LAUSANNE. The second revision of Switzerland's data protection framework has entered its final drafting stage, with a joint parliamentary committee reconciling the last differences between the two chambers and an agreed text expected before the summer recess.
At the centre of the remaining dispute is the treatment of automated profiling. The National Council wants consent required whenever personal data is used to evaluate personality traits likely to produce legal or similarly significant effects; the Council of States prefers a lighter regime under which profiling requires consent only where sensitive data is involved. The compromise now circulating ties the consent duty to the effect produced rather than the data used.
The revision is the second in quick succession. The first, which took effect in September 2023, modernised definitions and raised fines to 250,000 francs against individuals, but left questions of algorithmic decision-making, cross-border transfers to jurisdictions without adequacy findings, and the powers of the Federal Data Protection Commissioner largely untouched. The current bill is the attempt to finish that work.
The trigger for reopening the file so soon was partly external. The European Union's data protection authorities have signalled that Switzerland's adequacy status, which permits personal data to flow freely between the two economies, depends on keeping pace with European practice on automated decisions. Swiss exporters, for whom uninterrupted data flows are existential, have pressed Parliament accordingly.
The drafting committee must also settle the Commissioner's enforcement toolkit. The bill proposes order-making powers, allowing the authority to require companies to alter or suspend processing, replacing the current arrangement under which the Commissioner can only recommend and must sue to compel. Business federations accept the powers in principle but want judicial review built in before orders take effect. The compromise under discussion would route urgent orders through the Federal Administrative Court in St. Gallen on an expedited timetable, preserving a judicial check without hollowing out the new authority.
Early numbers shape the debate. The Commissioner's office handled roughly 1,400 consultations and complaints last year with a staff of fewer than sixty, a workload its annual report calls unsustainable. The bill accompanies the new powers with a phased staffing increase of some twenty posts, which the finance committees approved only after pointed exchanges about regulatory creep.
Technology companies and banks have focused their lobbying on a safe harbour for anonymised and pseudonymised data. A professor of information law at the University of Zurich said: “Everyone agrees anonymised data should fall outside the act; no one agrees where anonymisation ends and pseudonymisation begins, and that border is where the industry lives.”
Consumer and digital rights groups argue the compromise text still lags European protection in one conspicuous respect: it contains no general right to object to processing based on legitimate interest, leaving individuals to invoke specific grounds instead. The Digital Society association says the omission will prove the revision's most litigated gap, and has already signalled that it will support test cases once the new law applies.
Small business organisations counter that the cumulative weight of the two revisions is being felt well below the boardroom level. The federation of small and medium enterprises estimates compliance costs for a typical firm at several thousand francs a year and has won a concession exempting businesses under fifty employees from the duty to maintain full processing records, except for high-risk processing.
If the committee settles the profiling formula as expected, the bill returns to both chambers for a final vote in the autumn session and would take effect in 2027, with a two-year transition for existing processing systems. The Commissioner's office has already begun recruiting for the order-making unit it expects to lead, advertising posts for lawyers with technology backgrounds that have historically been hard to fill at federal salaries.
The larger significance is directional. Two decades ago Swiss data protection was a quiet administrative backwater; the revision now completing treats it as economic infrastructure, the condition on which data-dependent industries keep their access to the European market.