"Revision of data protection law will make profiling more difficult"

Werbewoche: With the preliminary draft of the new data protection law in Switzerland, a comprehensive revision of the current law is to be expected. Is there a need for a new data protection law?

Lukas Bühlmann: With the proposed draft, the Federal Council wants to take into account, among other things, the changed technological and social conditions. This makes sense in principle, provided it ultimately leads to greater legal certainty for companies. In addition, the transparency of data processing is to be improved and the self-determination of data subjects over their data strengthened. There is an immediate need for action here due to Switzerland's obligation under international law to fulfill the requirements of the Council of Europe's revised data protection convention (CETS 108). In addition, as is well known, the EU has also fundamentally revised its data protection law. These changes are also forcing Switzerland to adapt its data protection requirements. From a macroeconomic perspective, it is essential that the level of Swiss data protection continues to be assessed as appropriate and equivalent by the EU in the future. This assessment is a mandatory prerequisite for a smooth, functioning exchange of data with neighboring European countries. Against this background, there is a need for a revision of the Swiss data protection law and an approximation to the new EU regulations. However, it is by no means necessary to go beyond the requirements of EU law.

The consultation process for the preliminary draft of the new data protection law has just been completed. Was there anything to criticize?

The most controversial innovation is certainly the plan to dispense with the introduction of administrative sanctions and instead to expand and intensify the criminal liability of natural persons involved in data processing in companies. Thus, incomprehensibly, the sanctions envisaged are to be directed primarily at the employees and not at the company in whose interest the data processing is carried out. These sanctions are to include fines - a maximum of CHF 500,000 for intent and 250,000 for negligence - and/or even imprisonment.
This planned system of sanctions is diametrically opposed to Switzerland's "Digital Strategy". It is highly inhibiting to innovation and establishes a culture of denunciation in companies. It also leads to a considerable disadvantage for Switzerland as a business location. No innovative digital start-up will be willing to expose its founders and employees to such drastic criminal law risks. Good employees will no longer be willing to share responsibility in the companies. In particular, due to the envisaged criminal liability of negligent behavior, potentially every employee will be at constant risk of criminal liability through what are now everyday activities in the workplace. In my opinion, this is also unacceptable from a socio-political perspective. At the same time, the sanctions against data processing by foreign companies would in fact not be enforceable, which on the one hand would not increase data protection in Switzerland and on the other hand would give foreign companies an immense competitive advantage.

Does this mean, for example, that the person responsible for IT is fined and not the company?

The proposed system of sanctions is also problematic in that the waiver of administrative sanctions again represents a special approach compared to the regulation in the EU GDPR. This is because the draft of the new data protection convention requires both judicial and non-judicial sanctions. Here, uncertainty is created with regard to the adequacy of Swiss data protection law, and this corresponds to a legally unnecessary "Swiss finish".

Which innovation affects the advertising industry the most?

In addition to the introduction of a general active information obligation for data processing, the violation of which nota bene threatens drastic sanctions, the proposed regulation on profiling is particularly drastic for the advertising industry. The provision stipulates that profiling per se constitutes a violation of personal rights and that consent will therefore regularly be required. Moreover, this consent must be given "expressly". In addition, the term "profiling" is defined far too broadly in the proposed law and is not described in enough concrete terms. In particular, profiling that is not based on personal data is also to be covered by the regulation. The regulation overshoots the target by far and is also an (unnecessary) tightening compared to the European reform efforts. For advertising activities, especially personalized marketing, as well as Big Data, this provision would have a significant negative impact. Thus, not only the DM industry is affected, but all sectors of the economy and their companies. Foreign providers, who would not be factually threatened by these strict Swiss regulations, could at best gain a competitive advantage through this provision. Another example of how the proposed draft would lead to locational disadvantages for the Swiss economy.

How does the law in Switzerland intend to regulate Big Data? That seems impossible.

The Federal Council emphasizes that big data represents a challenge for data protection in various respects. At the present time, however, there is too little clarity about the concrete implications. The topic of "Big Data" has therefore only been addressed selectively, and an overall regulation is lacking. The lack of legal certainty has a negative impact on advertising activities and personalized advertising in particular. What remains is a large gray area. With the stricter sanction options envisaged, the aim of increasing the number of data protection infringement proceedings, and the expansion of the competences of the data protection authorities, this would not be good news for the Swiss economy.

What about consent for data processing for advertising purposes? Will stricter requirements apply in the future?

This question is not clearly answered in the Federal Council's proposal. The proposal is contradictory on this point. The law is adapted to the terminology of the EU regulation. However, there is no clarification as to whether this means that the same requirements for valid consent will apply in the future as in the EU. Adopting these strict requirements would result in a considerable tightening of the law compared to the current situation. For example, the check boxes that are currently frequently found in Switzerland and have already been pre-ticked would also be prohibited in Switzerland in the future. Customers would have to actively tick these check boxes. In addition, the GDPR provides for a so-called tying ban. It should no longer be permitted, for example, to make participation in sweepstakes dependent on consent to the use of participant data for advertising purposes. In my opinion, such a strict regulation is not absolutely necessary, at least in view of the adequacy of Swiss data protection law, and should therefore be rejected.

What does the expansion of data protection authorities' powers mean?

Compared to the previous law, the competences of the supervisory authority are to be strengthened. In particular, this will redress the imbalance between data subjects and data processors. The proposed provisions grant the FDPIC (Federal Data Protection and Information Commissioner) additional investigative and injunctive powers and create a new direct injunctive power. Non-compliance with the orders would be punished with heavy fines. Particularly problematic is the provision that appeals against precautionary measures of the FDPIC should generally have no suspensive effect. Since the cessation or adaptation of data processing during the uncertainly long duration of proceedings can cause massive damage to companies, they must at least be given the opportunity to apply to the courts for suspensive effect.

Is there no self-regulation or criteria of fairness in data protection?

The detailed regulations under discussion, which are to be introduced as binding in the DPA or in the sense of self-regulation ("good practice"), are controversial. Functioning self-regulations already exist today in a wide variety of economic sectors. These would all have to be re-evaluated and approved by the FDPIC. This leads to a double-edged result for companies. Recommendations of "good practice" can help in the implementation of the obligations to the needs of the industry concerned. The recommendations must be approved by the FDPIC and are expected to have high standards. However, because the approved recommendations would become de facto law, a growing and finely woven set of rules could develop around the law. Failure to comply with the recommendation would be a de facto presumption of a violation of the law. In principle, however, self-regulatory measures are preferable to rigid and excessively detailed legislation.

In the preliminary discussion, you mentioned that data subjects will be able to sue free of charge in the future in the event of data protection violations.

The rights of the data subject will be greatly expanded. The right to information is comprehensive in the current law and is only slightly expanded. The other rights (right to be forgotten, right to erasure, right to rectification, right to contest) do not change significantly compared to the current law. The waiver of procedural costs (court fees) in the civil prosecution of data protection violations is to be introduced. Perhaps a child of efforts to increase the number of data protection infringement proceedings.

What should companies in Switzerland be doing right now? Do you have any recommendations for action?

In particular, companies operating across borders are recommended to review their data processing in light of the future EU regulations. The geographical scope of application of the EU GDPR is very broad, so that a large number of companies without a branch in the EU are also subject to the requirements. The future regulation has already been definitively determined and will apply from May 25, 2018. In contrast, it must be assumed in Switzerland that the proposed revision will still be subject to a large number of changes, but this is also imperative. In this respect, it is currently still completely unclear how the future legal situation will be structured. In any case, the present draft law in its current form represents a major threat to the "digital economy" in Switzerland.

Interview: Heinz Schopfer

This interview was published in Werbewoche 6/2017, March 24, 2017. A subscription at Easter? Here.