1 September 2019 – The National Council’s Political Institutions Committee (PIC-NC) conducted its preliminary examination of the draft Data Protection Act (draft DPA). The press conference revealed that the PIC-NC did not adhere to all the proposed provisions

On 15 September 2017, the Federal Council published the draft DPA (see our news “The Swiss Federal Council publishes the draft of the revised Swiss Federal Data Protection Act” on 15 September 2017). The National Council’s Political Institutions Committee (PIC-NC) has now finalized its preliminary examination of the draft DPA.

The PIC-NC announced on Friday, 16 August 2019 that the preliminary examination resulted in several changes to the draft DPA. The draft DPA with the changes proposed by the PIC-NC has been published on Parliament’s website under a comparative report (available in German or French, but not in English). The amended draft DPA will be submitted to the National Council for its final vote in the autumn session. The Council of States (Swiss Parliament’s second chamber) will subsequently conduct its own examination of the draft DPA. In order for the revised DPA to pass, both Councils must agree on its content and wording.

The PIC-NC's preliminary examination led in particular to the following results:

• Appointment of the Federal Data Protection and Information Commissioner (FDPIC). The majority of the PIC-NC members advocated changing the competence of the FDPIC election system: instead of the FDPIC being appointed by the Federal Council with the approval of the Federal Assembly, he or she shall be directly elected by Parliament (Article 39 of the draft DPA as amended by the PIC-NC). The new system is supposed to guarantee a greater independence of FDPIC staff.
• Right to data portability. The Federal Council refrained from introducing a right to data portability in the draft DPA on the grounds that such right could be very costly, particularly for companies with more than 50 employees which would have to hire additional staff. In contrast to the Federal Council, the PIC-NC opted to introduce a right to data portability (Article 25a introduced by the PIC-NC). Nevertheless, the controller is entitled to refuse, restrict or defer the right to data portability for the same reasons as those provided for in Article 24(1) and (2) of the draft DPA (Article 25a introduced by the PIC-NC).
• Sensitive data. The PIC-NC decided to remove trade union related data as well as social security measures data from the list of personal data that qualifies as sensitive personal data (Article 4 of the draft DPA as amended by the PIC-NC).
• Foreign companies. Foreign companies providing services in Switzerland will have to comply with the DPA and appoint a representative in Switzerland, who would be in charge of keeping an inventory of the processing activities containing the information referred to in Article 11, para. 2. 2 of the draft DPA (Articles 12a and 12b introduced by the PIC-NC).
• Data on deceased persons. The PIC-NC decided to eliminate from the draft DPA specific provisions on the processing of personal data pertaining to deceased persons (Article 16 of the draft DPA deleted by the PIC-NC).
• Stricter criminal sanctions. As regards criminal sanctions, the PIC-NC followed the Federal Council's proposal to strengthen criminal sanctions (criminal fine of up to CHF 250,000 according to Article 55 et seq. of the draft DPA).

However, the PIC-NC also put forward a postulate inviting the Federal Council to examine the possibility of introducing a general regime of administrative monetary penalties into Swiss law (see Postulate 18.4100, available in German, French and Italian, but not in English).

• Entry into force. According to the PIC-NC’s decision, the revised DPA shall enter into force 2 years after the end of the referendum period if no referendum takes place or 2 years after acceptance by popular vote in case of a referendum (Article 69 of the draft DPA as amended by the PIC-NC).

In a nutshell and while the PIC-NC follows to a very large extent the propositions of the Federal Council, it must be noted that some of the amendments introduced by the PIC-NC will certainly lead to further discussions. This is particularly true in respect of the right to data portability and the obligation for foreign companies providing services in Switzerland to appoint a representative in Switzerland. In fact, these amendments will put an additional burden on companies operating in Switzerland. It remains to be seen and closely followed which changes will make it through the parliamentary process and finally be adopted.

The PIC-NC’s press release is available in German, French or Italian.

An unofficial English version of the draft DPA drawn up by the Federal Council and dated 15 September 2017is available on our website.