New EU data protection law: legal situation for Swiss companies
Why is there a new European data protection law?
MICHÈLE FORSTER Since the dawn of the digital age, there has been an increasing focus on protecting citizens' personal data. Everyone who surfs the Internet, communicates on social networks or shops online automatically leaves a data trail. Many companies - above all Internet giants such as Facebook, Google or Amazon - act as active data collectors in order to optimize their own business models with increasingly detailed information about their users and customers. The new European data protection law aims to expand the rights of EU citizens with regard to the control of their personal data. For companies, access to personal data is to become more difficult.Key innovations include, for example, the fact that Internet users will in future be able to demand that processors delete their personal data and report data protection violations to the data protection authority in the EU country in which they reside - the latter even if the perpetrator of the violation is located outside the EU. For companies, it follows that they must face new challenges with regard to the quality, complexity and protection of personal data. As a general rule, the collection and processing of personal data must be based on the principles of lawfulness, purpose limitation, accuracy, storage limitation and data minimization, as well as consent, integrity and transparency.Data subjects have a full right of access to their data, can demand that their data be restricted or not processed, or can transfer their data to third parties. In addition, they will have a legal right in the future to ensure that decisions about personal matters are not based on automated data processing.
Which Swiss companies are affected by the GDPR?
MICHÈLE FORSTER The new EU data protection law has extraterritorial effect insofar as the data of citizens of the European Union are affected. It applies even if the processing of this data by the companies themselves or a processor does not take place in the EU, but in Switzerland, for example. The GDPR applies to data that is stored and processed to offer products and services to customers within the EU or to monitor them and analyze their purchasing behavior, for example.De facto, it affects all Swiss companies that hold data of individuals who reside in the EU. The size of the company and the existence of a branch in the EU do not play a role here. The only criterion for whether a company must comply with the GDPR in its data protection is whether personal data of EU citizens is processed. This may involve the data of customers, potential customers, employees and other personal data files. Differentiations according to the size of the company and thus advantages for SMEs only concern partial provisions such as the appointment of an internal data protection officer or the fulfillment of a complete documentation obligation.Economiesuisse" states that the law also applies to companies that use digital applications to examine the behavior of visitors to their website or users of smartphone apps. In addition, newsletter automations and interactive communication tools almost automatically generate data that also comes from international customers and site visitors. This affects the vast majority of Swiss SMEs and, in particular, marketing and communications agencies, which often hold large databases of EU citizens.
What do Swiss companies need to do in light of the new legal situation?
MICHÈLE FORSTER In the coming months, every Swiss company should clarify whether they are affected by the GDPR. If so, they must first get an overview of all the personal data they hold: What data do they have? How, where, by whom and why is it collected and processed? In addition, existing data protection measures and the corresponding processes must be documented, checked against the existing data protection regulations and gaps in their compliance identified.The next step is to take measures to implement the provisions of the new EU data protection law. The following procedures, which will be required by law in the future, are particularly important:Implementation of information requirements, for example through data protection declarations and obtaining consent for data processing.Examination of the content, organizational and technical basis of data processing, implementation of appropriate protective measures.Conclusion and adaptation of contracts with processors.The GDPR stipulates that processors may only operate on a contractual basis in the future. It must be examined whether they can provide sufficient guarantees for the legally compliant processing of personal data - for example, through a data protection seal or comparable certificates.Establish internal processes to ensure data subjects' rights to their data.This concerns in particular the right to information, access, rectification or deletion of personal data and the right to object to the processing of personal data.Implementation of processes in the event of data protection breaches.The new EU law stipulates that data privacy violations must be reported to the responsible supervisory authority within 72 hours in the future. If there is a high risk of personality violations through the use and processing of data, those affected must also be informed. This naturally also increases the risk of reputational damage for companies. It makes sense to include the topic of data protection comprehensively in the planning of companies' crisis communications.Ensure complete documentation of data processing.This is a mandatory requirement under the GDPR for all companies with more than 250 employees. Companies with fewer than 250 employees are exempt from this requirement if they only occasionally process personal data, no particular risks are associated with this and the processing does not relate to particularly sensitive personal data - for example, health data.Appointment of a data protection officer.In the future, a data protection officer must be active in all companies that hold data of EU citizens. Companies with more than 250 employees are required to appoint an internal data protection officer. In smaller companies, an external consultant can also take on this task. In corporate groups, one data protection officer can oversee the entire corporate group.Appointment of a representative in the EU.Swiss companies without a branch in the EU that offer goods or services or conduct behavioral monitoring there must appoint an EU representative. Exceptions to this rule apply if the data processing is only occasional, does not pose any particular risks and does not involve any particularly sensitive data.Conducting a data protection impact assessment (DPIA).The DSFA is a new instrument that will become legally binding with the entry into force of the EU Data Protection Act. It must be carried out if sensitive personal data is collected or if the data collection and processing serves to evaluate the personality, abilities, performance and behavior of individuals. In such cases, the data protection officer must examine the particular risks to the rights and freedoms of the data subjects and comment on whether the processing of such data is lawful. For the use of Big Data or profiling activities, a DSFA is mandatory as a prior check. A DSFA includes a systematic description of the planned data processing procedures, an assessment of their necessity and proportionality, and the measures taken to avert the associated risks.In the long term, the aim is to ensure the sustainable implementation of the implemented data protection measures and processes and to generally generate awareness of data protection issues. Responsible persons must be appointed in the companies for this purpose and, of course, they must also be provided with sufficient resources.
What do marketing and communications agencies need to consider?
MICHÈLE FORSTER For most marketing and communications service providers, it is not worthwhile to develop their own infrastructure for email and lead management. Consequently, they rely on third-party providers to collect and process data. In the future, the GDPR compatibility of their business practices must also play a role in their selection, in particular guarantees that various data security requirements are met, including access, access and transfer controls as well as separation requirements and the exclusive use of data for specific purposes. For marketing and communications agencies, too, data processing may in future only be outsourced on a contractual basis using standard contractual clauses and with sufficient data protection guarantees from the contractor. Processors may only pass on such activities to further service providers - so-called sub-sub-accredited service providers - if they have the written approval of the responsible person of the commissioning company.Marketing and communications service providers must also observe further requirements of the new EU data protection law for the planning and design of individual campaigns. For advertising mailings, newsletters or nurture campaigns, an imprint, a data protection notice and a revocation option - for example, via an unsubscribe link - are indispensable. For an advertising contact, companies always need proof of the recipient's active, explicit, conscious and voluntary consent. Michèle Forster recommends that agencies use a double opt-in process to ensure this. In addition, companies should inform their customers and advertising contacts fully and comprehensibly about all aspects of the collection and processing of their data.
How are violations of the EU data protection law punished?
MICHÈLE FORSTER Companies that do not comply with the requirements of the new EU data protection law will face severe penalties from May 25, 2018. According to Michèle Forster, violations of the GDPR will be sanctioned with a fine of up to four percent of annual turnover, up to a maximum of 20 million euros.As a conclusion: at first glance, Swiss companies will face burdensome changes due to the implementation of the European data protection law, but in practice, the consequences for SMEs and also for marketing and communications agencies should be manageable. It can be assumed that most companies already have the basics in place for handling personal data in compliance with the GDPR. It is not without reason that the EU Commission also certified to Switzerland back in 2016 that its data protection legislation and its level of data protection comply with the regulations of EU law, so that there are no legal obstacles to an exchange of data. In addition, SMEs can take advantage of facilitations with regard to the documentation of their data processing, the appointment of a data protection officer or an EU representative.
*This article was published by the business campaigning GmbH provided.
