Data Protection and Privacy 2025

SWITZERLAND Law and Practice Contributed by: Hugh Reeves, Jürg Schneider and David Vasella, Walder Wyss Ltd

Swiss sovereignty and are prohibited under Arti - cle 271 of the SCC, unless they are authorised by the competent Swiss authorities or take place within the framework of mutual legal assistance proceedings. A violation of Article 271 of the SCC is punishable by imprisonment of up to three years or a fine of up to CHF540,000, or both. It is important to be aware that the trans - mission of evidence abroad to comply with a for - eign order requiring the production of evidence does not prevent the application of Article 271 of the SCC. Furthermore, evidence can only be handed over to foreign authorities lawfully by fol - lowing mutual legal assistance proceedings or by obtaining authorisation from the competent Swiss authorities. The blocking statute in Article 273 of the SCC additionally prohibits industrial espionage. According to this article, anyone who seeks to obtain a manufacturing or trade secret in order to make it available to an external official agency, a foreign organisation, a private enterprise or the agents of any of the foregoing; and anyone who makes a manufacturing or trade secret available to a foreign official agency, a foreign organisa - tion, a private enterprise or the agents of any of the foregoing is criminally liable. Therefore, manufacturing and business secrets with sufficient connection to Switzerland may only be released or communicated abroad when: • the owner of the secret relinquishes its intent to keep the information secret; • the owner of the secret agrees to disclose this information; • all third parties (who have a justifiable interest in keeping the information secret) consent to such a disclosure; • Switzerland has no immediate sovereign interest in keeping the information secret; and

• all requirements set forth by the FADP (in particular, as regards cross-border transfers) are complied with. 5.5 Recent Developments On 14 August 2024, the Federal Council decided to add the United States to the list of countries with an adequate level of data protection in accordance with Annex 1 of the DPO, provided that the recipient is certified under the Swiss- US Data Privacy Framework (Swiss-US DPF). The amendment came into force on 15 Sep - tember 2024. Some uncertainty remains as to the long-term reliability of the Swiss-US DPF in light of President Trump’s recent weakening of the Privacy and Civil Liberties Oversight Board, an organisation that exercises oversight within the Swiss-US DPF. The Swiss-US DPF has the following effects in particular. • Various importers such as Microsoft, Google, Amazon and Salesforce have already certified according to the Swiss–US DPF. An exporter whose export is subject to the FADP can invoke the Swiss–US DPF. • Transfers under this framework are permissi - ble without the SCCs having to be concluded. • Intra-group transfers can also be based on the Swiss-US DPF, provided that the US recipient is certified (and can comply with the corresponding obligations and conditions, including the requirements for intra-group onward transfers). • No TIA is required if a transfer is based on the Swiss or EU-US DPF, and a simpler TIA may be carried out for other transfers to US recipients. • If an exporter relies on the certification of an importer, it should ensure that the main -

431 CHAMBERS.COM

Powered by