17 August 2020 – As already commented in the past (see particularly our last News), the Federal Act on Data Protection (DPA) is currently under revision. It has been deliberated in the Swiss parliament in a first round but there are still some open issues on which parliament has not yet come to an agreement. Thus, a second round is necessary to deliberate these remaining differences in order to complete the final draft.

On 12 August 2020, the National Council’s Political Institutions Committee (PIC-N) published its proposals of 2 July 2020 to be deliberated in the second round by both chambers of parliament. The respective wording is available in German and French.

The proposals relate to the following issues:

• High-risk profiling (Article 4fbis draft DPA): A majority of the PIC-N requests that the provision and thus the concept of high-risk profiling be completely deleted, whilst a minority declares itself to be in favour of the Council of States' wording.
• Requirement of express consent (Article 5 para. 7 draft DPA): The majority of the PIC-N still adheres to the National Council’s resolution of 25 September 2019, according to which consent – if required – must only be expressly given when processing sensitive personal data.
• New proposal for an explicit right to object to profiling (Article 5 para. 8 draft DPA): A minority of the PIC-N requests the incorporation of an explicit right to object to any form of profiling, according to which the data subjects must be informed of the profiling in each case. The data may then not be further processed unless, in the case of increased risk, compelling reasons worthy of protection require further processing. The data subject must also be notified of the decision on further processing and the reasons for doing so.
• Processing of personal data in order to verify creditworthiness as a justification (Article 27 para. 2 lit. c draft DPA): The majority of the PIC-N still adheres to the National Council’s resolution of 25 September 2019 stating that a private interest of the person responsible is given provided that no sensitive personal data worthy of protection is processed. The minority proposal now follows the Council of States’ wording, according to which a justification in the mentioned context is only given if there is neither sensitive personal data nor high-risk profiling. With regard to the age of the data, the minority proposal also follows the Council of States’ wording, according to which the data processed in this context should not be older than five years. The majority of the PIC-N still adheres to the data age of ten years.

Deliberations in the National Council are expected to take place in the coming autumn session (7 - 25 September 2020). After the National Council has made its decision, the draft will be discussed by the Council of States. Should the remaining issues not be resolved in this second deliberation phase, a third round on the resolution of differences between the two chambers of parliament will take place.