Swiss Data Protection Authority Finds Swiss-US Privacy Shield Inadequate

Key Takeaways:

• Switzerland aligns with the Schrems II decision
• +5,000 organizations impacted by the Swiss announcement
• Contractual and technical measures, on an ad hoc basis, could be put in place to protect adequately data
• Absent viable measures that meet Swiss law requirements, parties should not engage in cross-border data transfers to the U.S.

Following the Court of Justice of the European Union's (CJEU) lead in the Schrems II case, on September 8, 2020, the Swiss Federal Data Protection and Information Commissioner (FDPIC) announced that the Swiss-US Privacy Shield regime is inadequate for the purposes of personal data transfers from Switzerland to the U.S. The FDPIC does not have authority to invalidate the Swiss-US Privacy Shield regime. However, in practice, the FDPIC's announcement casts serious doubt on the viability of the Swiss-US Privacy Shield as a compliance mechanism for Swiss-US data transfers. The announcement affects