Swiss Federal Data Protection Act

Overview

The Swiss Federal Act on Data Protection (FADP), which came into effect on September 1, 2023, represents a comprehensive modernization of Switzerland's data protection legal framework. Its primary purpose is to protect the personality and fundamental rights of natural persons whose personal data is processed. This updated legislation aims to align Swiss data protection standards with contemporary technological advancements and international norms, particularly with the European Union's General Data Protection Regulation (GDPR). The FADP replaces the previous 1992 Act, addressing deficiencies that arose due to rapid technological changes and ensuring the continued free flow of data with the EU, which is crucial for Swiss economic opportunities.

The historical context of the FADP's revision stems from the need to adapt to an increasingly digital world where personal data plays a central role in economic and social interactions. The original 1992 Act was no longer sufficient to address the complexities of modern data processing, cross-border data transfers, and the heightened expectations for individual privacy. The Federal Council's dispatch dated September 15, 2017, laid the groundwork for the revised Act, emphasizing the importance of robust data protection for both individuals and the Swiss economy. The new FADP introduces several key innovations, including an explicit extraterritorial scope, an expanded definition of sensitive data to include genetic and biometric information, and new obligations for data controllers and processors.

The FADP is significant because it strengthens the rights of data subjects and imposes stricter obligations on entities that process personal data. It matters for all organizations operating in Switzerland or processing the data of individuals in Switzerland, as non-compliance can lead to substantial penalties. The Act was proposed by the Federal Assembly of the Swiss Confederation, based on constitutional articles related to privacy and data protection. Its implementation ensures that Switzerland maintains a high level of data protection, fostering trust in digital services and facilitating international data exchange, particularly with countries that have adopted similar stringent data protection regimes like the GDPR.

Definitions

The FADP introduces and clarifies several key terms central to data protection. 'Personal data' refers to any information relating to an identified or identifiable natural person. This broad definition encompasses a wide range of data points, from names and addresses to online identifiers and, crucially in an employment context, salary information. The Act's focus is on protecting the individual's personality and fundamental rights in relation to this data. 'Processing' is defined broadly as any handling of personal data, regardless of the means and procedures used. This includes, but is not limited to, the acquisition, storage, keeping, use, modification, disclosure, archiving, deletion, or destruction of data. This comprehensive definition ensures that virtually any action taken with personal data falls under the scope of the FADP, requiring adherence to its principles.

A 'data controller' is defined as a private person or federal body that alone or together with others decides on the purpose and means of processing personal data. In an employment context, the employer typically acts as the data controller, determining why and how employee data, including salary data, is processed. The FADP places significant responsibilities on data controllers to ensure lawful, good faith, and proportionate processing of data. Conversely, a 'data processor' is a private individual or entity that processes personal data on behalf of the controller. This distinction is crucial for assigning responsibilities, especially when data processing activities are outsourced, such as to payroll service providers or IT service providers. The FADP mandates that data processors must process data as the controller would be permitted to do and without violating any legal or contractual confidentiality obligations.

The FADP also defines 'sensitive personal data' as data worthy of particular attention, which now explicitly includes genetic and biometric data, in addition to previously recognized categories like health records and political information. The processing of such data requires stricter requirements, often necessitating explicit consent from the data subject. 'Profiling' is another new term, referring to any automated processing of personal data to assess particular personal aspects relating to a natural person, especially to analyze or predict aspects concerning work performance, economic situation, health, personal preferences, interests, reliability, behavior, location, or change of location. The Act distinguishes between 'normal' profiling and 'high-risk profiling,' with the latter requiring special protection and often a Data Protection Impact Assessment (DPIA).

Covered Employers

The Swiss Federal Act on Data Protection (FADP) applies broadly to the processing of personal data of natural persons by both private persons (including private companies) and federal bodies. This means that virtually all employers in Switzerland, regardless of their size or sector, are subject to the FADP's provisions when they process employee data. The Act's territorial scope is also significant, applying to circumstances that have an effect in Switzerland, even if the data processing activities were initiated abroad. This extraterritorial reach ensures that foreign companies processing the data of individuals in Switzerland must also comply with the FADP, aligning with modern data protection principles seen in regulations like the GDPR.

While the FADP generally applies to all employers, there are minor exclusions. For instance, it does not apply to personal data processed by a natural person exclusively for personal use, or to data processed by the Federal Assembly and parliamentary committees as part of their deliberations. However, these exemptions are highly specific and do not typically apply to the regular processing of employee data by businesses. The FADP's focus on natural persons means it no longer protects legal entities, a change from the previous 1992 Act, which simplifies its application by concentrating on individual privacy rights.

There are no specific size thresholds for employers to be covered by the core principles of the FADP. However, certain formal obligations, such as the requirement to keep a register of processing activities, apply to companies with more than 250 employees. Even companies with fewer than 250 employees may be required to keep such a register if they process particularly sensitive personal data on a large scale or carry out high-risk profiling. This nuanced approach ensures that while fundamental data protection principles apply universally, more burdensome administrative requirements are targeted at organizations with higher data processing volumes or risks. There are no explicit phase-in periods for compliance, as the revised FADP came into effect on September 1, 2023, with immediate enforceability.

Employee Rights

Under the FADP, employees, as data subjects, are granted a comprehensive set of rights regarding their personal data. A fundamental right is the right to information, which mandates that data controllers (employers) must inform employees in an appropriate manner when collecting personal data. This duty to provide information also applies if the data is not collected directly from the employee. Employers must provide, at a minimum, their identity and contact details, the purpose of processing the data, and, if applicable, the recipients or categories of recipients to whom personal data is disclosed. If data is not collected directly from the employee, the employer must also inform them of the categories of personal data being processed.

Employees also have the right to access their personal data. This means they can request information about what data is being processed, the purpose of the processing, the categories of data involved, and the recipients of the data. Access to this information is generally free of charge and must typically be provided within 30 days. This right is crucial for employees to understand how their salary, performance, and other employment-related data are being handled. Furthermore, employees have the right to request the rectification of inaccurate data, ensuring that their personal information held by the employer is correct and up-to-date.

The FADP also introduces the right to data portability, allowing employees to request that the data controller hand over their personal data, which was previously disclosed to them or processed automatically based on consent or a contract, in a commonly used electronic format. They can also request that this data be transferred to another data controller. While the FADP does not directly grant 'wage discussion rights' in the sense of discussing salaries with colleagues, it does empower employees with the right to access their own salary data and understand its processing, which indirectly supports transparency regarding their own remuneration. The Act also provides for the right to object to certain data processing activities, particularly those involving high-risk profiling, and the right to have their data destroyed or anonymized once it is no longer required for the purpose of processing.

Pay Transparency Requirements

The Swiss Federal Act on Data Protection (FADP) does not directly impose pay transparency requirements in the sense of mandating salary range disclosures in job postings, publishing pay scales, or requiring employers to disclose individual salaries to other employees. The FADP is a data protection law, and its focus is on the lawful, good faith, and proportionate processing of personal data, including salary information, rather than on the transparency of remuneration structures themselves.

However, the FADP's general principles of transparency and the data subject's right to information mean that if an employer processes salary data, they must inform the employee about the purpose of this processing, the categories of data involved, and any recipients of this data. This ensures transparency regarding how salary data is handled, but not necessarily transparency regarding the content of salaries across an organization. For example, an employer must inform an employee that their salary data is collected for payroll purposes and may be shared with a pension fund, but the FADP does not compel the employer to disclose the salary ranges for a particular position to job applicants or existing employees.

Therefore, while the FADP contributes to a general environment of data transparency, it does not specifically address pay transparency as a mechanism for promoting equal pay or addressing pay gaps. Requirements for job posting disclosures, salary range publication, or pay scale transparency would fall under separate employment or equal pay legislation, not the FADP. Any data collected for such purposes, however, would then be subject to the FADP's rules on data processing, requiring employers to ensure its security, accuracy, and proper handling in accordance with the data protection principles.

Reporting & Audit Obligations

The FADP does not impose reporting or audit obligations specifically related to pay equity or pay gap analysis. Its focus is on the processing of personal data generally. However, it does introduce several obligations for data controllers (employers) that are relevant to how any data, including salary data, is managed and overseen. One significant obligation is the requirement for companies with more than 250 employees to keep a register of all personal data processing activities. This register must contain specific information, including the identity of the controller, the purpose of processing, a description of the categories of data subject and personal data being processed, categories of recipients, the retention period of personal data, and a description of data security measures. This obligation ensures a documented overview of all data processing, which would include the processing of salary and other employment-related data.

Furthermore, the FADP mandates that data controllers must carry out a Data Protection Impact Assessment (DPIA) if their data processing activities are likely to result in a high risk for individuals' personality and fundamental rights. This applies to situations involving new technologies, large-scale processing of sensitive data, or high-risk profiling. While not a 'pay audit' in the equal pay sense, a DPIA could be required if an employer implements new systems for processing extensive employee data, including salary data, in a way that poses significant privacy risks. The DPIA would involve a description of the proposed processing, an evaluation of the risks, and the measures taken to protect data subjects' rights.

In the event of a data security breach that is likely to incur a high risk for the data subject, the data controller must inform the Federal Data Protection and Information Commissioner (FDPIC) as soon as possible. This reporting obligation extends to any personal data, including salary data, that might be compromised. The controller must document all relevant facts of the incident, its consequences, and the measures taken, retaining this documentation for a minimum of two years. While these are not 'pay gap reports,' they are critical data governance obligations that ensure accountability and transparency in the handling of all personal data, including that which could be relevant to understanding pay structures, albeit from a data security and privacy perspective.

Governance & Enforcement Bodies

The primary governance and enforcement body for the Swiss Federal Act on Data Protection (FADP) is the Federal Data Protection and Information Commissioner (FDPIC). The FDPIC is an independent authority responsible for supervising the application of federal data protection regulations. Its role has been significantly strengthened under the revised FADP, granting it broad and encompassing powers to investigate potential violations. The FDPIC acts as the central point of contact for data subjects (employees) who wish to exercise their rights or file complaints regarding the processing of their personal data.

The FDPIC's responsibilities include providing guidance and recommendations on data protection matters, conducting investigations into alleged breaches, and issuing orders to ensure compliance with the FADP. While the FDPIC does not directly enforce pay equity laws, its oversight of how personal data, including salary information, is processed means it plays an indirect role in ensuring that data handling practices are fair and transparent. For instance, if an employer processes salary data in a manner that violates FADP principles (e.g., lack of transparency about purpose, disproportionate collection), the FDPIC can intervene.

The complaint filing process typically involves a data subject submitting a complaint to the FDPIC, outlining the alleged data protection violation. The FDPIC then assesses the complaint and may initiate an investigation. The FADP also outlines specific exemptions from the FDPIC's supervision, such as the Federal Assembly, the Federal Council, and federal courts in certain contexts. However, for private sector employers and federal bodies processing personal data, the FDPIC remains the key supervisory authority, ensuring adherence to the Act's provisions and safeguarding individual privacy rights.

Monitoring & Evaluation

Monitoring and evaluation under the FADP primarily revolve around ensuring compliance with data protection principles and responding to potential breaches. The Federal Data Protection and Information Commissioner (FDPIC) is central to these activities, possessing strengthened powers to investigate and monitor data processing practices. Inspection procedures can be initiated by the FDPIC based on complaints received from data subjects, or proactively as part of its supervisory mandate. These investigations assess whether data controllers and processors are adhering to the FADP's requirements, including lawful, good faith, and proportionate data processing, as well as adequate data security measures.

Complaints are investigated by the FDPIC, which has the authority to request information, access documents, and conduct on-site inspections. The FDPIC evaluates the evidence to determine if a violation of the FADP has occurred. If a breach is found, the FDPIC can issue recommendations or orders to rectify the situation. While the FADP does not mandate 'audit frequency' for pay equity, it does require data controllers to maintain a register of processing activities, which serves as a continuous record of their data handling practices. This register can be subject to review by the FDPIC during an investigation or audit.

The evaluation criteria for compliance are based on the FADP's core principles, such as data minimization, purpose limitation, accuracy, storage limitation, integrity, and confidentiality. For instance, if an employer collects excessive salary data beyond what is necessary for a legitimate purpose, or fails to secure it adequately, this would constitute a violation. The FADP also requires data controllers to conduct Data Protection Impact Assessments (DPIAs) for high-risk processing activities, which involves a formalized risk analysis and documentation of measures taken to protect data subjects' rights. This proactive assessment mechanism contributes to ongoing monitoring and evaluation of data protection risks.

Enforcement & Penalties

The Swiss Federal Act on Data Protection (FADP) significantly strengthens enforcement mechanisms and introduces stricter penalties for violations, particularly targeting natural persons responsible for intentional breaches. Unlike the GDPR, where fines can be levied directly against companies, the FADP primarily targets the employee(s) responsible for the violation, although companies can be sanctioned in well-defined cases. Anyone who intentionally violates specific obligations of the FADP can face a fine of up to 250,000 Swiss francs (CHF). This represents a substantial increase from the previous maximum fines and underscores the seriousness with which data protection violations are now treated in Switzerland.

Specific violations that can lead to these significant fines include providing false or incomplete information, violating a data subject's right to information, non-compliance with minimum data security requirements, unauthorized disclosure of data abroad, commissioned data processing that does not comply with legal requirements, and breaches of confidentiality requirements. The FDPIC has broad powers to investigate and enforce these provisions. If a data controller fails to comply with an FDPIC order, further penalties may be imposed. The escalation process typically involves the FDPIC issuing recommendations or orders, and if these are not followed, legal proceedings can be initiated to impose fines.

While the FADP does not outline criminal liability in the same way as some other legal frameworks, the substantial fines for intentional violations serve as a strong deterrent. The appeals process for penalties would generally follow Swiss administrative and judicial procedures, allowing individuals or entities to challenge decisions made by the FDPIC or subsequent court rulings. It is important to note that while the FADP's fines are significant, they are generally lower than the maximum fines under the GDPR, which can reach up to €20 million or 4% of a company's total annual worldwide turnover. Nevertheless, the FADP's enforcement regime is designed to ensure robust data protection and accountability for those handling personal data in Switzerland.

Relationship to Other Laws

The Swiss Federal Act on Data Protection (FADP) operates within a broader legal landscape, interacting with various other Swiss and international laws. In the context of employment, the FADP complements existing provisions in the Swiss Code of Obligations (OR) and the Employment Services Act (AVG) and Employment Services Ordinance (AVV). These employment-specific laws govern the processing of personal data for employers and recruitment service providers, primarily by concretizing the principle of proportionality under data protection law. This means that while the FADP sets the overarching data protection framework, sector-specific laws provide additional details on how these principles apply in the employment context, ensuring that data processing is limited to the minimum necessary for the purpose.

The FADP is also designed to be largely compatible with the European Union's General Data Protection Regulation (GDPR). This alignment is a key objective of the revised FADP, aiming to ensure the continued free flow of data between Switzerland and the EU and to maintain Swiss companies' economic opportunities. While there are differences – for example, the FADP primarily targets natural persons for fines, unlike the GDPR which can fine companies directly, and the FADP generally permits data processing without a legal basis like consent unless specific conditions apply – the overall principles and many requirements are similar. This compatibility is crucial for international businesses operating across Switzerland and the EU.

In cases of conflict, the FADP generally takes precedence in matters of personal data protection. However, specific provisions in other federal laws that regulate public registers for private legal transactions, or data processing in court proceedings, may take precedence or complement the FADP. The FADP also interacts with international law treaties ratified by the Federal Assembly that have legislative content, as well as resolutions of international organizations binding on Switzerland. This intricate relationship ensures that while the FADP provides a strong general framework for data protection, it also integrates with and respects specialized legal provisions in other areas, creating a comprehensive and coherent legal environment for data handling.

International Context

The Swiss Federal Act on Data Protection (FADP) is deeply rooted in an international context, particularly influenced by global trends in data privacy and the European Union's data protection framework. A primary objective of the FADP's revision was to align Swiss privacy law with the EU General Data Protection Regulation (GDPR), which has been in effect since May 25, 2018. This harmonization is critical for ensuring the continued free flow of data between Switzerland and the EU, thereby safeguarding Swiss economic interests and maintaining its status as a country with an adequate level of data protection. While not identical, the FADP shares many core principles and requirements with the GDPR, such as data subject rights, obligations for data controllers, and the concept of data protection by design and by default.

Beyond the GDPR, the FADP also reflects broader international conventions and principles related to privacy and human rights. Switzerland is a member of the Council of Europe and has ratified Convention 108, the world's first legally binding international instrument in the data protection field. The FADP's emphasis on protecting the personality and fundamental rights of natural persons aligns with the principles enshrined in international human rights instruments. Furthermore, while not directly a pay equity law, the FADP's robust framework for protecting personal data, including sensitive information, indirectly supports the principles of fair treatment and non-discrimination that underpin ILO Conventions such as C100 (Equal Remuneration Convention) and C111 (Discrimination (Employment and Occupation) Convention). By ensuring that data, including that which could reveal pay disparities, is processed lawfully and transparently, the FADP contributes to an environment where such issues can be identified and addressed, even if it does not directly mandate pay equity measures.

Implementation Timeline

Compliance Checklist

Sources and References