Switzerland’s New Data Privacy Landscape: Understanding the revFADP and its Significance

Switzerland, often regarded as a hallmark of precision and forward-thinking, has now made a substantial leap in the domain of online privacy and cybersecurity. From September 1, 2023, the Swiss digital realm has embraced a transformative change — the implementation of the revised Federal Act on Data Protection (revFADP). This act, updating the Swiss data protection law of 1992, not only fortifies the rights of consumers regarding their data but also strategically aligns Swiss data protection norms with the EU’s General Data Protection Regulation (GDPR).

Key Highlights of the revFADP:

• Broadened Scope: The law will predominantly apply to the processing of personal data of natural persons, excluding data of legal entities.
• Enhanced Definition: Sensitive data classifications now extend to genetic and biometric data, necessitating explicit consent for processing.
• Data Privacy Principles: Introduction of principles such as ‘privacy by design’, requiring developers to ensure privacy is part of the design process of any product, and ‘privacy by default’, requiring maximum data privacy settings to be turned on by default (i.e. without the users need for intervention).
• Data Protection Advisor (DPA): Private businesses can now designate a DPA. Companies with a DPA can, in certain circumstances, sidestep consultations with the Federal Data Protection and Information Commissioner (FDPIC).
• Records of Processing Activities (ROPA): Most businesses are required to maintain a regularly updated ROPA, centralizing their data strategy and compliance.

Impacts and Implications for Swiss Citizens and Entities:

• Empowered Data Ownership: Swiss citizens gain more control and rights over their personal information.
• Business Transformation: Companies adhering to the revFADP can distinguish themselves, strengthening customer trust.
• Clearer Cross-border Transactions: The act ensures that Swiss data practices are of the highest international standard, providing clarity on global operations.

What You Should Do:

As a Business:

• Data Strategy Revision: Incorporate ‘privacy by design’ and ‘privacy by default’ principles into your operations.
• Consider Appointing a DPA: Evaluate if a DPA aligns with your business’s scale and operational complexity.
• Update Breach Protocols: Ensure a rapid response plan is in place for potential data breaches.
• Stay Informed on Cross-border Directives: Regularly check the Swiss Federal Council’s list of countries with adequate data protection.

As an Individual:

• Stay Informed: Familiarize yourself with your rights under the revFADP.
• Exercise Your Rights: Engage with businesses if you feel they aren’t respecting your data rights.
• Safe Online Practices: Always adopt online safety measures, like strong passwords and being cautious of unsolicited communications.

In conclusion, as Switzerland paves its new trajectory in data privacy, it’s imperative for businesses and individuals to understand and navigate this evolving landscape. Embracing the revFADP isn’t just about compliance, it’s about fostering a digital culture where privacy is a fundamental right, not an afterthought.

At eduCYBER Sàrl, while we continually observe the evolving landscape of online privacy and cybersecurity, we believe that knowledge is power. Stay informed, stay safe, and remember, in the world of the internet, privacy is your right, not a privilege.