On January 11, 2017, the governments of the United States and Switzerland announced that an agreement had been reached over a Privacy Shield Framework (“Privacy Shield”) that sets out how companies may transfer personal data between the two countries.  The agreement provides companies with a process through which they can certify compliance with certain Swiss data protection requirements in order to enable the transfer of personal data from Switzerland to the United States “in support of transatlantic commerce.”  The agreement mirrors a separate Privacy Shield agreement between the United States and the European Union that was finalized in July 2016. 

The new Privacy Shield agreements the United States has entered into—with both Switzerland and the European Union—replace previous data transfer “safe harbor” frameworks. A European Court of Justice ruling in October 2015 invalidated the previous EU Safe Harbor Agreement when the European Court of Justice held that the previous data transfer framework failed to adequately protect the privacy rights of European Union citizens.  As a result of this decision, the previous United States – Swiss Safe Harbor agreement also was called into question. 

Now, American companies that obtain certification under the Swiss-U.S. Privacy Shield regime will be recognized as having adequate data protection standards.  Swiss companies thus will be able in most cases to transmit personal data to certified business partners in the United States again without requiring additional contractual guarantees.  Swiss officials have confirmed that the new agreement with the United States closely aligns with the similar agreement with the European Union, as it “guarantees the same general conditions for persons and businesses in Switzerland and the EU/EEA area in relation to trans-Atlantic data flows.” 

Amongst the improvements put into place by the new framework are stricter application of data protection principles to participating companies, improved cooperation and collaboration between government data protection authorities in the United States and Switzerland, and the placement of an Ombudsman within the United States Department of State to address specific concerns by citizens in Switzerland (and the European Union) about the processing of their data by United States intelligence services. 

Similar to the agreement reached with the European Union, the Swiss Privacy Shield will be administered by the International Trade Administration within the U.S. Department of Commerce.  The certification process under the Swiss Privacy Shield for interested entities will begin in April 2017.  Resources for organizations and businesses seeking certification under both the European Union and Swiss Privacy Shields can be found here.