Data Protection Compliance Under Swiss Dpa .
1. Legal Framework
Old: Federal Act on Data Protection 1992
New: Federal Act on Data Protection of 25 September 2020 (nFADP) + Data Protection Ordinance DPO - entered into force on 1 September 2023. Main goal was to adapt Swiss law to changed technological conditions and improve transparency and strengthen rights of data subjects.
Who it applies to: Private persons and federal bodies processing personal data. Territorial scope: "This Act applies to circumstances that have an effect in Switzerland" - even non-Swiss companies that do business in Switzerland must comply. Cantonal banks are under cantonal DPA.
Authority: FDPIC - Federal Data Protection and Information Commissioner. A Federal Data Protection Agency has been set up to implement the new Act, headed by FDPIC and among other things requires reporting of incidents involving data privacy issues including from financial sector. FINMA is exempt with regard to its supervisory activities, though act applies to processing of data related to their own employees.
2. Core Changes vs Old Law - Critical for Banks
| Old FADP | nFADP 2023 |
|---|---|
| Registration of data files | Accountability Art. 7 nFADP - no registration, must prove compliance |
| No mandatory breach reporting | Art. 24 nFADP - Mandatory reporting to FDPIC as soon as possible if breach likely to result in high risk to personality or fundamental rights |
| Sensitive data loosely defined | Genetic data, biometric, now explicitly sensitive |
| No DPIA | Art. 22 nFADP - DPIA mandatory for high-risk processing (large-scale profiling in banking) |
| Weak sanctions | Fines up to CHF 250,000 - personal liability of responsible employee, not company |
| No data portability | Right to data portability under certain circumstances - data subject can request data in common electronic format |
Key principle: Swiss law follows "default prohibition, case-by-case approval" model for cross-border financial data transfers, stricter than GDPR.
3. Principles - Art. 6 nFADP
- Lawfulness, Good Faith, Proportionality
- Purpose Limitation - banking data collected for account opening cannot be reused for AI credit scoring without new basis
- Transparency - Privacy notice mandatory at collection
- Data Minimization
- Accuracy
- Storage Limitation
- Security - Art. 8 nFADP mandates TOMs (Technical and Organizational Measures)
4. Banking-Specific Compliance
A) Privacy by Design - Art. 7: Banks must embed data protection in CBS, YAPEAL, UBS Red platform. FINMA requires absolute data sovereignty within Swiss borders.
B) Cross-Border Transfer - Art. 16-18 nFADP: Transfer only if:
- Adequacy decision (EU Member States are adequate for Swiss purposes),
- SCCs, Binding Corporate Rules, or
- Consent / performance of contract.
US is NOT adequate. Federal Data Protection Act prohibits any transfer if in country of recipient there is no data protection comparable to Swiss. US regulations are deemed insufficient even with Privacy Shield certification. For banks sharing with US DOJ, need public interest exception.
C) Breach Notification - Art. 24: Two tracks:
- FDPIC: If high risk, report ASAP via portal. Report must include nature, categories, measures. If breach occurs on processor's premises, processor must notify controller ASAP.
- FINMA: Swiss financial institutions licensed under financial market regulations are subject to yet another reporting obligation - to FINMA + NCSC under revISA. New Art. 24(5bis) allows FDPIC to forward breach reports to BACS if controller agrees.
D) Records of Processing Activities - Art. 12 DPO: Mandatory for any automated processing of sensitive data on large scale or high-risk profiling - typical for banks.
5. Data Subject Rights Under nFADP
- Art. 8 Right to Information: Any person may request information as to whether data concerning them is being processed. Under nFADP, controller may refuse, restrict or defer if request is manifestly unfounded or obviously querulous. Must choose most favourable solution for data subject.
- Right to data portability: Under certain circumstances, data subject has right to data portability - e.g., get transaction history in CSV.
- Right to object, erasure, rectification
6. Landmark Case Laws
1. Swiss Federal Supreme Court 2015 - US Tax Dispute - Article 8 Right of Access
In 2015 the Swiss Federal Supreme Court issued a noteworthy decision on right of access in connection with tax dispute between certain Swiss banks and US. Based on right of access set forth in Article 8 FADP, court obliged a Swiss bank to provide its employees with copies of all documents transferred to US Department of Justice in April 2012 containing their personal data. Principle: Bank secrecy does NOT override employee's data protection rights when bank transfers personal data abroad.
2. Federal Supreme Court 18 Nov 2020 - Information Request
On November 18, 2020, Swiss Federal Supreme Court clarified its previous case law on information requests under Article 8 FDPA. Any person may request information from owner of data file as to whether data concerning them is being processed. Set limits - no fishing expeditions.
3. Google Street View - 138 II 346
Federal Supreme Court held Swiss law applicable and requested Google to take necessary measures to anonymize before publication. Found that scope of application of FADP includes anonymization of persons and distinctive signs like car number plates. Applied to banks using CCTV in branches.
4. Logistep - 136 II 508
Decision recognised that IP addresses are personal data. Critical for e-banking log analysis.
5. Federal Administrative Court 2024 - First Art. 24 Breach Decision
Swiss Federal Administrative Court has recently issued first judicial decision interpreting Article 24 FADP, which governs notification of data security breaches. FAC clarified threshold of "high risk" - risk assessment must be done during or immediately after breach, and controller must notify if high risk exists or cannot be ruled out.
6. Julius Baer / Elmer Case - Banking Secrecy vs Data Protection
Federal Supreme Court by 3-2 majority upheld pursuit of data leak. Elmer, who headed Cayman office of Swiss private bank Julius Baer, sent documents with details of alleged tax evasion to WikiLeaks. Case underscored how Swiss authorities continue to pursue people who leak client data even as strict banking secrecy erodes.
7. Sanctions
- FDPIC opened 26 preliminary enquiries and investigations under new law, of which seven had been concluded as of Nov 2024 report.
- Fines: Up to CHF 250,000 on responsible individual - CEO, DPO, relationship manager - not bank entity. For intentional violations: failure to inform, to provide information, to report breach, to do DPIA.
- FINMA can order disgorgement, license withdrawal.
Compliance Checklist for Bank under nFADP:
- Map all personal data flows + international transfers
- Update privacy notices with Art. 19 info + TOMs
- Implement DPIA for AI scoring, large-scale profiling
- SCCs + Transfer Impact Assessment for any US cloud
- 72-hour internal breach triage + FDPIC + FINMA notification process
- Data portability API for transaction data
RELATED Blog
comments