adequate level of data protection.</li>
<li>However, the CJEU makes an important reservation concerning standard contractual clauses: The data exporter cannot use the standard contractual clauses indiscriminately, but must verify on a case-by-case basis whether compliance with the standard contractual clauses is guaranteed in the recipient country. In particular, governmental access rights must be taken into account: Provided that these rights do not go beyond what is necessary in a democratic society to safeguard public security, such access rights are unproblematic. However, if it turns out that despite agreeing on the standard contractual clauses with the data importer, an adequate level of data protection is not achieved in the country of destination, the export should be suspended. This may be the case, in particular, if mass surveillance is carried out in the country of destination, which is not compatible with the principles of a democratic society.</li>
<li>The CJEU decision raises doubts as to whether the standard contractual clauses can be used in the future as a basis for data transfers to the USA. The CJEU has not ruled on this question. However, it argues that the U.S., surveillance measures conflict with European data protection law, as the U.S. surveillance programs are not limited to what is absolutely necessary.</li>
</ul>
<h4>Effects of the decision</h4>
In addition to the obvious consequence of the abolition of the privacy shield, the CJEU&#8217;s decision also makes data exporters and supervisory authorities responsible: data exporters may continue to use the standard contractual clauses, but they can no longer use them indiscriminately for exports to any country of destination. Instead, they must verify on a case-by-case basis whether the standard contractual clauses can be complied with. The CJEU is thereby creating new hurdles and uncertainties for data transfers to third countries, in particular to the USA. It can be assumed that data exports under the standard contractual clauses will require more attention in the future.
However, due to the importance of the standard contractual clauses for the transfer of data to third countries, it is above all the supervisory authorities who are called upon to act: They must now quickly clarify whether, in which cases and, if necessary, with which additional measures the standard contractual clauses can still be used in the medium term for data transfers to the USA and other countries with comparable surveillance programs. A coordinated approach at European level seems urgently necessary here.
Finally, the CJEU&#8217;s decision also sends a signal to the USA: The CJEU is not willing to settle for the limited improvements of the Privacy Shield compared to the former Safe Harbor Framework. The CJEU is thus increasing the pressure on the USA to make further concessions with regard to the protection of the personal rights of individuals in the EU in order to guarantee the transatlantic transfer of data, which is important for the economy.
<h4>Relevance for Swiss companies</h4>
The CJEU decision also has implications for Swiss companies. These too base their data exports largely on the standard contractual clauses also recognized by the Federal Data Protection and Information Commissioner (FDPIC). Switzerland also has the Swiss-U.S. Privacy Shield, which corresponds to the EU-U.S. Privacy Shield, which has now been declared invalid.
With regard to the Privacy Shield, it can be assumed that the FDPIC will also declare data exports on the basis of the Swiss-U.S. Privacy Shield to be inadmissible and adapt its list of countries with adequate data protection laws accordingly. It can therefore be assumed that in the short to medium term Swiss companies will no longer be able to rely on the Swiss-U.S. Privacy Shield for data exports.
With regard to standard contractual clauses, the situation in Switzerland under the Data Protection Act (DPA) is comparable to the one under the EU General Data Protection Regulation (GDPR): data transfers to third countries are permitted under art. 6 para. 2 lit. a DPA if «sufficient safeguards, in particular contractual clauses, ensure an adequate level of protection abroad». Swiss companies can therefore generally rely on the standard contractual clauses when exporting personal data to third countries. However, here too, intervention is required if there is reasonable doubt as to whether the data importer is complying with the standard contractual clauses.
<h4>Need for action</h4>
Companies that base data transfers to the USA on the EU-U.S. Privacy Shield will have to put these transfers on a new basis. The same is recommended to companies in Switzerland who base their data transfers to the USA on the Swiss-U.S. Privacy Shield.
The standard contractual clauses are an alternative. Here, the concerns of the CJEU must be taken into account: If the standard contractual clauses cannot be complied with by the data importer, the export must be suspended.
We advise companies that base their data exports from Switzerland to the USA on the standard contractual clauses to adopt a cautious approach in the short term. It is hardly imaginable to stop all these data exports from one day to the next, and in our opinion there is no immediate need for this either from a Swiss perspective or under the GDPR. It can be assumed that the European supervisory authorities and the FDPIC will soon issue guidance on the matter. Consequently, developments must be monitored and a reaction will be necessary if there is a change in practice. To this end, it must be made clear which contracts would have to be adapted, if need be, if there were any changes in practice with regard to the standard contract clauses and their application.
<h4>The background to the decision</h4>
The background to the decision is a dispute between Facebook and Maximilian Schrems regarding data transfers from Facebook Ireland to the USA. Facebook Ireland has based its data transfers to the USA on the standard contractual clauses since the CJEU&#8217;s annulment of the Safe Harbor Framework.2 This means that the U.S. Facebook entity has committed itself to Facebook Ireland to respect European data protection laws. Maximilian Schrems applied to the Irish data protection authority to prohibit the further transfer of his personal data by Facebook Ireland to the USA. He argued that the standard contractual clauses cannot serve as a basis for such transfer due to conflicting U.S. law.
<h4>Footnotes:</h4>
1 Judgment of the CJEU of July 16, 2020, Case C-311/18, available here: <a href="https://bit.ly/2ZADzY4">https://bit.ly/2ZADzY4</a> (visited on July 16, 2020).
2 Judgment of the CJEU of October 6, 2015, Case C-362/14, available here: <a href="https://bit.ly/3exrXcD">https://bit.ly/3exrXcD</a> (visited on July 16, 2020).

Homburger_Illu_DatentransferUSA_Preview_2020_09_V2

CJEU Decision in re Schrems II

<h4>What will not change?</h4>
Most importantly, the core principles of Swiss data protection law will not change. As already under the current DPA, the revised DPA will require compliance with a number of processing principles (such as transparency, purpose limitation, proportionality, data security, etc.), and the processing of personal data continues to be lawful if these processing principles are complied with.
In this respect, the revised DPA continues to differ from the EU General Data Protection Regulation (the GDPR). There will not be a need for a legal basis for each processing activity. Rather, a processing activity must only be justified based on consent, legal requirements or overriding private or public interests if any processing principle is not complied with, or if personal data is processed against the data subject&#8217;s wish. Thus, the need for justification continues to be an exception rather than the default under the revised DPA.
In practice, we do not expect the revision of the DPA to have a major impact on how companies process personal data in Switzerland. Rather, the new DPA will have an impact on data protection governance and documentation needed to ensure compliance.
<h4>What will change?</h4>
Nevertheless, the revised DPA also brings a number of relevant changes. Largely, and not surprisingly, many of these changes are inspired by the GDPR and they will be familiar to data protection professionals working with the GDPR. The following changes are worth to be highlighted:
<ul>
<li>Data relating to legal entities will no longer be protected by the DPA. As under the GDPR, only data relating to individuals will fall within the scope of the revised DPA.</li>
<li>The data controller&#8217;s information duties will be broadened. The controller will have to inform the data subjects at least about its identity and contact details, the purpose of processing and recipients or categories of recipients. The list provided in the DPA is however not comprehensive, and controllers will have to consider whether additional information needs to be provided to data subjects, so that they provide the «information needed for the data subjects to exercise their rights» under the DPA and to «ensure a transparent processing», as rather vaguely required by the revised DPA.</li>
<li>There will be an increased need to document processing activities and to implement governance processes. Subject to certain exceptions applying to companies with less than 250 employees, data controllers and data processors will have to maintain inventories of their processing activities. For high risk processing activities, data controllers will have to perform a data protection impact assessment.</li>
<li>The new DPA introduces a data breach notification obligation into Swiss law: The data controller will have to report any data breach that is expected to trigger a high risk for the personality rights of data subjects to the Swiss Federal Data Protection and Information Commissioner (the FDPIC); the notification is to be made as soon as possible. Thus, the threshold for a notification obligation to be triggered is slightly higher than under the GDPR. If needed to protect the data subjects, or if requested by the FDPIC, the data controller must also inform the affected data subjects.</li>
<li>While the data subject rights will remain unchanged for most part, the revised DPA will introduce certain modifications regarding the data subject access right. In particular, it will likely be clarified that transfers among affiliates within the same group will not deprive the data controller from its right to refuse to provide information insofar as justified by its own overriding interests. Further, the revised DPA will introduce a right to data portability that is inspired by (but differs from) the GDPR.</li>
<li>The revised DPA will regulate automated individual decision making. Subject to certain exceptions, an information duty applies to the extent that decisions are exclusively based on automated processing and have legal consequences for, or otherwise significantly impair the data subject. There will not be a prohibition of such decision making, but a right of the data subject to escalate to a human being for review.</li>
<li>The new DPA will govern profiling, but the details are not yet resolved between the two parliamentary chambers. As it currently stands, the proposed regulation would be limited to certain restrictions with respect to performing credit checks and not have a relevant impact for most private companies.</li>
<li>The revised DPA will distinguish between controllers and processors, essentially in the same way as the GDPR does. While the distinction already exists under the current DPA, it will now be expressly introduced into the new DPA. In substance, the new DPA does not provide for detailed requirements regarding processor terms, so that GDPR-compliant processor terms continue to be compliant also with the new DPA. Further, the new DPA expressly states that the appointment of subprocessors requires the approval of the data controller.</li>
<li>The obligation to register data files is abolished.</li>
<li>The FDPIC is granted more extensive enforcement powers. Under the new DPA, the FDPIC will be empowered to conduct investigations ex officio or upon complaint, to collect evidence and to issue orders. The FDPIC&#8217;s orders will be binding, unless they are successfully appealed by the addressee. This deviates from the current law, that does not empower the FDPIC to issue binding orders to remedy non-compliance.</li>
<li>The new DPA will significantly broaden the range of sanctions for non-compliance with the DPA. Under the new DPA, sanctions of up to CHF 250,000 can be triggered by a broad range of infringements of the DPA.</li>
</ul>
<h4>Will there be relevant changes regarding the export of personal data?</h4>
The core principles governing data exports will remain unchanged under the new DPA. Thus, data exports continue to be permitted to countries that have adequate data protection laws in place. Conversely, exports to third countries either require justification (such as the performance of an agreement with or in the interest of the data subject, overriding public interests, the enforcement of claims, etc.) or the implementation of other remedies to maintain an adequate level of data protection (e.g., by implementing standard contractual clauses, binding corporate rules, or other contractual arrangements, etc.).
However, there will be a few amendments with relevance for day-to-day business activities. First, the new DPA empowers the Federal Council to render binding adequacy decisions on the data protection level of foreign jurisdictions; the current non-binding FDPIC list of whitelisted countries will no longer be maintained. Second, the use of approved standard contractual clauses will no longer have to be notified to the FDPIC. Third, the possible justifications for exports to non-whitelisted countries are broadened in the context of foreign proceedings, given that the revised DPA will also allow exports to exercise or enforce claims in proceedings at foreign authorities (and not only courts, as under the current DPA). This will facilitate data exports for the purpose of foreign regulatory proceedings in front of administrative authorities rather than courts, which triggered a number of litigations under the current DPA. Fourth, the information duties of the data controller under the revised DPA will require the data controller to inform the data subject about the country to where the data will be exported, and the applicable justification or other remedy in case of exports to non-whitelisted countries.
<h4>Will the new DPA have extra-territorial reach?</h4>
Already the current DPA has a limited extra-territorial reach, which is the result of Swiss international private law that allows data subjects to choose Swiss law to apply in certain situations with respect to claims under data protection law. Going beyond that, the revised DPA will apply to processing activities outside of Switzerland that take effect in Switzerland. Further, data controllers domiciled outside of Switzerland will have to appoint a representative in Switzerland in case they process personal data of individuals in Switzerland and the processing (i) occurs in the context of the offering of products or services in Switzerland or to monitor the conduct of individuals in Switzerland, (ii) is extensive and regular and (iii) implies a high risk for the data subjects. The representative has to maintain an inventory of the relevant processing activities.
<h4>Will there be a Swiss Finish?</h4>
In general, the requirements under the revised DPA will not go beyond the level of protection of the GDPR. Most «Swiss finishes» that were included in the first draft of the DPA have been removed. As already mentioned, however, there are differences to be taken into account. For instance, the scope of the information duty of the data controller will not be delimited by a comprehensive list of information, but leave room for interpretation as to what specific information has to be provided.
<h4>Are there other differences to the GDPR?</h4>
There are a number of other differences compared to the GDPR. For instance, consent continues to be a viable means of justification for breach of privacy under the revised DPA as under the current DPA. In particular, and unlike under the GDPR, there will not be any unbundling requirements introduced into Swiss law. Differences also exist with respect to data subject rights.
<h4>What are the sanctions under the DPA?</h4>
While the sanctions for breaches of the new DPA will be more severe compared with the current law, they are still moderate when compared to the GDPR. It is important to note, however, that the revised DPA will not provide for administrative sanctions against companies, but continue to target responsible individuals based on criminal liability. Accordingly, an individual&#8217;s non-compliance with the new DPA may be fined with up to CHF 250,000. If it would require a disproportionate effort to identify the individual offender acting within a company and the expected fine does not exceed CHF 50,000, the company can be fined instead.
<h4>What are the next steps?</h4>
A few differences remain to be resolved in parliament. In substance, these relate to the regulation of profiling activities and to details regarding the information duties, the data subject access right, and the justification of processing activities in the context of credit checks. Likely, the remaining differences will be resolved during Q1 of 2020. While a public referendum on the revised DPA is a possibility, no calls for a referendum have been made so far.
<h4>When will the DPA enter into force?</h4>
As it currently stands, the revised DPA will likely enter into force early 2021.
<h4>Will there be a general transitional period?</h4>
No, the revised DPA will not provide for a general transitional period. It will apply going forward as from its entry into force, with limited exceptions (e.g., in respect of ongoing proceedings, and the application of the principle of privacy-by-design).
<h4>How do companies prepare for the new DPA?</h4>
For businesses that have already implemented GDPR compliance, only limited changes are to be expected. For instance, they may have to review and update their documentation – such as privacy policies – to address the DPA requirements, extend their inventories to cover Swiss processing activities that were previously carved-out, and implement processes to comply with Swiss data breach notification obligations.
For businesses that have not yet complied with the GDPR, major implications are to be expected. In particular, they will have to review their data protection organization, governance and documentation, and their agreements with third parties.
In particular, the following steps and activities are to be considered in view of the new DPA:
<ul>
<li>Review the organization. Consider establishing a data protection competence center for governance purposes and as internal and external point of contact for related questions.</li>
<li>Identify and document processing activities. Understanding and documenting processing activities is key to enable an appropriate data protection governance. This applies even if there may not be a formal obligation to maintain an inventory, as may be the case for small and medium companies.</li>
<li>Assess compliance of the processing activities. Check whether the requirements under the new DPA will be complied with. If not, implement necessary changes. Prioritize high risk processing activities and non-compliances that may have a high impact.</li>
<li>Implement appropriate processes. Assess whether appropriate processes are in place to deal with data subject rights. There is no need to have a formal process in all circumstances, but processes should facilitate compliance. For instance, companies need to be in a position to adequately deal with data subject rights and data breach notification obligations.</li>
<li>Update relevant documentation. For a large part, data protection compliance relies on up-to date and appropriate documentation. For instance, privacy policies need to be in place to inform employees, business partners and the public about processing activities, cross-border transfers may have to be secured by means of contractual arrangements with the data importer, and appropriate processor terms have to be implemented with third party processors. In view of the implementation of the revised DPA, this documentation needs to be reviewed and updated.</li>
<li>Review data security measures. Companies will continue to have to make sure that personal data is appropriately secured to avoid data breaches. Thus, security measures need to be reviewed and updated from time to time.</li>
<li>Consider whether a representative in Switzerland needs to be appointed. For certain foreign companies, the revised DPA will require the appointment of a representative in Switzerland.</li>
<li>Prepare for inquiries. The obligation to demonstrate compliance with the DPA rests upon data controllers. Thus, be prepared to answer inquiries from authorities and to demonstrate compliance.</li>
</ul>

Revision of the Swiss Federal Act on Data Protection

Corporate / M&A

Competition

Regulatory

IP / IT

Data Protection

Financing and Investment Products

Avaloq_bw

On December 22, 2020, Avaloq Group (Avaloq), a Swiss-based global leader in digital banking solutions, core banking software and wealth management technology, announced that Japan-based NEC Corporation (NEC, TSE:6701) had completed its acquisition of Avaloq. In the transaction, NEC acquired all outstanding shares from the existing shareholders, which includes the founders, current and former employees as well as private equity firm Warburg Pincus, at an enterprise value exceeding CHF 2 bn.
Homburger acted as global transaction counsel to Avaloq and the majority shareholders. The Homburger team was led by partner Heinz Schärer and included partner David Oser, associates Philippe Baumann and Angela Oppliger and junior associate Cédric Berger (all Corporate / M&amp;A), partner Marcel Dietrich and associates Allegra Arnold and David Waldmeier (all Competition, Regulatory), partners Georg Rauber and Luca Dal Molin and associates Valentin Fluor and Kirsten Wesiak-Schmidt (all IP / IT and Data Protection), partner Jürg Frick and associate Pierina Janett-Seiler (both Financing and Investment Products), as well as associate Marc Vogelsang (Tax).

Homburger advised Avaloq Group and majority shareholders in the completion of NEC Corporation's acquisition of Avaloq Group

Litigation

Liberty Global

On November 11, 2020, the all-cash public tender offer by UPC Schweiz GmbH (UPC), a subsidiary of Liberty Global plc, for all publicly held shares of Sunrise Communications Group AG (Sunrise) has been settled. UPC has acquired a 98% stake in Sunrise. The transaction values Sunrise’s equity at CHF 5.0 bn.
Homburger AG is advising Liberty Global on the transaction. The Homburger team is led by partners Daniel Daeniker and Daniel Hasler (Corporate / M&amp;A) and includes partners Richard Stäuber, Franz Hoffet (Competition, Regulatory), Stefan Oesterhelt (Tax), Luca Dal Molin (IP / IT) and Roman Baechler (Litigation), counsel Micha Fankhauser (Corporate / M&amp;A), associates Daniel Häusermann, Karin Mattle, Mirko Stiefel and Stefan Luginbühl (all Corporate / M&amp;A), Yves Bianchi, Ramin Gohari and Jonas J. Krull (Competition, Regulatory), David Borer and Pierina Janett-Seiler (Financing and Investment Products), Marc Vogelsang and Raphaël Fellay (both Tax), Kirsten Wesiak-Schmidt (IP / IT), as well as junior associates Cédric Berger, Géraldine Danuser, Daniel Madani (all Corporate / M&amp;A) and Urs Stürmer (Competition, Regulatory).

Homburger advises Liberty Global on successful settlement of public tender offer for Sunrise

On October 28, 2020, Winemaker World SA (Winemaker) launched its digital marketplace for wine connoisseurs and discoverers. The digital marketplace enables direct encounters between winemakers and wine lovers.
Winemaker&#8217;s first goal is to create an experience on winemaker.com that is as close as possible to a real visit to the wineries. Winemaker&#8217;s second goal is to significantly increase the share of direct sales of wine and thus create a platform for winemakers to find new customers.
Homburger AG acted as a legal counsel to Winemaker in connection with the setting-up of its business. The Homburger team was led by partners Claude Lambert (Corporate / M&amp;A), Luca Dal Molin (IP / IT) and Reto Heuberger (Tax) and included associates Karin Mattle (Corporate / M&amp;A), Laetitia Fracheboud (Tax), Kirsten Schmidt (IP / IT) and Francesco Bernasconi (Corporate / M&amp;A) and junior associate Vincent Croisier (Corporate / M&amp;A).

Kirsten
Wesiak-Schmidt

Homburger advised Avaloq Group and majority shareholders in the completion of NEC Corporation's acquisition of Avaloq Group

Homburger advises Liberty Global on successful settlement of public tender offer for Sunrise

Homburger advised Winemaker World in the set-up of its digital marketplace

Data Protection Day 2021

CJEU Decision in re Schrems II

Revision of the Swiss Federal Act on Data Protection

Switzerland: Data Protection Laws and Regulations

Datenschutz als Vermögensrecht

Datenmärkte ohne "Dateneigentum"

Join the Team

Kirsten Wesiak-Schmidt

Career

Languages

Bar Registration

Teams

KirstenWesiak-Schmidt

Homburger advised Avaloq Group and majority shareholders in the completion of NEC Corporation's acquisition of Avaloq Group

Homburger advises Liberty Global on successful settlement of public tender offer for Sunrise

Homburger advised Winemaker World in the set-up of its digital marketplace

Data Protection Day 2021

CJEU Decision in re Schrems II

Revision of the Swiss Federal Act on Data Protection

Switzerland: Data Protection Laws and Regulations

Datenschutz als Vermögensrecht

Datenmärkte ohne "Dateneigentum"

Join the Team

Kirsten Wesiak-Schmidt

Career

Languages

Bar Registration

Teams

Kirsten
Wesiak-Schmidt