Since mid-September 2024, the United States has been included on the Swiss list of countries offering an adequate level of data protection. The canton of Friborg points out, however, that the data outsourcing rules set out in the cantonal data protection law remain valid.
It’s official since September 15, 2024: the United States is considered by Switzerland to be a country offering an adequate level of data protection. A month earlier, the Federal Council had already decided to include the United States on the list of countries concerned. This decision is motivated by a new data protection framework, the Swiss-US Data Privacy Framework, but it is also linked to the introduction of a Data Protection Supervisory Court.
However, for organizations that want to store their data in a US company’s cloud, for example, little has changed. At least that is the opinion of the canton of Fribourg. In a press release, the State Chancellery speaks of “limited effects on the outsourcing measures”.
“The transfer of personal data from Switzerland to these companies in the United States may be permitted,” indicate the authorities. But in the case of outsourcing, data protection conditions must be respected.
The State Chancellery refers in this regard to the cantonal law on data protection (LPrD) and the provisions anchored therein regarding data outsourcing. “The measures provided for by articles 18-21 of the law of October 12, 2023 on data protection (LPrD; RSF 17.1) do not change. They must continue to be respected. The processing of personal data, including sensitive data, may be outsourced under the conditions set by the LPrD. Thus, despite this adequacy decision by the Federal Council, a public body subject to the LPrD must, when outsourcing to a certified company in the United States, ensure compliance with the legal requirements listed in articles 18 to 21 LPrD. specifies the press release from the Friborg authorities.
Canada
