Switzerland

Federal Act of 19 June 1992 on Data Protection (FADP)

Ordinance of 14 June 1993 to the Federal Act on Data Protection

Section 328 of the Code of Obligations establishes the general conditions for workplace monitoring.

The Federal Data Protection and Information Commissioner has issued a number of statements that appear to make the monitoring of email difficult, if not illegal. Unfortunately, the guidance documents issued by the Commissioner do not specifically state that monitoring in the workplace is illegal. Instead, the Commissioner has identified a number of measures that would be considered illegal and thus should be avoided by employers. Employers should have in place clear policies that set forth the proper uses of networks, emails, Internet and other electronic communications media. If monitoring is to take place, the employer should set forth the specific basis for monitoring, explain how and when monitoring will take place, and provide information to employees sufficient to enable to employee to understand his or her rights of access, etc. Where feasible, the employer should obtain an employee’s specific consent to monitoring. Monitoring should be tailored to target specific violations of policy – and where possible, immediate notice should be provided to the employee for suspected violations.

In order to avoid privacy problems, employers should consider setting up employee e—mail accounts in such a manner as to designate that are for business purposes and to avoid the use of an employee’s name. The Swiss Data Protection Commissioner provides the following examples: hans.meier@companyname.ch or hans.meier@sales.companyname.ch (as possibly indicating personal use is permissible), on the one hand, and info@companyname.ch, sales@companyname.ch, or salesmanager@companyname.ch (as indicating business purposes only and thus avoiding privacy issues).

The Commissioner has made the following statement: “Opening emails where there is uncertainty over their nature is not permitted, irrespective of whether private emails are allowed within a company or not.” 105 in such circumstances, an employer must consult with the employee to determine the nature of the communication. The Commissioner specifically states: “The name address should be used for purely personal business related correspondence (e.g., personal matters or personal messages.”)

Article 6 of the FADP is the main provision that regulates the transborder transfer of personal data, together with the Ordinance to the Federal Act on Data Protection. Article 6 of the Act provides:

“Personal data may not be disclosed abroad if the privacy of the data subject would be seriously endangered thereby, in particular due to the absence of legislation that guarantees adequate protection.”