Employee Data Protection

On 18 October 2024, the Federal Council approved the "Fourth Act to Reduce Bureaucracy for Citizens, Business and the Administration". The aim: less effort for business, more time for the core business. A central element of the law is the shortening of the retention period for accounting documents under commercial and tax law from ten to eight years. What initially sounds like a noticeable relief, however, also has a data protection component that companies should not underestimate.

In its judgment of 4 October 2024, the Court of Justice of the European Union ruled that an apology may be sufficient as reasonable compensation for non-material damage under Art. 82 GDPR (ECJ, judgment of 4.10.2024, Ref. C-507/23).

Collective agreements, in particular works agreements, are only a suitable legal basis for the processing of employee data if they fulfil high requirements. The European Court of Justice (ECJ) recently made this key statement as part of a preliminary ruling procedure.

In a ruling dated 15 February 2024 (case reference: 3 Ca 625/23), the Nordhausen Labour Court ruled that deliberate, unprovoked video surveillance in the workplace constitutes a significant violation of the right to informational self-determination and the dignity of employees and can justify termination without notice.

In its judgement of 26 September 2024, the Duisburg Labour Court ruled that an employee is entitled to compensation in accordance with Art 82 GDPR in the amount of EUR 10,000.00 because his employer passed on health data to third parties without authorisation (Duisburg Labour Court, judgement of 26 September 2024, Ref. 3 Ca 77/24)

According to the parliamentary initiative of the Green Group of 15 June 2023, the nDSG should be amended in Art. 21bis nDSG.

After more than 15 years, the Canton of Zurich is undergoing a total revision of its law on information and data protection (IDG).

The European Union (EU) has recently adopted regulations in the digital field and is actively working on new ones. From the Digital Services Act (DSA) and Digital Markets Act (DMA) to the AI Act, freshly passed by the Parliament, important changes in the EU area are on the horizon.

In just under two months, the completely revised version of the FADP will enter into force, which will provide the federal data protection supervisory authority in particular with new instruments so that the FDPIC can intensify its supervisory activities.