FADP Updates – What You Need to Know

• data concerning religious, philosophical, political, or trade union opinions or activities;
• data concerning health, privacy, or racial or ethnic origin;
• genetic data;
• biometric data that uniquely identify a natural person;
• administrative and criminal prosecutions and sanctions;
• data concerning social assistance measures.

• data concerning religious or philosophical beliefs, political, or trade union opinions;
• data concerning health, sexual orientation, racial or ethnic origin;
• genetic data;
• biometric data

• the processing of personal data worthy of special protection;
• the processing of sensitive personal;
• high-risk profiling by private persons
• profiling by a federal body.

• the data processed consists of sensitive personal data
• profiling is carried out;
• the purpose of the processing or the type of processing is likely to result in a serious interference with the fundamental rights of the data subject.

The controller is to provide the following information within 30 days from the data subject’s access request (concerning the processing of the data subject’s personal data):

• the identity and contact details of the data controller;
• the categories of personal data being processed;
• the purposes of processing;
• the duration of storage of such personal data or the criteria used to determine such duration if the former is not available;
• if the personal data was not collected directly from the data subject, the source of such personal data;

Personal data may only be transferred to foreign countries or international bodies that are deemed to provide an adequate level of protection, as verified by the Swiss Federal Council. In the absence of such an adequacy decision, personal data can be transferred abroad pursuant to:

• an international treaty;
• contractual provisions between the controller and the processor and its contracting partner communicated beforehand to the FDPIC;
• specific safeguards prepared by the competent federal body and previously communicated to the FDPIC;
• standard data protection clauses subject to the prior approval of the FDPIC;
• binding corporate rules previously approved by the FDPIC.

Several exceptions to the transfer of personal data abroad are also provided for under the FADP. These include:

• the explicit consent to the transfer of personal data being granted by the data subject;
• the transfer of personal data is related to the performance or the conclusion of a contract between the controller and the data subject or the controller and a contracting partner in the interest of the data subject;
• the transfer is necessary to safeguard an overriding public interest, enforce a legal claim before a court of law, to protect the life of the data subject or a third party where it is not possible to obtain the prior consent of the data subject within a reasonable time, the data subject has granted access to the data and has not expressly prohibited its processing, and the data originates from a legal register which is available to the public or to persons that possess a legitimate interest to such register.

• Adequacy decisions of the European Commission;
• Standard Contractual Clauses; and
• Binding Corporate Rules.