In a nutshell

Art. 15 FADP lists certain further obligations for a data protection representative pursuant to Art. 14 FADP. The representative must keep a record of the processing activities for the controller(s) and provide the FDPIC with the relevant information upon request. Furthermore, the representative must provide data subjects with information on the exercise of their rights upon request.

I. general

1 Art. 15 FADP enumerates certain further obligations of the data protection representative in addition to the obligations under Art. 14 para. 2 and 3 FADP (function as contact point, Art. 14 para. 2 FADP, and publication of contact details, Art. 14 para. 3 FADP). The enumeration in Art. 15 FADP is to be understood as non-exhaustive due to the broad role of the representation as a contact point.

II. duties of the Data Protection Representative

A. list of processing activities (para. 1)

2 According to the wording, the data protection representative must keep a register of the processing activities of the data controller (para. 1). This obligation goes further than the obligation under Art. 30 para. 1 DSGVO, according to which the EU data protection representation must keep a register only for processing activities that are subject to its competence. This excessive obligation, which in any case goes significantly further than the DSGVO, is likely to be a legislative oversight.

3 The exemption for companies with fewer than 250 employees pursuant to Art. 12 para. 5 FADP in connection with Art. 24 DPA does not apply. Art. 24 DPA does not apply to the data protection representation. According to Art. 14 para. 1 lit. a FADP, the data protection representative must only be designated if the processing by the data controller poses a high risk to the personality of the data subjects, among other things. This corresponds to the general risk-based approach of the FADP, as expressed in particular in Art. 24 FADP.

4 The information in the directory must comply with Art. 12 para. 2 FADP. In practice, the controller will keep a partial directory of processing activities that have an impact on Switzerland and provide a copy to the representation.

B. obligation to notify the FDPIC (para. 2)

5 The representation must communicate the information contained in the directory to the FDPIC upon request (para. 2), even without an administrative procedure. In practice, the representation is likely to communicate the directory to the FDPIC instead of providing only the information contained therein.

6 The obligation thus applies independently of the duty of the data controller to provide the FADP with all necessary documents in the context of an investigation (Art. 49 para. 3 FADP) and also independently of the power of the FADP to order access to all necessary lists of processing activities in the context of an investigation (Art. 50 para. 1 lit. a FADP).

7 The FDPIC does not have to take the route of international mutual legal assistance with the representation as a contact point in order to obtain the information in the directory. The representation in Switzerland may only communicate information that is already available.

8 A voluntarily designated representation does not have to maintain a directory as such.

C. information to data subjects (para. 3)

9 As a contact point (Art. 14 para. 2 FADP), the data protection representation must provide information to data subjects on request about the exercise of their rights under Art. 25 et seq. FADP upon request.

10 The representation must enable requesting data subjects to exercise their rights. The representation must inform data subjects, for example, at which contact details and by which means they can exercise their right to information (Art. 25 ff. FADP) vis-à-vis the controller and whether the controller has appointed a data protection advisor (Art. 10 FADP) who can be consulted (Art. 10 para. 2 FADP).

11 The duty of the data controller to provide information (Art. 19 ff. FADP) remains unaffected by the duty of the representation to provide information. The data controller may also instruct the representative to provide other information to the data subjects.

Bibliography

Husi-Stämpfli Sandra, Kommentierung zu Art. 15 DSG, in: Baeriswyl Bruno/Pärli Kurt/Blonski Dominika (Hrsg.), Datenschutzgesetz, Stämpflis Handkommentar, 2. Aufl., Bern 2023. (zit. SHK-Husi-Stämpfli, Art. 15 DSG).

Eidgenössisches Justiz- und Polizeidepartement, EU-Datenschutzgrundverordnung DSGVO: Erläuterungen betreffend die Pflicht zur Meldung von Verletzungen des Schutzes personenbezogener Daten nach Art. 33 DSGVO, 4.9.2018 (zit. EJPD, Erläuterungen).

Gogniat Yves, Die Datenschutzgrundverordnung im Kontext von Art. 271 StGB, in: Jusletter vom 19.11.2018 (zit. Gogniat, Art. 271 StGB).

Rosenthal David, Das neue Datenschutzgesetz, in: Jusletter vom 16.11.2020 (zit. Rosenthal, Jusletter).