Liability under the Revised Swiss Data Protection Act.

The modernized Swiss Data Protection Act (nFDAP) came into force on September 1, 2023. It includes criminal sanctions for the intentional violation of data protection obligations.

Under the revised act, the intentional breach of the new data protection obligations may now lead to criminal prosecution and fines of up to CHF 250,000. These fines are not generally imposed on the company itself, but rather directly target responsible individuals (e.g., board members, executive management, compliance officers, etc, …). The following actions may result in sanctions:

Violation of the Duty to Provide Information and Cooperate (Art. 60 nFDAP)

• Intentionally providing false or incomplete information to data subjects
• Intentionally providing false information to supervisory authorities or refusing to cooperate

Unlawful Data Transfers:

According to Art. 61 nFDAP, private individuals are liable if personal data is unlawfully disclosed and minimum technical and organizational security standards are violated. This includes

• Intentional transfer of personal data to third countries without a legal basis
• Intentional transfer of personal data to data processors without a legal basis
• Intentional disregard of the minimum requirements for technical and organizational measures (TOMs

Disregarding Orders from the Supervisory Authority (Art. 63 nFDAP)