QUESTION: Under what conditions is the transfer of personal data by the local subsidiary to the parent company located in a country outside the European Economic Area (EEA) lawful under national law?

According to the Swiss Federal Act on Data Protection (FADP), a transfer of personal data of employees out of Switzerland is only lawful if the personal rights of the data subject are not seriously threatened by the transfer. In particular, a transfer is deemed to imperil the personal rights of the data subject if the country to which the data is transferred does not guarantee an adequate level of protection.

A transfer of data from Switzerland to a country without adequate protection is still possible, but it is required to meet one of the specific exceptions for data transfer abroad listed in Article 6 para. 2 FADP.

The U.S.-Swiss Safe Harbor Framework Agreement (Safe Harbor), which is identical to the U.S.-EU Safe Harbor Framework, is one of the specific exceptions under Article 6 para. 2 FADP for the transfer of data. Under this Agreement, entities or organizations register and commit themselves ("self-certification") to comply with the principles of data protection provided in the Safe Harbor.

Once an entity is self-certified, no further authorisation is required to transfer personal data to the U.S.

However, following the decision of the European Court of Justice ruling on October 6, 2015 that the U.S.-EU Safe Harbor Framework was invalid, Swiss authorities are currently questioning the perpetuation of the U.S.- Swiss Agreement. At this stage, the Swiss authorities – through the Swiss Data Protection Commissioner (FDPIC) – recommend using data transfer agreements for data transfers to U.S. recipients. FDPIC requires that these additional agreements regulate the following points:

  • A duty on the data transferor and transferee to inform affected data subjects in a clear and comprehensive manner about potential interception by U.S. authorities so that the data subjects can exercise their rights.
  • An undertaking from the data transferor and transferee to provide the affected data subjects with the necessary means for protecting their rights, to carry out the corresponding procedures, and to accept the resultant decision.

In the case of a non-certified Safe Harbour entity (such as Umpire), the data may still be transferred if the data subject has agreed to the transfer in the specific case, or if the disclosure is made within the same legal person or company or between persons or companies under the same management, provided that those involved are subject to data protection rules that ensure an adequate level of protection. In the latter case, the Federal Data Protection and Information Commissioner must be informed of the data protection rules.

QUESTION: When using the EU Standard Contractual Clauses, does Umpire still need a national authorisation to proceed with the transfer? If so, under what conditions is authorisation granted?

Exceptions for data transfer from Switzerland to a country without adequate protection are listed in Article 6 para. 2 FADP. The use of contractual clauses ensuring an adequate level of protection, such as the EU Standard Contractual Clauses, constitutes one of these exceptions. No further authorisation is necessary for the transfer.

QUESTION: Under what conditions are local subsidiaries allowed to transfer whistle-blowing reports containing personal data within a multinational to a country outside the EEA?

Swiss law does not specifically regulate whistle-blowing within the private sector. The rules outlined above also apply to the transfer of whistle-blowing reports containing personal data.

According to current Swiss law, an employee is not authorized to provide information to third parties if such information could adversely affect his/her employer, unless higher interests are at stake.

However, a bill is being debated in the Swiss parliament that aims to regulate and protect whistle-blowers through a three-step procedure: the employee would have to alert his/her employer in case of wrongdoings. In the event the employer does not remedy the deficiencies, the employee may then transfer the information to the authorities or as a last resort to the public. Alternatively, the employer can set up an internal reporting system.

Monitoring of Employees

QUESTION: What are the relevant laws concerning monitoring of employees at work – both off- and online?

QUESTION: If evidence of misconduct or breach of contractual duties is gathered by monitoring, is there something comparable to the U.S. "Fruit of the Poisonous Tree Doctrine" (i.e., evidence gathered illegally cannot be presented in court in dismissal cases)?

In general, evidence gathered unlawfully is prohibited and not binding in Courts. However, the judge may, at his/her discretion, consider the evidence admissible if public interest is deemed overriding.

QUESTION: What type and scope of information/consultation/co-determination rights exist for employee representatives in connection with monitoring of employees?

Employers must notify their employees in advance in a clear and plain manner about the monitoring. Employees must be involved in the planning, installation, and operation of the monitoring system. Furthermore, the employer shall obtain an employee's consent before consulting his/her private data carrier, or it must have suspicion based on factual indications that an employee has taken part in unlawful activities. Vague impressions or the lack of trust in the employee do not constitute sufficient factual indications.

QUESTION: Will the upcoming EU data privacy/data protection regulation change the legal landscape when it comes to monitoring of employees?

Since Switzerland is not a member of the European Union, EU regulations are not directly applicable. Therefore, the upcoming EU data privacy shall not change the legal landscape regarding monitoring of employees. Nevertheless, Swiss authorities remain attentive to the European legislation changes.

QUESTION: What damages/remedies do employers face in case of illegal monitoring of employees?

In case of unlawful monitoring of employees, the employer faces civil, administrative, and criminal sanctions. The employer can be ordered to compensate an employee for moral damage as a result of infringing the employee's personal rights due to the unlawful monitoring. As for criminal charges, employers can be subject to sanctions ranging from monetary penalties (for opening private mail in order to acquaint themselves with its contents) to a deprivation of liberty up to three years (for monitoring and recording conversations without the parties' consent).

Use of Social Media

QUESTION: Can an employee be dismissed for cause if he or she uploads to Facebook incriminating photos of inappropriate behaviour at the workplace and/or for posting on Facebook or other social media insulting or derogatory comments about the employer and/or other employees?

Swiss law does not specifically regulate employee's use of social media. Such use falls under the employees' general duty of care and loyalty inherent in any employment contract. According to this duty, the employee must carry out the work assigned to him with due care and loyally safeguard the employer's legitimate interest. The duty of loyalty implies that the employee refrains from criticizing his superiors or the company strategy, or from acting inappropriately. Moreover, insult or derogatory comments (posted on social media or said face to face) constitute an infringement of personality rights.

It should be noted that in Switzerland, the principle of contractual freedom prevails and either party is free to terminate the employment contract by observing the applicable notice period. This being said, both the infringement of personality rights and the breach of the duty of loyalty may constitute a valid reason justifying a summary dismissal, i.e., without notice and with immediate effect. The law defines such valid reason as being any circumstance under which the terminating party cannot be expected in good faith to continue the employment relationship even during the notice period. The court decides, in its own discretion, whether, given the circumstances of the individual case, the contentious issue sets a sufficient basis for the immediate termination of the employment relationship. According to case law, only a particularly serious offence may justify a summary dismissal.

Originally published in Employee Data Privacy in Europe: The Essentials for Multinational Employers by the Employment Law Alliance.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.