On January 15, 2024, the EU Commission published its <a href="https://commission.europa.eu/system/files/2024-01/JUST_template_comingsoon_Report%20on%20the%20first%20review%20of%20the%20functioning.pdf">report</a> on the results of its first review of the adequacy decisions previously taken under the old EU Data Protection Directive. The EU Commission concludes that Switzerland continues to provide an adequate level of protection for personal data transferred from the EU.
According to its report, the EU Commission welcomes the developments in the Swiss legal framework since the adoption of the first adequacy decision in July 2000, including in particular the modernization of the Swiss Data Protection Act (cf. our <a href="https://www.homburger.ch/en/insights/revision-of-the-swiss-data-protection-law-is-complete">Bulletin</a> of August 31, 2022). These developments have contributed to an increased level of data protection, in a manner sufficient for the EU Commission to maintain its adequacy decision.
Maintaining the EU adequacy decision was one of the main objectives of the revision of the Swiss Data Protection Act, which entered into force on September 1, 2023: Without the EU&#8217;s recognition of the adequacy of Swiss data protection law, the export of personal data from the EU to Switzerland would have become much more burdensome. Today&#8217;s confirmation by the EU Commission thus marks the achievement of a key goal in the efforts to modernize Swiss data protection law in a manner consistent with the EU General Data Protection Regulation (GDPR).
The review of adequacy decisions by the EU Commission, which has now been completed, is the first such review since the GDPR came into force in 2018. The GDPR calls for regular reviews, and the EU underlines its intention to further intensify dialogue and cooperation with like-minded international partners on data flows and digital issues in general.

EU Confirms Adequacy of Swiss Data Protection Law

<h3>New DPA enters into force on September 1, 2023</h3>
<h4>What did the Federal Council decide today?</h4>
While Parliament had approved the new Swiss Data Protection Act (DPA) already in September 2020 (see our <a href="https://www.homburger.ch/en/insights/swiss-parliament-approves-revision-of-the-swiss-federal-act-data-protection">Bulletin of September 25, 2020</a> and the text of the DPA available <a href="https://cms.homburger.ch/wp-content/uploads/2021/01/Swiss-Data-Protection-Act-of-September-25-2020_02_682151_1.pdf" target="_blank" rel="noopener">here</a>), the revision of the Data Protection Ordinance (DPO) continued until today. On August 31, 2022, the Federal Council now adopted the new DPO (available <a href="https://www.bj.admin.ch/dam/bj/de/data/staat/gesetzgebung/datenschutzstaerkung/vdsg/vo.pdf.download.pdf/vo-d.pdf" target="_blank" rel="noopener">here</a>)<a href="#_ftn1" name="_ftnref1">[1]</a> and decided that the new DPA and the new DPO shall enter into force on September 1, 2023. At the same time, the Federal Council also adopted the new Ordinance on Data Protection Certifications. With this, the legislative work on the revision of the Swiss data protection law is complete.
<h4>What is the impact of today&#8217;s decisions of the Federal Council?</h4>
With today&#8217;s decisions by the Federal Council, it is clear which implementing provisions must be taken into account in addition to the DPA and when the revision will enter into force. Companies are now required to take the necessary steps to ensure compliance with the requirements of the new DPA and the DPO by September 1, 2023.
<h4>What are the most important regulations of the Data Protection Ordinance?</h4>
The following provisions of the DPO are to be highlighted for companies:
<ul>
<li>In the area of data security, the DPO specifies the principle of the adequacy of data security in that the need to protect personal data and the risks to the personality and fundamental rights of the data subject must be assessed on the basis of the criteria set out in the DPO. In addition, the DPO defines the protection goals and certain technical and organizational measures that should allow these goals to be achieved.</li>
<li>The obligation to log certain data processing activities, which was heavily criticized in the consultation, remains in place despite calls to the contrary. Although the obligation has been restricted compared to the draft released for consultation a year ago, the requirement has not become any clearer. Private data controllers and data processors who process sensitive personal data on a large scale by automated means or who carry out high-risk profiling must now log the storage, modification, reading, disclosure, deletion and destruction of the data if the preventive measures taken are not sufficient to guarantee data protection. The log must be kept for at least one year, separately from the system in which the personal data is stored. The scope of this requirement, which is far-reaching for both data controllers and data processors, remains unclear. In particular, it will have to be clarified when sensitive personal data is processed «on a large scale» and when «preventive measures do not guarantee data protection». In the explanatory report, the Federal Office of Justice takes the position – surprisingly and without reasoning – that the latter is only rarely the case. This is not convincing, since ensuring data protection is a fundamental premise for all data processing activities.</li>
<li>Furthermore, the DPA provides for an obligation of private data controllers and data processors to issue and regularly update regulations for automated data processing if they process particularly sensitive personal data on a large scale by automated means or carry out high-risk profiling.</li>
<li>For data processing through processors, the clarification that the authorization of subcontractors can be granted both specifically (i.e. in relation to a specific subcontractor) and generally is welcome. In the latter case, the DPA requires information about intended changes and a right of objection in favor of the controller.</li>
<li>The DPA then specifies further obligations of the controller, in particular the modalities of the duty to inform data subjects, the duration of the retention of the data protection impact assessment, as well as the requirements for the notification of data breaches to the FDPIC. Furthermore, certain modalities of the data subject&#8217;s right to information as well as the right to data surrender and transfer are regulated.</li>
<li>Finally, the DPA states that the obligation to keep a processing record does not apply to companies that employ fewer than 250 people on January 1 of any given year (whereby the level of employment should not play a role) and that neither process particularly sensitive personal data on a large scale nor carry out high-risk profiling.</li>
</ul>
<h4>Which countries does the Federal Council acknowledge to have an adequate level of data protection?</h4>
Annex 1 of the DPO lists those countries which have appropriate data protection legislation. In principle, the disclosure of personal data to these countries is permitted. In particular, the list includes all member states of the EU and the EEA and the United Kingdom, as well as Canada in certain areas. Furthermore, the list includes: Andorra, Argentina, Faroe Islands, Gibraltar, Guernsey, Iceland, Isle of Man, Israel, Jersey, Monaco, New Zealand and Uruguay.
Disclosures of personal data to other countries – including in particular to the USA – require either the application of a specific exemption set forth in the DPA or the implementation of alternative protective measures to ensure adequate data protection.
<h4>Why is there a need for the Data Protection Ordinance in addition to the DPA?</h4>
The DPA empowers the Federal Council to issue certain implementing regulations, which is why the Federal Council adopts the DPO.
<h4>Has the new Data Protection Ordinance been toned down from the June 2021 draft?</h4>
The draft of the new DPO published in June 2021 was sharply criticized in the public consultation process. This is because the draft contained numerous provisions that would have had a significant impact on the companies subject to the DPA, and which, in terms of content, went far beyond mere implementing provisions. Fortunately, the Federal Council has at least taken partial account of the criticism from the consultation. The final DPO that is now available has been toned down compared to the draft. For example, the Federal Council has considerably streamlined the regulation of the modalities of the duty to inform as well as the requirements for the role of the data protection advisor compared to the draft and has also waived certain written form requirements. However, the final DPO still appears to be excessive in the area of data security requirements, where in particular the implementation of the obligation to log certain data processing appears to be challenging.
<h4>What measures are to be undertaken in view of the entry into force of the new DPA?</h4>
Projects for implementation of the new DPA in companies should now be tackled promptly so that companies are DPA-compliant on September 1, 2023. For many companies, it will be particularly necessary to review internal processes and documentation (such as data protection declarations, processing records, data protection impact assessments, contracts regarding the processing of personal data, etc.) and, if necessary, update them or introduce new ones. A short checklist giving an overview on implementation work is available for download <a href="https://cms.homburger.ch/wp-content/uploads/2022/08/Summary-Checklist-Implementation-of-the-New-Swiss-Data-Protection-Act-2022-08-3113880971.2.pdf">here</a>.
<h6><a href="#_ftnref1" name="_ftn1">[1]</a>        An English translation is not yet available.</h6>

RZ_Preview_Ritter_Data Protection_SS_02

Revision of the Swiss Data Protection Law is Complete

By way of a note published on its <a href="https://www.bj.admin.ch/bj/de/home/staat/gesetzgebung/datenschutzstaerkung.html" target="_blank" rel="noopener">website</a>, the Swiss Federal Office of Justice (FOJ) has just informed that the new Swiss Data Protection Act (DPA) is scheduled to enter into force on September 1, 2023. While the FOJ is cautious to caveat that the final date has yet to be confirmed and decided by the Swiss Federal Council, many companies will be relieved to hear that they will have more time than previously anticipated in order to prepare for the advent of the new DPA. This is even more important considering that the new DPA will not provide for a general transition period, so that companies will have to complete their implementation activities by the time the new DPA enters into force.
Previously, it was anticipated that the new DPA would enter into force already at the beginning of 2023. With the new ordinance on the DPA still not being in final form, this timing would have been tight.
You may find further information on the new DPA in our <a href="https://www.homburger.ch/en/insights/swiss-parliament-approves-revision-of-the-swiss-federal-act-data-protection">Bulletin of September 25, 2020</a> and the text of the new DPA, including an English translation in our <a href="https://cms.homburger.ch/wp-content/uploads/2021/01/Swiss-Data-Protection-Act-of-September-25-2020_02_682151_1.pdf">printable booklet</a>.

New Swiss Data Protection Act Enters Into Force in September 2023

Corporate / M&A

IP / IT

Data Protection

Employment and Executive Compensation

Scaled-Agile-web-640x140

Homburger News

Homburger and Scaled Agile

On April 20, 2023, Scaled Agile Inc., a portfolio company of Eurazeo SE (Euronext Paris: RF), one of Europe&#8217;s leading private equity firms, announced its acquisition of Rentouch, a Swiss-based company specializing in software for visualizing agile planning events across multiple agile teams with SAFe®. This acquisition aims to accelerate Scaled Agile&#8217;s goal to redefine the way the world&#8217;s leading organizations identify and deliver customer value, capitalize on emerging opportunities, and improve business outcomes through integrated solutions that help teams unlock better ways of working.
Homburger advised Scaled Agile in this transaction. The team was led by Dieter Gericke (Corporate/M&amp;A) and included Léonard Aeschlimann (Corporate/M&amp;A), Reto Heuberger, Philippe Weber (both Tax), Gabriel Kasper (IP/IT and Data Protection), Matia Trosic and Frédéric Fitzi (both Employment and Executive Compensation) as well as Pepe Hünerwadel and Florian Gasche (both Corporate/M&amp;A).

Homburger advises Scaled Agile on its acquisition of Rentouch

Competition

Real Estate

Financing and Investment Products

Regulatory

Homburger for Implenia

20230403_Implenia

On March 30, 2023, Implenia AG (SIX: IMPN), Switzerland&#8217;s leading real estate and construction service provider, announced that it had agreed to purchase Wincasa AG for CHF 171.6 m from Swiss Prime Site AG (SIX: SPSN). Wincasa is the leading Swiss real estate service provider with more than 250,000 managed properties, CHF 81 bn in assets under management and 1,350 employees (FTE). The closing of the transaction is planned for the second quarter of 2023, subject to regulatory approvals.
Homburger acts as counsel to Implenia. The Homburger team is led by Marcel Dietrich (Competition, Real Estate) and Daniel Häusermann (Corporate / M&amp;A, Real Estate) and comprises Peter Müller (Tax), Oriana Schöni (Corporate / M&amp;A), Gabriel Kasper, Kristina Martinovic and Hélène Bruderer (IP / IT), Allegra Arnold and Jonas Krull (Competition), Stefan Kramer, Manuel Baschung and Daniel Junginger (Financing and Investment Products / Regulatory), Gregor Bühler and Sebastian Wyler (Employment and Executive Compensation), as well as Anna Delia Lohmann and Giulia Meier.

Homburger advised Implenia on the acquisition of Wincasa

StoneX

On November 1, 2022, StoneX Group Inc. (NASDAQ: SNEX), a global financial services company, announced that it had acquired Cotton Distributors Inc. (CDI).
CDI operates a global cotton merchant business and is headquartered in Lausanne, Switzerland with an office in Brazil.
Homburger advised StoneX as lead and Swiss counsel in this transaction. The Homburger team was led by partner Daniel Häusermann (Corporate / M&amp;A) and included partner Reto Heuberger and counsel Peter Müller (both Tax), associates Léonard Aeschlimann, Romain Fakhoury (both Corporate / M&amp;A), Philippe Weber (Tax), Simone Gloor (Financing and Investment Products) and Gabriel Kasper (Data Protection) as well as junior associate Thomas Leu (Corporate / M&amp;A).

Gabriel
Kasper

Homburger advises Scaled Agile on its acquisition of Rentouch

Homburger advised Implenia on the acquisition of Wincasa

Homburger advised StoneX on the acquisition of Cotton Distributors Inc.

EU Confirms Adequacy of Swiss Data Protection Law

Revision of the Swiss Data Protection Law is Complete

New Swiss Data Protection Act Enters Into Force in September 2023

People Analytics in privatrechtlichen Arbeitsverhältnissen

§3 Datenschutz-Governance in Unternehmen

People Analytics in privatrechtlichen Arbeitsverhältnissen, Vorschläge zur wirksameren Durchsetzung des Datenschutzrechts

Join the Team

Gabriel Kasper

Career

Languages

Bar Registration

Teams

GabrielKasper

Homburger advises Scaled Agile on its acquisition of Rentouch

Homburger advised Implenia on the acquisition of Wincasa

Homburger advised StoneX on the acquisition of Cotton Distributors Inc.

EU Confirms Adequacy of Swiss Data Protection Law

Revision of the Swiss Data Protection Law is Complete

New Swiss Data Protection Act Enters Into Force in September 2023

People Analytics in privatrechtlichen Arbeitsverhältnissen

§3 Datenschutz-Governance in Unternehmen

People Analytics in privatrechtlichen Arbeitsverhältnissen, Vorschläge zur wirksameren Durchsetzung des Datenschutzrechts

Join the Team

Gabriel Kasper

Career

Languages

Bar Registration

Teams

Gabriel
Kasper