New data protection legislation

The data protection legislation has been completely revised in order to adapt to new technological and societal conditions and to the requirements of international law. It came into force on 1 September 2023.

zeitleiste-e

1. What has happened so far

The first Federal Act on Data Protection (FADP) came into force on 19 June 1992. With technological and societal developments and increasing data protection threats, the Federal Council considered it necessary to strengthen the data protection legislation.

An advisory group was set up to prepare a preliminary draft revision of the FADP. On 15 September 2017, the Federal Council adopted the draft new FADP and the related dispatch. The revised text aimed to better protect citizens' rights and to strengthen the economy by harmonising Swiss law with the protection standards of the EU and the Council of Europe, particularly with regard to the cross-border disclosure of personal data.

Parliament debated the draft and divided it in two. Initially, it decided only to adopt Directive (EU) 2016/680 (Development of the Schengen acquis) approving the Schengen Data Protection Act (SDPA), which came into force on 1 March 2019. However, it was repealed on 1 September 2023 when the major reform of data protection legislation came into force. The SDPA did not apply to private data controllers. It only applied to the processing of personal data carried out by federal bodies in the criminal and judicial fields.

In a second phase, Parliament tackled the revision of the Federal Data Protection Act (FADP). The aim of this revision was not only to meet the challenges posed by technological developments, but also to take account of developments at an international level, in particular the reforms carried out by the Council of Europe in this area, i.e. Convention 108+ and EU (Regulation (EU) 2016/679 for data protection (GDPR), which came into force on 25 May 2018 (although the GDPR is not formally binding on Switzerland). The Federal Data Protection Act was adopted by Parliament on 25 September 2020 following intense debate in the two Chambers and after a conciliation meeting had addressed the issue of high-risk profiling. The revised FADP came into force on 1 September 2023.

The Federal Council adopted the Data Protection Ordinance (DPO) and the Data Protection Certification Ordinance (DPCO) on 31 August 2022. They supplement the FADP and came into force on 1 September 2023.

The Federal Council decides that the Data Protection Act and the related ordinances (DPO and DPCO) will come into force on 1 September 2023.

2. International framework

Like Swiss law, international law has also had to take account of technological developments. Within the Council of Europe, the first Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data was signed in Strasbourg on 28 January 1981. The Federal Council ratified the Convention in 1997; it came into force in Switzerland on 1 February 1998.

In 2018, an Amending Protocol was adopted to meet the challenges posed by new information and communication technologies and to ensure the effective implementation of the Convention. The Protocol was signed on 21 November 2019 and ratified on 7 September 2023 by Switzerland.

The modernised Convention 108, also known as Convention 108+, will come into force once 38 States Parties have ratified the Protocol of Amendment; it is not yet in force.

On the European Union side an initial Directive on data protection was adopted in 1995. Switzerland, however, is not bound by this instrument.

In 2012, the European Commission proposed a comprehensive reform of the Data Protection Directive adopted in 1995, with the aim of improving the privacy rights of data subjects while taking account of the digital economy. On 27 April 2016, the General Data Protection Regulation (GDPR) and Directive (EU) 2016/680 were adopted. Directive (EU) 2016/680 is binding on Switzerland to the extent that it forms part of the development of the Schengen acquis. The GDPR, on the other hand, is not binding on Switzerland.

Links

The full dossier on improving data protection is available at the following page

The various reports and legal opinions relating to the complete revision of the Data Protection Act are available at the following page

Press releases

These documents don’t exist in English. Please see the German, French or Italian version.

Last modification 21.09.2023

Social share