Export hit data protection
January 28 was European Data Protection Day—a date that likely went unnoticed by many. In a guest commentary, Gabriel Gabriel explains what this date—and the GDPR—mean for Switzerland.
Few topics are as hotly debated as the protection of personal data. There is no doubt about its relevance: just a few days ago, the French data protection authority CNIL imposed an Penalty payment of 50 million euros for lack of transparency.
The European Data Protection Day on January 28 should also serve as a reminder of the need for binding guidelines. For 12 years now, the day of action launched by the Council of Europe has been raising awareness of the issue among citizens and companies. In the EU, the General Data Protection Regulation regulates the transnational flow of data. However, when it comes to data transfers between the EU and third countries, things get much more complicated. Different rules apply in each country, which makes cooperation more difficult for companies and authorities.
In recent years, the GDPR has also taken the lead beyond EU borders and is shaping data protection worldwide. Thus, in many recent legislations, such as in California and Japan, there are similarities to the General Data Protection Regulation. The Swiss data protection law, which is currently being revised, is also largely based on the EU GDPR. This is no coincidence. The greater the proximity to the GDPR, the easier it is for the EU Commission and the respective third country to mutually recognize an appropriate level of data protection. This simplifies data transfer between the regions and facilitates economic cooperation.
The provisions on data exchange between the EU and the USA are also a good example. For example, on December 19, 2018, the Privacy Shield was extended for the second time. The agreement regulates the lawful exchange of data between the EU and the USA. It had been criticized in the run-up to the extension, as some demands from the Europeans - such as that for the appointment of a permanent and independent ombudsperson - were still open. After a number of improvements, the regulation entered into force for another year and facilitates the intercontinental exchange of data.
However, not only countries, but also international companies in particular are taking their cues from the GDPR. For example, many companies now voluntarily use standard contractual clauses. Microsoft has even in September 2018 six principles published, on which international agreements should be based.
For companies that operate in Europe and third countries at the same time, it is burdensome to comply with different data protection standards for the different regions. Companies that are forced to comply with the General Data Protection Regulation partly adopt the strict EU regulations in other countries whose laws are less stringent. This reduces the administrative burden and enhances the image.
In this way, the GDPR indirectly benefits people outside the EU. The more foreign companies voluntarily align themselves with the data protection standard of the GDPR, the more the GDPR thus resembles a global data protection standard.
About the authorGabriel Gabriel is Managing Director of Brainloop Switzerland.
