Data Protection and GDPR Overview

A public authority or service of the Confederation, or a person entrusted with public tasks on behalf of the Confederation.

When a federal body acts under private law, the same data protection rules apply as for private individuals.

Data that has been processed, organized, structured or presented in a specific context to make it meaningful or useful.

Raw, unorganized facts.

The GDPR applies to Swiss entities that have an establishment within the EU or process personal data of individuals within the EU, regardless of where the processing takes place.

The GDPR rule that applies to data processing activities with the aim of offering goods or services to data subjects in the EU.

The GDPR rule that applies to data processing activities related to monitoring behavior of individuals within the EU.

Any operation or set of operations performed on personal data, such as collection, storage, use, or deletion.

The individual to whom the personal data relates.

The entity or person that determines the purpose and means of data processing.

A third party handling data on behalf of the controller.

Data requiring extra protection, such as health information, religious beliefs, or biometric data.

The principle that any government action must have a legal basis. This ensures transparency and accountability, preventing arbitrary actions.

Regulations that are stricter for government bodies compared to private entities due to their authoritative nature, lack of choice for individuals, and the need for legal justification for all actions.

The right to privacy is protected from unwarranted government intrusion. This ensures personal autonomy and freedom.

Public bodies are subject to many of the same data protection provisions as private individuals and entities, including key principles like data minimization, purpose limitation, and data security.

Federal bodies have specific data protection provisions tailored to their unique circumstances. These may include rules on data retention, data sharing between agencies, and the role of data protection officers.

Examples include codes of conduct, representatives for data subjects, and specific provisions on data processing for private entities.

The FADP outlines how to handle data protection when data is processed by an entity other than the 'controller,' such as an external company hired to manage databases or software.

This ensures that data is only used for its intended purpose, minimizes risks, and protects individuals' rights.

Data privacy should be built into the design phase of any system or process, minimizing potential risks and ensuring compliance from the outset.

When multiple bodies (federal, cantonal, or private) process personal data together, the Federal Council sets rules for controlling this process and assigning responsibilities.

Federal bodies are allowed to process personal data only if a legal basis exists, meaning it's allowed by a specific law.

Processing of sensitive personal data, conducting profiling, or actions that might severely harm someone's rights requires a statutory basis in a formal law, which is a higher level of legal authority.

Processing sensitive personal data or profiling may only require a statutory basis in a substantive law, which is less formal, if it's essential for a task specifically mandated by a formal law and poses low risks to individuals.

The requirement for a statutory basis can be overridden if certain conditions are met. For example, the Federal Council may authorize processing if individuals' rights are not at risk.

Federal bodies can disclose personal data only if authorized by a specific law. This law must be evaluated for its level of formality and whether it falls under specific exceptions for processing sensitive data.

When several organizations work together to process personal data, the Federal Council defines responsibilities and controls.

The Federal Council establishes specific rules for controlling and assigning responsibility for processing personal data in joint data processing.

The legal basis for processing personal data is governed by specific laws tailored to the type of data being processed and the risks involved.

Processing personal data, especially sensitive data, must have a clear legal foundation to protect individuals' rights and ensure transparency.

The Federal Data Protection Act aims to ensure individuals' rights are protected when their personal information is processed. This includes safeguarding their privacy and ensuring transparent and fair data handling.

The FADP applies to processing activities that have an effect in Switzerland, even if the data is processed outside of the country.

The FADP covers the processing of any type of information that relates to an individual who can be identified, either directly or indirectly.

The FADP applies to all individuals and federal authorities in Switzerland.

Swiss cantonal laws, such as the Zurich IDG-ZH, have similar data protection principles as the FADP but are tailored to the specific needs of public administrative bodies.

The GDPR applies to entities established within the EU that process personal data, regardless of where the data is processed.

Even if an entity is outside the EU, they must comply with the GDPR if they offer goods or services to individuals in the EU or monitor their online behavior.

The FADP applies to private individuals and federal bodies, including those contracted to perform public duties.

Organizations can secure rights to data through contracts that specify how the data is used, accessed, and deleted.