Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

Switzerland: FOJ analyses risks of potential US Cloud Act executive agreement for Swiss adequacy

The Federal Office of Justice ('FOJ') issued, on 17 September 2021, a report on the US CLOUD Act. In particular, the report analyses the data protection safeguards under the CLOUD Act, the contents of the UK-US executive agreement under the CLOUD Act, and the European Commission's adequacy decision for the UK, in order to present findings on the legality of a potential Swiss-US executive agreement and the potential impact of the same on Switzerland's adequacy status under the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'). In particular, the report posits that the disclosure and processing of personal data carried out under production orders under the CLOUD Act is fundamentally problematic in terms of their compatibility with both the GDPR and Swiss data protection law, as well as individuals' fundamental rights more generally and, as such, an executive agreement concluded with a similar scope to the UK-US executive agreement would also be problematic.

In this regard, the report considers that the Commission's favourable adequacy finding with respect to the UK, whilst taking into account the UK-US executive agreement, was strongly influenced by the fact that the UK has transposed the GDPR into its national law, and the same cannot be said for Switzerland. Taking this into account, the report concludes that an executive agreement concluded between Switzerland and US within the narrow framework of the CLOUD Act would not suffice to ensure the adequate level of protection that the EU requires. Further to this point, the report outlines that any possible Swiss-US executive agreement should include sufficient guarantees that the standards of data protection and protection of fundamental rights corresponding to Swiss law are guaranteed, including regarding the disclosure of personal data to US prosecution authorities.

You can read the report, only available in German here and in French here.