New data protection legislation
The data protection legislation has been completely revised in order to adapt to new technological and societal conditions and to the requirements of international law. It came into force on 1 September 2023.
1. What has happened so far
2. International framework
Like Swiss law, international law has also had to take account of technological developments.
Within the Council of Europe, the first Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data was signed in Strasbourg on 28 January 1981. The Federal Council ratified the Convention in 1997; it came into force in Switzerland on 1 February 1998.
- Übereinkommen zum Schutz des Menschen bei der automatischen Verarbeitung personenbezogener Daten vom 28. Januar 1981 / Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data of 28 January 1981 / Convenzione del 28 gennaio 1981 per la protezione delle persone in relazione all’elaborazione automatica dei dati a carattere personale
(SR 0.235.1 / RS 0.235.1 / RS 0.235.1) (This document is not available in English)
In 2018, an Amending Protocol was adopted to meet the challenges posed by new information and communication technologies and to ensure the effective implementation of the Convention. The Protocol was signed on 21 November 2019 and ratified on 7 September 2023 by Switzerland.
The modernised Convention 108, also known as Convention 108+, will come into force once 38 States Parties have ratified the Protocol of Amendment; it is not yet in force.
On the European Union side an initial Directive on data protection was adopted in 1995. Switzerland, however, is not bound by this instrument.
In 2012, the European Commission proposed a comprehensive reform of the Data Protection Directive adopted in 1995, with the aim of improving the privacy rights of data subjects while taking account of the digital economy. On 27 April 2016, the General Data Protection Regulation (GDPR) and Directive (EU) 2016/680 were adopted. Directive (EU) 2016/680 is binding on Switzerland to the extent that it forms part of the development of the Schengen acquis. The GDPR, on the other hand, is not binding on Switzerland.
- Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHI
- Regulation (EU) 2016/679 of the European Parliament and of the Council of the 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Text with EEA relevance)