Swiss-US Data Privacy Framework enters into force
Following the failed Safe Harbor Agreement (2015, Schrems I ruling) and the Privacy Shield (2020, Schrems II ruling), the EU officially brought a new data protection agreement with the US into force on 10 July 2023 with the Privacy Shield 2.0 and subsequently intensified negotiations between Switzerland and the US on a similar framework.
With the Federal Council’s decision on 14 August 2024 to recognise the USA as a country with adequate data protection, the long-awaited ‘Swiss-US Data Privacy Framework’ will officially enter into force on 15 September 2024 with a corresponding amendment to the Data Protection Ordinance.
According to data protection activist Max Schrems, the Trans-Atlantic Data Privacy Framework is largely a copy of the Privacy Shield. The European Commission’s third attempt to reach a stable agreement on data transfer between the EU and the USA has already been referred back to the European Court of Justice (ECJ). Contrary to the European Commission’s claims, there is little change to US law: the fundamental problem of FISA 702 has not been addressed by the US, meaning that only US persons still have constitutional rights and cannot be monitored without cause.
The European Court of Justice could then even suspend the new agreement during the proceedings. In terms of legal certainty and the rule of law, we will then get an answer as to whether the small improvements made by the Commission were sufficient or not. In the last 23 years, all agreements between the EU and the US have been declared retroactively invalid – now we are simply adding two more years of legal uncertainty.’
In this respect, it remains exciting to see whether the agreement will be overturned again and whether Switzerland will return to the decision and traditionally follow the EU’s decision with a delay.
The situation regarding data traffic with the USA therefore remains uncertain.
