A New Swiss - U.S. Privacy Shield Replaces The U.S. – Swiss Safe Harbor

The U.S. Department of Commerce and Swiss Federal Data Protection and Information Commissioner ("FDPIC") recently finalized a new Swiss–U.S. Privacy Shield Framework ("Swiss Privacy Shield") that will allow companies to transfer Swiss personal data to the United States in compliance with Swiss data protection requirements. The Swiss Privacy Shield will replace the U.S.–Swiss Safe Harbor Framework ("Swiss Safe Harbor") and will apply conditions similar to those the EU–U.S. Privacy Shield Framework ("EU–U.S. Privacy Shield") established last summer for cross-border transfers of EU personal data.

As a result, no longer can organizations transferring Swiss personal data to the United States rely on the Swiss Safe Harbor. Those organizations with current Swiss Safe Harbor registrations will need to certify under the new Swiss Privacy Shield or implement an alternative means of complying with Swiss data transfer restrictions. Organizations can self-certify to the U.S. Department of Commerce (via the Privacy Shield website) and publicly commit to comply with the Swiss Privacy Shield starting April 12, 2017. Now is the time for organizations considering self-certifying to the Swiss Privacy Shield to review the principles and commitments of the new pact.

The Swiss Privacy Shield's replacement of the Swiss Safe Harbor follows closely after the European Court of Justice ("ECJ") invalidated the U.S.–EU Safe Harbor program in its October 6, 2015, Schrems decision on the ground that the program failed to provide adequate levels of protection to personal data transferred from the European Union to the United States.1 The invalidation of the U.S.–EU Safe Harbor quickly led EU and U.S. officials to negotiate the terms of the new EU–U.S. Privacy Shield released in July 2016 to replace the defunct U.S.–EU Safe Harbor with a more robust and comprehensive transatlantic data-transfer scheme.2 Shortly after the EU–U.S. Privacy Shield was released, the FDPIC announced in August 2016 that the shortcomings identified in the Schrems decision also applied to the Swiss Safe Harbor, thereby prompting the Swiss and U.S. governments to also negotiate a more stringent data-transfer pact.3

The Swiss Privacy Shield adopts requirements that are almost identical to those incorporated in the EU–U.S. Privacy Shield. For example, the Swiss Privacy Shield requires participating companies to annually certify with the U.S. Department of Commerce and to voluntarily adhere to the...