Swiss Information Privacy Law and the Transborder Flow of Personal Data

• Author: Sylvain Métille
• Position: Lecturer at the Faculty of Law and Criminal Justice of the University of Lausanne and at the University of Applied Sciences Western Switzerland, Attorney at Law at id est avocats, Lausanne
• Pages: 71-80



















 !∀

71





Sylvain Métille

1

sylvain.metille@romandie.com

Abstract: Switzerland, like the European Union, has an extensi ve protection of

privacy. An omnibus law, the D ata Protection Act, ensures a high level of p rotection for

every data relating to an identified or iden tifiable person, including legal persons. This Act

applies both to data treated inside Switzerland and to data exported abroad. Data can only

be transmitted if an adequate level of protection is granted.For countries where the legal

framework is not deemed to be sufficient like the U.S., particular contractual clauses are

necessary. In order to facilitate the exchange of data, Switzerland and the U.S. have

developed a Safe Harbor Framework. Every company certified compatible with the Sa fe

Harbor is automatically recognized as o ffering the adequate level of protection required

under Swiss law.

1. Introduction

To paraphrase the Council o f Europe, with the increase in exchanges of personal data across national

borders, it is necessary to ensure the effective protection of human rights and fundamental freedom and

in particular, the right to privac y and it is necessary to reconcile the fundamental values of the respect for

privacy and the free flow of information between peoples.

2

Information privacy law, generally known in Europe as data protection law, offers a very dif ferent

protection on both sides of the Atlantic Ocean. With little simplification, the right to privacy in the U.S. is

an aspect of liberty and a right “to be let alone.” In contrast, the right to p rivacy in Switzerland and

Europe is an aspect of dignity and a right to be respected. The European continent a t first fears the press

and the market, when America fears the Government and defends as main value private property and free

speech. Finally, the U.S. is attached to an individual’s reaso nable expectation of privacy, where Swiss and

European people consider privacy not only as an individual right but also a social value that needs to be

defended by an official data Commissioner.

3

This paper aims to present the legal protection of information privacy and the current relevant

requirements when data is treated in or exported from Switzerland. The analysis is based on the current

legislation and does not take into account the early stages of expected modifications of the privacy law in

Europe, which are subject to multiple amendments

4

.

According to the Swiss legislation, personal data can only be exported if the foreign country offers an

adequate level of protection or if sufficient safeguards ensur e an adequate level of protection abroad, like

particular contractual clauses. As the U.S. is not considered to offer sufficient protection, a Safe Harbor

1

Dr Sylvain Métille, Lecturer at the Faculty of Law and Criminal Justice of the University of Lausanne and at the

University of Applied Sciences Western Switzerland, Attorney at Law at id est avocats, Lausanne. This article was

mainly written during my time as a visiting scholar at the Berkeley Center for Law and Technology (UC Berkeley). I

thank research assistants Jean Perrenoud and Everett Monroe for their valuable help.

2

See Council of Europe, Additional Protocol to the Convention for the Protectio n of Individuals with regard to

Automatic Processing of Personal Data, Regarding Su pervisory Authorities and Transborder Data Flo ws, Nov. 8,

2001, C.E.T.S. 181 [hereafter Convention 181].

3

Francesca E. Bignami, European Versus American Liberty: A Comparative Privacy Analysis of Antiterrorism Data

Mining, 48 B.C.

L.

R

EV

. 609 (2007); Paul M. Schwartz & Karl-Nikolaus P eifer, Prosser's Privacy and the German

Right of Personality: Are Four Privacy Torts Better than One Unitary Concept?, 98 C

ALIF

.

L.

R

EV

. 19 25 (2010);

James Q. Whitman, The two western cultures of privacy: dignity versus liberty, 113 Y

ALE

L.J. 1151 (2004).

4

See for the modernization of the Convention 108 the proposal of the Consultative Committee at

http://www.coe.int/t/dghl/standardsetting/dataprotection/modernisation_EN.asp? and for the revision of the Directive

95/46/EC the Commission’s proposal and information on the reform at http://ec.europa.eu/justice/newsroom/data-

protection/news/120125_en.htm (last visited August 15, 2012). A revision of the Swiss DPA i s not expected before

2014.