Data Protection and Privacy 2025

SWITZERLAND Law and Practice Contributed by: Hugh Reeves, Jürg Schneider and David Vasella, Walder Wyss Ltd

areas relevant to fundamental rights; and non- binding measures. 1.6 Interplay Between AI and Data Protection Regulations As mentioned in the foregoing, there is no spe - cific law in Switzerland governing the use of AI. In this respect, general laws apply to the use of AI systems. These include, for example: • data protection law (if personal data is pro - cessed during training or use); • secrecy protection law (if secret information is used for training or as input); • employment contract law (if the personal data of applicants and employees is processed and if AI affects the employer’s duty of care); • public labour law (eg, when duties to co- operate take effect or when monitoring behaviour is discussed); • personality rights (eg, when conversations or team calls are recorded); • unfair competition law (when AI-generated content can be misleading); • copyright law (eg, if AI is trained with works or uses works as input, and if the protection of output is at issue); • criminal law (if non-public conversations are recorded or if AI is used in general in relation to criminal behaviour); and • product liability and other liability laws. Industry-specific regulation may apply as well. A few supervisory authorities have already pub - lished their expectations in relation to the use of AI, in particular FINMA with its Guidance 08/2024 Governance and Risk Management when using Artificial Intelligence, published on 18 December 2024.

Private actors have also started to set non-bind - ing rules. This applies to exposed actors, such as: • the media (the Swiss Press Council’s journal - istic guidelines); • political parties (eg, KI-Kodex of the Greens, the Green Liberal Party (GLP), the Social Democratic Party of Switzerland (SP), the Middle and the Liberals (FDP)); and • research and education institutions (eg, rec - ommendations for dealing with generative AI at the University of Zurich). Numerous private companies have also issued or are in the process of issuing guidelines, codes and instructions, some of which are public and some of which are not. In addition, in certain cases, the EU AI Act will be applicable to Swiss companies trading with the EU market or otherwise working with EU coun - terparties, who may be exposed to AI-generated output. Switzerland has implemented the Council of Europe’s Convention for the Protection of Indi - viduals with regard to Automatic Processing of Personal Data (Convention 108) through the FADP. In addition, although Switzerland is not a mem - ber of the EU or the EEA and is under no obliga - tion to implement the EU GDPR, the EU is Swit - zerland’s most important partner, and ensuring a level playing field for Swiss and EU-based companies is an important policy objective. The FADP largely aligns with the GDPR, such that a 2. Privacy Litigation 2.1 General Overview

423 CHAMBERS.COM

Powered by