Collection and processing in Switzerland
Data Processing Principles and Duties
The following principles apply to the collection and processing of personal data:
- Personal data may only be processed lawfully, in good faith and in accordance with the principle of proportionality.
- The collection of personal data and, in particular, the purpose of its processing must be evident to the data subject. In addition, the FADP imposes the following duties on controllers:
- a duty to inform the data subject about the collection of personal data similar as under the GDPR, with the list of minimum information being shorter, but drafted more openly and in a non-exhaustive manner (however, the FADP goes beyond the GDPR in that it requires the controller to specify all countries to which personal data is transferred, or from which it is accessed, and to provide some additional information in this context);
- under certain circumstances a duty to inform the data subject about decisions based solely on automated processing that have legal consequences or significant impact on the data subject (automated individual decision).
Wilful violations of the information duty may be subject to sanctions (see here).
- Personal data should only be processed for a purpose that is indicated or agreed at the time of collection, evident from the circumstances at the time of collection, and/or provided for by law.
- The controller and any processor must ensure that the data processed is accurate.
- Personal data must not be transferred abroad if the privacy of the data subject may be seriously endangered (see here).
- The controller must design the processing in technical and organisational terms to comply with data protection law, in particular the (other) data processing principles (privacy by design). Furthermore, the controller is obliged to ensure by means of suitable default settings that the processing is limited to the minimum required for the respective purpose (privacy by default).
- Personal data must be protected from unlawful and unauthorized processing by appropriate technical and organisational measures.
- Personal data must not be processed against the explicit will of the data subject, unless this is justified by:
- an overriding private or public interest; or
- Sensitive personal data must not be disclosed to a third party, unless this is justified by:
- the consent of the data subject (which must be given expressly in addition to being voluntary and based on adequate information);
- an overriding private or public interest; or
- Personal data shall be destroyed or anonymized as soon as it is no longer required for the respective processing purpose.
The FADP imposes on the controller a duty to conduct a data protection impact assessment if the processing may constitute a high risk for the personality or the fundamental rights of the data subject (particularly when new technologies are used) and also defines specific cases where a data protection impact assessment may be necessary, including in the event of processing sensitive personal data on a large scale and systematic surveillance of extensive public areas. The FDPIC generally needs to be consulted if the data protection impact assessment shows that the processing presents a high risk for the personality or fundamental rights of the data subject despite the measures envisaged by the controller.
Rights of the Data Subject
Data subjects enjoy certain rights to control the processing of their personal data:
Right of access
A data subject is generally entitled to request access to, and obtain a copy of, his or her personal data that is being processed (i.e. the personal data as such), together with prescribed information on the identity and contact details of the controller, the purpose of processing, as well as the period of storage of the personal data (or the criteria used to determine the period) and the available information about the source of the personal data, if it has not been collected from the data subject. If applicable, the data subject is also entitled to be informed about the existence of an automated individual decision and the logic on which this decision is based as well as the recipients (or categories of recipients) to which the personal data is disclosed. In case of cross-border data transfer, the destination country and the implemented guarantee (if applicable) shall also be provided to the data subject. There are certain exceptions, e.g. a data controller may invoke its own overriding interests, however, only if it does not disclose the personal data to third parties (whereby companies controlled by the same legal entity are not considered third parties).
Wilful violations of data subject access rights by giving incomplete or wrong information are subject to sanctions (see here).
Right to rectify / Right to erasure / Right to restriction of processing / Right to object
The data subject may request that inaccurate personal data concerning him or her be corrected. Taking into account the purpose of the processing, he or she may also request that incomplete personal data be completed. This right is, however, restricted to the extent that a legal provision prohibits the modification or the personal data is processed for archival purposes in the public interest.
If the personal data is processed unlawfully and there is no justification (i.e. consent, overriding private or public interest or legal basis), the personal data must be deleted or destroyed. Under such circumstances, the data subjects may also request that the data processing be prohibited or restricted or they may object to the processing in question.
Right to data portability
Data subjects may request the controller to deliver the personal data that they have disclosed to it in a conventional electronic format if the controller is carrying out automated processing of the data and if the personal data is being processed with the consent of the data subject or in direct connection with the conclusion or the performance of a contract between the controller and the data subject. In addition, the data subject may request the controller to transfer the personal data to another controller if the aforementioned requirements are met and no disproportionate effort is required. There are certain exceptions, e.g. a data controller may invoke its own overriding interests, however, only if it does not disclose the personal data to third parties.
