17 September 2020 – On 17 September 2020, the National Council deliberated on the remaining differences of the revised Data Protection Act (revDPA) (see also our news in the past on this issue). The provisional text on the session and the voting results (Official Bulletin) may be accessed via the following link. The most recently published flag with the motions of the National Council's Political Institutions Committee dated 2 July 2020 may be found here.

In view of the current status, differences have been resolved on the following issues:

• The National Council follows the Federal Council's initial proposal that all genetic data shall be considered sensitive personal data (Article 4 lit. c no. 3 revDPA)
• Pursuant to the majority of the National Council, no explicit right of objection to profiling shall be introduced, thereby abandoning the minority motion submitted to the Political Institutions Committee in July (cf. Article 5 para. 8 revDPA in the flag dated 2 July 2020).
• Pursuant to the majority of the National Council, the Council of States' concept of high-risk profiling (Article 4 lit. fbis revDPA) shall be deleted. A minority of the National Council adheres to the Council of States' decision dated 2 June 2020 and wishes to retain this concept.
• Potentially required consent shall only be expressly given when processing sensitive personal data but not – as the Council of States demands – also in case of profiling by federal authorities and, if applicable, for high-risk profiling by private persons (Article 5 sect. 7 revDPA).
• no sensitive personal data is processed (the Council of States would also like to omit such an interest in case of high-risk profiling); and
• the personal data that is processed is not older than ten years (the Federal Council and the Council of States advocate for five years).

However, differences on most issues have still not been resolved:

With regard to verifying creditworthiness, the National Council adheres to its justification concept (Article 27 para. 2 lit. c revDPA) and deviates from the stricter approach pursued by the Federal Council and the Council of States. According to the National Council, an overriding private interest of the responsible data processor shall be assumed if:

The flag with the National Council's final decision will be made available here after its publication. According to the session programme, the DPA is already on the agenda for the Council of States' session on 23 September 2020. The National Council has set another deliberation on its programme for 24 September 2020. However, it is still unknown to what extent the National Council will re-deliberate the DPA.