Swiss-US Privacy Shield: new legal framework for the transfer of data to the USA

11.01.17 - At its meeting today, the Federal Council took note that a new framework, Privacy Shield, has been established for the transfer of personal data from Switzerland to the USA. Privacy Shield replaces the Safe Harbor Agreement between Switzerland and the USA, which the FDPIC had declared inadequate and which the Federal Council has now formally terminated. The FDPIC welcomes the introduction of the new framework.

Privacy Shield substantially improves the position of those concerned in Switzerland, especially in the commercial sector. The changes include the stricter application of data protection principles by participant companies and improved management and supervision of the framework by the US authorities. Persons concerned are given specific instruments to enable them to find out directly from certified US companies or the competent authorities about data processing and to ensure that any required corrections or deletions are made. People can also indirectly influence the processing of their data by the US security services via an ombudsman procedure. In addition, the US authorities have given assurances that they will act to enforce and evaluate the new instruments.

Cooperation between the US Department of Commerce (DOC) and the FDPIC will be intensified, and the FDPIC will act as a point of contact for persons in Switzerland in the event of any problems in connection with the transfer of data to the USA. Following finalisation of Privacy Shield, US companies can start the certification process with the DOC within a 3-month period, during which the FDPIC will not undertake enforcement actions. The DOC will then publish a list of all certified companies on its website. The FDPIC will provide a link to this list and to all the relevant documents on its website as soon as this information is available.

With the introduction of Privacy Shield, the same standards apply for Swiss exports of personal data to the USA as for data exports from the EU. This is fundamental to legal certainty in commercial transactions and in particular for the free exchange of data between Switzerland and the EU - especially in the commercial sector.

The FDPIC considers that the new framework guarantees an adequate level of data protection. He has approved the level based on the wording of the Swiss-US Privacy Shield and has ammended his list under Art. 7 of the Ordinance to the Data Protection Act for the benefit of companies certified in this connection. However, he has stressed the importance of developments in practices and the legal position. Accordingly, the FDPIC has reserved the right, following the annual evaluations of Privacy Shield, to revise the list if he regards this as appropriate in view of his assessment of actual implementation. In his appraisal, he will take account of court judgments in Switzerland and in the EU.