The Swiss-U.S. Data Privacy Framework (Swiss-U.S. Framework) took a significant step to becoming operational this week, when Switzerland officially added the United States to its list of countries that provide “adequate levels of data protection.” Starting on September 15, businesses that operate under the framework will be able to transfer personal data of Swiss residents from Switzerland to the United States without any additional transfer mechanisms required (e.g. standard contractual clauses).
The Swiss-U.S. Framework was negotiated along the lines of the European Union-U.S. Data Privacy Framework (EU-U.S. Framework) that permits the transfer of data to U.S. entities that are regulated by the Federal Trade Commission or Department of Transportation, as long as those entities annually certify to the Department of Commerce that they comply with certain privacy principles and standards. The EU-U.S. Framework went into effect last year, but since Switzerland is not part of the European Union, it had to enter into a separate agreement with the United States. The issue of data transfers between the European Union and the United States has been a contentious one for the past two decades, due to concerns about how the U.S. government and intelligence agencies may have access to EU resident data. Prior versions of the EU-U.S. Framework, the Safe Harbor Agreement and the Privacy Shield were struck down by the EU High Court in 2015 and 2020 respectively.
