Swiss Finance Council

Swiss Finance Council – EU Representative Office Square de Meeûs 23, B - 1000 Brussels T +32 (0)2 430 3700 www.swissfinancecouncil.org EU Transparency Register ID Number 858716912337-17 Feedback to European Commission Report on the application of GDPR The Swiss Finance Council (SFC) engages in dialogue around policy developments in finance at a European and international level. It represents the interests of internationally active Swiss financial institutions and provides a platform to share their experience, expertise and knowledge through a permanent representative office in Brussels. The SFC would like to thank the European Commission for the opportunity to comment on the forthcoming report on the application of the EU General Data Protection Regulation (GDPR). In this respect, we would like to highlight a few aspects of particular relevance to our members.

Regulation (GDPR). In this respect, we would like to highlight a few aspects of particular relevance to our members. Transfer of personal data to third countries The SFC members, as internationally active financial institutions, are subject to Swiss data protection legislation, the EU GDPR (where Article 3 para 2 applies) and applicable laws of other jurisdictions, owing to their global activities. The SFC notes that the GDPR is intended as a comprehensive data protection law to enhance the data protection rights of EU data subjects and to oblige companies to provide easier access to personal data, with information on its processing, use and storage. We focus our remarks on the merit of the Commission's review which is the issue of international transfer of personal data to third countries and the cooperation and consistency mechanism between national data protection authorities.

…data to third countries and the cooperation and consistency mechanism between national data protection authorities. At the same time, we would also highlight the need for further efforts to be taken to limit discrepancies in the interpretation of the GDPR by different EU Member States. From a legal certainty and operational point of view, we are in particular concerned by the growing number of domestic laws across the world that require that data be localised within a certain jurisdiction (e.g. China, India, Russia)1. This not only results in extra costs and unnecessary burdens for companies, it also creates regulatory fragmentation that impedes the free flow of data and hampers cross-border solutions that benefit consumers in the end.

…fragmentation that impedes the free flow of data and hampers cross-border solutions that benefit consumers in the end. In this respect, we commend the Commission for its determination to systematically incorporating specific provisions on data flows and prohibitions of data localisation requirements in bilateral and multilateral trade agreements to enable transfers of data. We agree that such horizontal measures, together with the adoption of adequacy decisions, will benefit individuals, companies, and authorities as well as they will encourage investment and facilitate trade.

…will benefit individuals, companies, and authorities as well as they will encourage investment and facilitate trade. Need of legal certainty on adequacy decisions for third countries The European Commission’s adequacy decisions, on the basis of Article 45 of Regulation (EU) 2016/679, as to whether a country outside the EU offers an adequate level of data protection, are essential to guaranteeing the free flow of personal data without the need for additional safeguards and to ensuring a level-playing field. Reliable and predictable adequacy frameworks, free of undue political influence, are crucial to guaranteeing legal certainty for cross-border data portability and transfers of personal data outside of the EU. 1 China’s Cybersecurity Law of 2016; Reserve Bank of India’s directive RBI/2017-18/153 on the Storage of Payment System Data of 218; Russia’s Federal Law No. 242-FZ of 2016. Ref.

…directive RBI/2017-18/153 on the Storage of Payment System Data of 218; Russia’s Federal Law No. 242-FZ of 2016. Ref. Ares(2020)2291800 - 29/04/2020 Swiss Finance Council – EU Representative Office Square de Meeûs 23, B - 1000 Brussels T +32 (0)2 430 3700 www.swissfinancecouncil.org EU Transparency Register ID Number 858716912337-17 The revision of the Swiss Federal Act on Data Protection (DPA) has entered the final phase. We expect the Swiss parliament to pass the fundamental revision and modernisation of the DPA by the summer of 2020 if the parliamentary work is resumed as expected after the interruption by the extraordinary measures due to COVID-19.

…if the parliamentary work is resumed as expected after the interruption by the extraordinary measures due to COVID-19. We call on the European Commission, when reporting on the review of the adequacy of Swiss data protection law, to take into consideration the intention of the revision, the good cooperation with the Swiss authorities on the topic, and the exceptional circumstances that European countries are facing with COVID-19 and the impacts on the legislative timetable. Further, we express our support for, and expectation of, a positive outcome as soon as the situation allows parliamentary work to resume. Consistency of the GDPR with other Commission initiatives In recent years, there has been an increased focus on how technology is impacting data protection regulation and international coordination of data policies.

…focus on how technology is impacting data protection regulation and international coordination of data policies. Particular attention should be paid to clarity and legal certainty on the collection, processing, and sharing of data and how the implementation of the respective EU legislation works together. This includes considerations for clarity regarding the ability of banks to use big data analytics, addressing privacy and security concerns aimed at giving individuals more control over how their data is collected and used, and smooth transfers of data across borders. In this respect, we acknowledge and support other EU initiatives that were released recently by the Commission and which have important considerations for data protection, in particular the consultations on a European Data Strategy2, and the one on a new Digital Finance Strategy3.

…in particular the consultations on a European Data Strategy2, and the one on a new Digital Finance Strategy3. The EU GDPR should remain sufficiently flexible to take into account current developments including the use and implications of big data in the financial sector, the digitalisation of financial services or the prospect of open data. Finally, the SFC would like to express its full support for the feedback provided to the consultation by the Association for Financial Markets in Europe (AFME) which complements the comments we have made above. We thank you for your consideration of our feedback and we are at your disposal if you require further information. April 2020 The Swiss Finance Council was established in 2013 to engage in dialogue around policy developments in finance at a European and international level.

…established in 2013 to engage in dialogue around policy developments in finance at a European and international level. It represents the interests of internationally active Swiss financial institutions and provides a platform to share their experience, expertise and knowledge through a permanent representative office in Brussels. The current members of the Swiss Finance Council are Credit Suisse Group AG, UBS Group AG, UBS Switzerland AG and Credit Suisse (Schweiz) AG. The Swiss Finance Council supports an integrated Single Market that can contribute to the creation of a strong, open and globally competitive European financial sector, and it advocates for an EU that remains attractive to foreign investors and service providers. 2 COM(2020) 66 final. 3 https://ec.europa.eu/info/consultations/finance-2020-digital-finance-strategy_en

originalus šaltinis (PDF) ↗