What is FADP? Since 2018, companies operating within the European Union or processing data of European citizens have been required to comply with the General Data Protection Regulation (GDPR).
In the same spirit, Switzerland has established its own regulations: the Federal Act on Data Protection (FADP) , a complex and demanding legislation that regulates the collection, processing and storage of personal information by companies based in Switzerland or processing the data of Swiss citizens.
This text, which came into force on September 1, 2023, aims to guarantee the confidentiality and security of personal information while establishing clear responsibilities for organizations that process this data.
The LPD was created to protect the privacy of individuals and regulate how companies handle personal data, thus aligning with current European regulations.
Although the two texts (GDPR and LPD) have similarities, each legislation has its own specificities and nuances.
The Federal Act on Data Protection ( FADP ) contains the cross-sectoral rules that must generally be observed when processing personal data. Personal data, as defined by the FADP, includes all information relating to an identified or identifiable natural person. Health data, and therefore the genetic data of identified or identifiable individuals, are by definition particularly sensitive personal data and must be protected.
When dealing with pseudonymized, i.e., encrypted, data, personal information
can no longer be attributed to a specific individual without using the decryption key. However, since the individual remains identifiable through this key, the processing of pseudonymized data is subject to the Swiss Federal Act on Data Protection (FADP). Only irreversibly anonymized personal data falls outside the scope of the FADP.
The LPD defines the fundamental principles and requirements to guarantee the lawful processing of personal data:
Principle of transparency: all data processing must take place in a transparent manner.
Purpose limitation principle: the data collected should only be used for purposes that are obvious to the data subject; the data should only be collected, stored, disclosed and processed to the extent that these purposes require it.
Consent to data processing: when data processing requires the consent of the data subject, such as in the context of research on human beings, this consent will only be legally valid if it has been given freely, on the basis of appropriate information, and explicitly if it concerns particularly sensitive data.
Right to withdraw consent: consent to data processing can be withdrawn at any time by the data subject.
Data security: Personal data must be protected against unauthorized processing by appropriate technical and organizational measures.
Right of access: every person has the right to request from the data controller information on the processing of data concerning them.
Obligation to inform: The data controller is obligated to inform the data subject about the acquisition of particularly sensitive personal data. This obligation to inform also applies to data collected by third parties.
Cross-border disclosure: personal data must not be disclosed abroad if this would entail a serious risk to the personality rights of the persons concerned.
It should be noted that the current Federal Act on Data Protection (FADP) is under review. From the Federal Council’s perspective, a revision is necessary, firstly, because the current legislation is no longer suited to the rapid pace of technological developments, and secondly, to bring Swiss data protection law more closely into line with EU law, particularly the GDPR. The FADP must be adapted to new technological and social conditions in order to improve, in particular, the transparency of data processing and strengthen the autonomy of data subjects regarding their data.
The completely revised Federal Data Protection Act (FDPA) proposal includes, among other things, a restriction on the research privilege regarding data protection. While the disclosure and transmission (particularly to universities or research groups) of personal health data are covered by public or private interest and thus justifiable under the current FDPA, the revised FDPA proposal restricts this possibility. Research interest will henceforth only be considered a justification for the transmission of personal data under strict conditions; consequently, in many cases, the consent of the individuals concerned will be required.
Health data will continue to be considered particularly sensitive personal data. The revised FDPA also expressly includes “genetic data” and “biometric data.” Legal practice in specific cases therefore requires aligning the FDPA with the Human Resources Act (HRA) and the General Act on Health Data (GAHD). This alignment will not always be easy, particularly with regard to information obligations and mandatory consent rules, which are of particular importance with respect to health data.
- What is the LPD?
- The main requirements of the LPD for businesses
- How to ensure the protection of personal data in accordance with the Swiss Federal Act on Data Protection (FADP)? Concrete implications for businesses
- Why Swiss companies have every interest in complying with it
- The importance of the External Data Protection Advisor in achieving compliance with the Data Protection Act
What is the LPD?
The Federal Act on Data Protection (FADP) forms the cornerstone of personal data protection and security in Switzerland. It governs how companies and organizations manage, process, and safeguard the personal information of their customers and partners.
The Data Protection Act (LPD) was established to protect individuals’ privacy by ensuring that their personal data is neither compromised nor used for illegitimate purposes. It requires companies to take specific measures to ensure information security.
In other words, the LPD establishes standards and norms to be respected in terms of transparency and data security, respect for fundamental rights to privacy and data protection.
This means that Swiss companies are required to implement exemplary data management practices, not only to avoid heavy fines associated with violations, but also to actively protect their company’s reputation.
The application and compliance with the Federal Data Protection Act (FDPA) is monitored by the Federal Data Protection and Information Commissioner (FDPIC). The FDPIC is the federal supervisory authority in Switzerland for data protection (the equivalent of the French CNIL ).
It has jurisdiction over matters relating to data protection at the national level.
Its primary role is to monitor and regulate data protection issues at the federal level, provide guidance to businesses and organizations, handle complaints from individuals, initiate investigations into non-compliance, and impose sanctions.
The main requirements of the LPD for businesses
In concrete terms, what does this new regulation imply? To answer this question, we need to look at the 8 guiding principles of the LPD.
Indeed, all companies must observe, with regard to their use of citizens’ personal data, the principles of lawfulness, good faith, proportionality, purpose limitation, accuracy, transparency, security and respect for the rights of the persons concerned.
First, companies must comply with the principle of lawfulness , as stipulated by the Swiss Federal Act on Data Protection (FADP). This means that all processing of personal data carried out by organizations subject to the FADP must comply with its provisions.
Companies must respect the principle of good faith , which is an essential component of the Federal Data Protection Act. This principle requires companies to act fairly and honestly when collecting and processing personal data.
For example, when a Swiss company obtains an individual’s consent to use their data for specific purposes, it must act transparently and not knowingly deviate from the original objective.
Therefore, companies must adhere to the principle of proportionality , collecting only the data strictly necessary for the specific purpose for which it was obtained. An e-commerce website, for example, should not request more information than is essential to complete a transaction.
Companies must respect the principle of purpose limitation , which implies that personal data should only be collected for specific, explicit and legitimate purposes.
For example, an online commerce site must collect data such as delivery address and payment information only for the purpose of processing and delivering orders, thus ensuring that the data is used in a manner consistent with the original purpose.
Companies must also ensure they obtain accurate data on the individuals concerned .
For example, data accuracy is a critical component of banking data security. It ensures that transactions are recorded correctly, helps prevent fraud, protects sensitive information, and ensures compliance with security standards.
The LPD requires the collection of personal data in a transparent manner and with the consent of individuals, which means that companies must clearly explain how this data will be used.
For example, an online booking platform should inform customers that their data will be used to confirm bookings and not for other purposes.
Furthermore, companies must guarantee data security by adopting protective measures against potential breaches. For example, if an organization processes sensitive data, it must ensure that the data stored on its servers is encrypted.
Finally, the LPD stipulates that individuals have the right to access their data and correct it if necessary.
Respecting these principles and implementing the Federal Data Protection Act (DPA) requires a methodical approach for the companies concerned.
The LPD, by emphasizing security and the rights of individuals, forces companies to rethink their approach to managing personal data.
How to ensure the protection of personal data in accordance with the Swiss Federal Act on Data Protection (FADP)? Concrete implications for businesses
What are the material and concrete implications of complying with the LPD for businesses?
Having the right resources: investing in security and the right tools
Compliance with the Data Protection Act begins with the allocation of adequate resources. Companies must have the necessary tools, technologies, and personnel to ensure compliance.
This often involves investments in staff training and in the choice of software adapted to the management and protection of personal data (essential tools for successful and sustainable compliance).
This often also involves investments in data security, such as the implementation of firewalls, intrusion detection systems, and other protective measures.
Appoint a person responsible for compliance
Appointing a competent compliance officer is crucial. This person is responsible for ensuring that the company complies with the provisions of the Data Protection Act.
She ensures that policies and procedures are in place, monitors potential breaches and coordinates the response in the event of a data protection incident.
This expertise is an essential component of compliance with the LPD.
Raising awareness and training employees
Raising awareness of compliance with the LPD is essential at all levels of the company.
Employees must understand the importance of data protection and be trained in best practices for managing personal data.
A company culture focused on data privacy and security is a major asset. Especially when 78% of cybersecurity incidents stem from human error!
Selection of subcontractors and partners
Companies must also be careful in choosing their subcontractors and partners.
Contracts involving the processing of personal data must clearly stipulate the obligations regarding data protection.
Third parties with whom you share data must comply with the same data protection standards as you.
Documentation
Documentation is also essential for compliance with the LPD. Companies must maintain detailed records of all activities related to the use, collection, or storage of personal data.
This may also include maintaining consent records, data protection impact assessments, and security incident reports.
Compliance with the LPD is not only a legal obligation, it is also an opportunity to strengthen customer trust and thrive in an environment where data protection is crucial.
Why Swiss companies have every interest in complying with it
Now that the outlines and objectives of the LPD have been defined, let us explore how and why Swiss companies have every interest in complying with it proactively.
Compliance with a legal obligation
Compliance with the Data Protection Act (LPD) is first and foremost a legal obligation . Complaints, formal notices, and sanctions can have serious consequences, and fines for non-compliance can be substantial.
By complying with its provisions, Swiss companies avoid costly litigation and severe penalties, which constitutes significant financial protection.
Risk management
Data security is a fundamental aspect of LPD compliance. Many standards refer to technical and organizational security measures.
Being compliant allows for better risk management and better prevention of cyberattacks.
Protecting your data is also, but above all, about protecting your business, your reputation, your capital and ensuring its sustainability.
Trust from customers and partners
Compliance with the Federal Data Protection Act is not only a legal obligation, it is a vital investment in the trust and credibility of your business .
By implementing robust data protection practices, you strengthen customer trust, avoid media scandals and reputational damage, ensure legal compliance, and gain a competitive advantage in a climate of growing distrust towards the management of personal data.
Furthermore, this demonstrates your commitment to ethics and responsibility, thereby strengthening your position as a trusted player in the market.
In short, compliance with the LPD is a strategic investment for the sustainability of your business.
Competitive advantage
Compliance with the Data Protection Act (LPD) is a major competitive advantage . Your company will be perceived as a safe place for personal data, thus attracting new customers and partners.
Compliance with the LPD becomes a distinctive advantage that strengthens the trust and attractiveness of your business.
It allows you to stand out in the market by showing that you attach particular importance to the protection of your customers’ data, thereby creating opportunities for growth and business development.
The importance of the External Data Protection Advisor in achieving compliance with the Data Protection Act
FADP Compliance with the Federal Data Protection Act is a major concern for companies keen to be fully compliant and in compliance with the law.
In this context, the role of the external data protection advisor is crucial. This professional provides essential expertise to help companies comply with the provisions of the Swiss Federal Act on Data Protection (FADP).
What is a Data Protection Officer?
The data protection advisor, also known as Data Protection Officer (DPO) , is a professional specializing in the management and protection of personal data within a company.
Although the appointment of an external personal data advisor is left to the discretion of the company, except for public authorities for whom it is mandatory, it is strongly recommended to consider integrating a DPO within the organization.
The functions of the data protection officer are varied and crucial to ensuring compliance with data protection regulations and information security. Among their main responsibilities are:
- Compliance supervision : The DPO is responsible for ensuring that the company complies with the provisions of the LPD.
- Advice and Awareness : The data protection advisor provides advice and information to company employees on best practices in data protection, thereby contributing to a culture of respect for privacy within the organization.
- Request management : It handles requests from individuals regarding their personal data, including requests for access, rectification, and deletion.
- Risk assessment : The Data Protection Officer (DPO) plays a crucial role in assessing data protection risks within the organization. By identifying potential vulnerabilities and threats that could compromise the confidentiality of personal data, the DPO establishes a rigorous assessment framework. This assessment extends not only to detecting existing risks but also to preventing future ones.
- Audits and controls : It regularly conducts internal audits to ensure that the company’s policies and procedures comply with data protection standards.
- Incident Management : In the event of a data breach, the DPO plays a key role in incident management, including informing the relevant authorities and affected individuals.
- Collaboration with authorities : He acts as a point of contact with data protection authorities, ensuring smooth communication when needed.
- Continuing education : The DPO keeps himself constantly informed of legislative and technological developments in data protection and ensures that the company adapts accordingly.
In summary, the data protection officer is a key player in preserving the confidentiality of personal data within a company. They provide valuable expertise to ensure legal compliance, data security, and privacy protection, thereby helping to strengthen the trust of customers and partners.
Why choose an external Data Protection Officer ?
Compliance with the Data Protection Act (DPIA) is not limited to simply implementing privacy policies. It is a proactive process that requires time, availability, and specialized skills.
Companies must implement measures such as data classification, access management, data encryption, staff training, internal documentation, incident management and notification, etc.
The external advisor, as an expert in the field of data protection, is able to guide the company in implementing these crucial measures while ensuring compliance with the LPD.
A crucial aspect of the relationship with an external personal data advisor is the absence of conflict of interest .
It is imperative that the advisor be impartial and have no subordinate relationship and/or influence regarding the determination and implementation of a treatment that could conflict with the company’s compliance objectives.
This impartiality ensures that the advice and decisions taken are based on best practices in data protection.
Given the increasing complexity of the LPD, the most sensible choice for many companies is to outsource this task to a specialist LPD compliance firm.
These experts possess in-depth knowledge of data protection regulations and the practical realities faced by organizations.
They can not only advise on compliance, but also assist with the implementation of specific measures, security incident management, staff training, and much more.
Outsourcing to a specialist compliance firm is increasingly recognized as a wise option for full compliance, offering the company peace of mind and confidence in the management of its personal data.
What are the risks of non-compliance with the LPD?
Non-compliance with the Federal Act on Data Protection (FADP) in Switzerland carries a number of significant risks for companies.
Non-compliance can be penalized by the Data Protection Authority (DPIA) with the suspension of processing, an activity, or even the closure of a site. These are dramatic consequences, yet easily avoidable!
Financial penalties can be particularly severe. In the event of a breach of data protection rules, a company risks fines of up to 250,000 Swiss francs.
It is essential to note that these financial penalties can also be assigned to the data controller as a natural person, meaning that managers and officers within the company can be held personally liable.
These financial penalties can have a considerable impact on a company’s financial health.
Furthermore, non-compliance can lead to significant damage to a company’s reputation, and have consequences for the trust of customers and business partners.
Data protection authorities have the power to make violations public, thereby exposing the company to negative media exposure.
Furthermore, non-compliance can lead to the loss of clients and contracts, as organizations and clients are concerned about the protection afforded to personal data, and will therefore choose an organization promising a high level of protection.
Read More GDPR and Brazilian Data Protection act
