Another Privacy Shield Bites the Dust

Published On September 9, 2020 | By Charlotte Kress and Mason Weisz | International, Privacy
TwitterLinkedInFacebookRedditCopy LinkEmailPrint

While not outright eliminating the Swiss-U.S. Privacy Shield, the Swiss Data Protection Authority, the Federal Data Protection and Information Commissioner (FDPIC), announced in a position paper on September 8, 2020 that he no longer considers the Swiss-U.S. Privacy Shield adequate for the transfer of personal data from Switzerland to the U.S. 

The Commissioner’s position paper follows an annual assessment of the Swiss-U.S. Privacy Shield regime and echoes a recent ruling on data protection by the Court of Justice of the European Union (CJEU) in the case known as Schrems II. The Commissioner reasoned that, although the regime guarantees special protection rights for persons in Switzerland, it does not provide an adequate level of protection for data transferred from Switzerland to the U.S. pursuant to Switzerland’s Federal Act on Data Protection (FADP). Consequently, the U.S. is now classified as having an “insufficient” level of data protection to support international data transfers without restrictions. 

Like the CJEU ruling, the Commissioner also concluded in the position paper that the use of alternative data transfer mechanisms, such as Standard Contractual Clauses (SCCs) or Binding Corporate Rules, would require companies to conduct a risk assessment. In cases where the assessment indicates that personal data is not adequately protected, businesses would potentially need to implement additional safeguards. 

Notably, the FDPIC does not have the authority to invalidate the Swiss-U.S. Privacy Shield Framework outright, and its position is subject to any rulings to the contrary by Swiss courts. But, in light of the CJEU ruling in Schrems II and the Commissioner’s policy paper, companies should consider alternatives to relying on the Swiss-U.S. Privacy Shield framework as a valid data transfer mechanism.

Given that the FDPIC’s rationale for its new position is based on essentially the same rationale as the Schrems II decision, it is possible that methods for addressing the Schrems II decision would be equally effective in addressing this Swiss development, in at least some cases. Some of ZwillGen’s original proposals for such measures appeared in our article Supplementing SCCs to Solve Surveillance Shortfalls. Note, however, that Swiss law explicitly allows certain alternative legal exceptions for transfers that the GDPR does not (see Art. 6(2) of the FAPD), so the full range of options differs.

About The Authors

Charlotte is a ZwillGen Fellow. Prior to working at ZwillGen, Charlotte was the Elise Berkower Memorial Fellow at the Future of Privacy Forum in Washington, D.C., where she specialized in advertising technology and European privacy law. Last fall, she also spent time working at ZwillGen on CCPA-related matters.

Mason helps clients navigate a constantly shifting web of domestic and international laws regulating data collection, marketing, data sharing, computer crime, data security, electronic surveillance, online content, children’s privacy, financial privacy, information management, and other areas of privacy and Internet law. A former web designer, he has extensive experience with issues relating to digital media, new technology and e-commerce.