{"id":237723,"date":"2023-08-23T13:30:40","date_gmt":"2023-08-23T11:30:40","guid":{"rendered":"https:\/\/devowl.io\/?post_type=knowledge-base&#038;p=237723"},"modified":"2024-06-25T09:31:44","modified_gmt":"2024-06-25T07:31:44","slug":"cookie-banner-schweizer-datenschutzgesetz-dsg","status":"publish","type":"knowledge-base","link":"https:\/\/devowl.io\/de\/knowledge-base\/cookie-banner-swiss-data-protection-fadp\/","title":{"rendered":"Cookie Banner f\u00fcr neues Schweizer Datenschutzgesetz (DSG) 2023 einrichten"},"content":{"rendered":"<section class=\"l-section wpb_row height_medium\"><div class=\"l-section-h i-cf\"><div class=\"g-cols vc_row via_flex valign_top type_default stacking_default\"><div class=\"vc_col-sm-12 wpb_column vc_column_container\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><div class=\"wpb_text_column\"><div class=\"wpb_wrapper\"><p><span style=\"font-weight: 400;\">The data protection landscape in Switzerland will change from September 1, 2023 due to the new <a href=\"https:\/\/www.kmu.admin.ch\/kmu\/en\/home\/facts-and-trends\/digitization\/data-protection\/new-federal-act-on-data-protection-nfadp.html\" target=\"_blank\" rel=\"noopener\">Swiss Federal Act on Data Protection<\/a> (FADP or nFADP; in German DSG or nDSG). This article highlights the most important changes of the FADP and gives some advice on what you as a Swiss website operator need to adapt in the cookie banner and what European providers also need to consider now.<\/span><\/p>\n<\/div><\/div><div class=\"w-iconbox us_custom_8551abba iconpos_left style_outlined color_primary align_left no_title\"><div class=\"w-iconbox-icon\" style=\"font-size:18px;\"><i class=\"fas fa-info\"><\/i><\/div><div class=\"w-iconbox-meta\"><div class=\"w-iconbox-text\"><p>We must point out that the following statements do not constitute legal advice. Therefore, we can only give you evaluations from our intensive experience with the legal regulations in practice and a technical assessment of the situation.<\/p>\n<\/div><\/div><\/div><div class=\"wpb_text_column\"><div class=\"wpb_wrapper\"><h2>Changes in the new Swiss Act on Data Protection 2023<\/h2>\n<p><span style=\"font-weight: 400;\">The main motivation behind the updates to the <a href=\"https:\/\/www.fedlex.admin.ch\/eli\/cc\/2022\/491\/de\" target=\"_blank\" rel=\"noopener\">FADP (only in German)<\/a>\u00a0in Switzerland is to better protect personal data and self-determination in light of the latest technological developments, as well as to increase transparency when obtaining personal data. The FADP has received many aligning changes to the European General Data Protection Regulation (GDPR). We consider these to be the most important changes:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">The FADP now protects only natural persons and no longer legal persons. (<\/span><a href=\"https:\/\/www.fedlex.admin.ch\/eli\/cc\/2022\/491\/de#art_1\"><span style=\"font-weight: 400;\">Art.1, 2 FADP<\/span><\/a><span style=\"font-weight: 400;\">)<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Technological solutions must take data protection aspects into account from the outset. Data protection should therefore be ensured through technology and data protection-friendly default settings. (<\/span><a href=\"https:\/\/www.fedlex.admin.ch\/eli\/cc\/2022\/491\/de#art_7\"><span style=\"font-weight: 400;\">Art. 7 FADP<\/span><\/a><span style=\"font-weight: 400;\">)<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Companies must take concrete technical and organizational measures to ensure the protection of personal data. (<\/span><a href=\"https:\/\/www.fedlex.admin.ch\/eli\/cc\/2022\/491\/de#art_8\"><span style=\"font-weight: 400;\">Art. 8 FADP<\/span><\/a><span style=\"font-weight: 400;\">)<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">A transparent directory of all processing activities becomes mandatory. (<\/span><a href=\"https:\/\/www.fedlex.admin.ch\/eli\/cc\/2022\/491\/de#art_12\"><span style=\"font-weight: 400;\">Art. 12 FADP<\/span><\/a><span style=\"font-weight: 400;\">)<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">In certain cases, risk assessments must be carried out within the framework of so-called data protection impact assessments and, if necessary, the competent authority must be consulted. (<\/span><a href=\"https:\/\/www.fedlex.admin.ch\/eli\/cc\/2022\/491\/de#art_22\"><span style=\"font-weight: 400;\">Art. 22, 23 FADP<\/span><\/a><span style=\"font-weight: 400;\">)<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">The adapted data subject rights ensure improved protection for the personal data of data subjects. (<\/span><a href=\"https:\/\/www.fedlex.admin.ch\/eli\/cc\/2022\/491\/de#art_25\"><span style=\"font-weight: 400;\">Art. 25 to 29 FADP<\/span><\/a><span style=\"font-weight: 400;\">)<\/span><\/li>\n<\/ul>\n<h2>Requirements for a cookie banner according to the new FADP<\/h2>\n<p><span style=\"font-weight: 400;\">To be in compliance with the new FADP, you must continue to provide clear and transparent information about the use and purpose of cookies and the processing of personal data. Under the new FADP, you can in principle process personal data of your website visitors without consent if you process it lawfully, fairly, proportionately and only for a specific and identifiable purpose for the data subject, in accordance with <\/span><a href=\"https:\/\/www.fedlex.admin.ch\/eli\/cc\/2022\/491\/de#art_6\"><span style=\"font-weight: 400;\">Art. 6 FADP<\/span><\/a><span style=\"font-weight: 400;\">. This applies, for example, to the use of a calendar tool or a chatbot on your website, which do not transmit personal data to an insecure third country.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">However, if sensitive personal data, i.e. personal data requiring special protection according to <\/span><a href=\"https:\/\/www.fedlex.admin.ch\/eli\/cc\/2022\/491\/de#art_5\"><span style=\"font-weight: 400;\">Art. 5 lit. c FADP<\/span><\/a><span style=\"font-weight: 400;\">, is processed or data without adequate protection is transferred to an insecure third country, the explicit consent of the website visitor is required. That it is not so easy to distinguish between requiring consent and simply having an interest in processing data is shown in this <\/span><a href=\"https:\/\/www.edoeb.admin.ch\/edoeb\/en\/home\/datenschutz\/internet_technologie\/tracking.html\"><span style=\"font-weight: 400;\">contribution from the FDPIC on tracking<\/span><\/a><span style=\"font-weight: 400;\"> on websites. The third countries designated as secure by Switzerland can be found in <\/span><a href=\"https:\/\/www.fedlex.admin.ch\/eli\/cc\/2022\/568\/de#annex_1\"><span style=\"font-weight: 400;\">the annex to the new Swiss Data Protection Ordinance (only in German)<\/span><\/a><span style=\"font-weight: 400;\">, which was published alongside the FADP.\u00a0<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Thus, for some Swiss websites, a simple information about data processing would suffice. Practically, however, this is not advisable, as we explain in the following section.<\/span><\/p>\n<h2><span style=\"font-weight: 400;\">Why Swiss website operators should also comply with the GDPR and the ePrivacy Directive<\/span><\/h2>\n<p><span style=\"font-weight: 400;\">The requirements of the FADP differ from the handling of personal data as described in the GDPR. For the <\/span><i><span style=\"font-weight: 400;\">processing<\/span><\/i><span style=\"font-weight: 400;\"> of personal data according to the GDPR you need a so-called <\/span><i><span style=\"font-weight: 400;\">legal basis<\/span><\/i><span style=\"font-weight: 400;\"> (<\/span><a href=\"https:\/\/gdpr-info.eu\/art-6-gdpr\/\"><span style=\"font-weight: 400;\">Art. 6 GDPR<\/span><\/a><span style=\"font-weight: 400;\">), i.e. consent or a contract, and a legal basis must be given before you process such data or may set cookies. Although the FADP was developed specifically for Switzerland, Swiss operators should still comply with the requirements of the GDPR and the ePrivacy Directive. The reason: the market location principle. <\/span><b>If your website with goods or services is also aimed at EU citizens, then it is also subject to the GDPR.<\/b><span style=\"font-weight: 400;\"> Incidentally, the same also applies to EU companies that offer goods or services in Switzerland, which must then also comply with the GDPR.<\/span><\/p>\n<h2>Configuration of Real Cookie Banner GDPR and FADP<\/h2>\n<p><span style=\"font-weight: 400;\">However, for Swiss website owners who want to use Real Cookie Banner or are already using it, it is still easy to create a FADP-compliant cookie banner. Real Cookie Banner provides you with a simple user interface, a checklist for setup and service templates to ensure that the requirements of the GDPR and the FADP are met. You can adapt the suitable legal basis in your WordPress backend under <i>Cookies &gt; Settings &gt; General &gt; Legal basis to be applied.<\/i> By selecting <em>GDPR \/ ePrivacy Directive<\/em> and<em> DSG (Switzerland)<\/em>, the necessary texts are automatically adapted to both legal bases for you.<\/span><\/p>\n<h2>Configuration of Real Cookie Banner according to the FADP<\/h2>\n<p><span style=\"font-weight: 400;\">For websites that are actually <\/span><span style=\"font-weight: 400;\">exclusively<\/span><span style=\"font-weight: 400;\"> aimed at Swiss people, for example by content only in Swiss German or by deliveries only within Switzerland, compliance with the FADP is sufficient. If you are unsure, we,, recommend that you comply with FADP and GDPR equally. However, if you are convinced that you only have to comply with the FADP, then you can adapt the following as a website operator:<\/span><\/p>\n<ol>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">You can customize many of our service templates, where we recommend you to ask for consent, in your WordPress backend under <\/span><i><span style=\"font-weight: 400;\">Cookies &gt; Services (Cookies) &gt; [name of your service] &gt; Edit &gt; Legal basis<\/span><\/i><span style=\"font-weight: 400;\"> to the <\/span><i><span style=\"font-weight: 400;\">legitimate interest<\/span><\/i><span style=\"font-weight: 400;\"> and thus use them without a consent of your website visitors. However, your website visitor can still object to the use of a service.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">You should also adapt the suitable legal basis (in this case the Swiss FADP) in your WordPress backend under <i>Cookies &gt; Settings &gt; General &gt; Legal basis to be applied.<\/i> This is especially important when you transfer personal data to an unsafe third country. The <\/span><a href=\"https:\/\/www.edoeb.admin.ch\/edoeb\/de\/home\/datenschutz\/international\/angemessenheit.html\"><span style=\"font-weight: 400;\">ED\u00d6B describes which countries are considered safe on its website<\/span><\/a><span style=\"font-weight: 400;\">.\u00a0<\/span><\/li>\n<\/ol>\n<h2>What EU companies need to look out for when targeting people from Switzerland<\/h2>\n<p><span style=\"font-weight: 400;\">As we have described before, the new FADP means that the market location principle also applies in Switzerland. This means that you as a website operator from the European Union <\/span><b>must also comply with the FADP<\/b><span style=\"font-weight: 400;\"> if you also or especially address Swiss.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">However, your advantage is that the GDPR is stricter than the Swiss FADP in many respects, especially regarding the need for consent from your website visitors. So, if you continue to comply with the GDPR, you will also comply with the FADP, at least as far as the cookie banner is concerned. However, you should also take a look at the section &#8220;Configuration of Real Cookie Banner GDPR and FADP&#8221; in this article and implement our recommendation. Also you should check legally if you need a permanent <\/span><a href=\"https:\/\/www.fedlex.admin.ch\/eli\/cc\/2022\/491\/de#art_14\"><span style=\"font-weight: 400;\">representation in Switzerland according to Art. 14 FADP<\/span><\/a><span style=\"font-weight: 400;\">.<\/span><\/p>\n<h2>Consent for Google advertising products in Switzerland<\/h2>\n<p>Google requires consent for Swiss website visitors from 31 July 2024 for the setting\/reading of certain cookies or similar technologies and the collection, transfer and use of person data (Swiss term for personal data) for the personalization of advertising. This consent must be obtained using the Transparency &amp; Consent Framework (TCF) and communicated to Google.<\/p>\n<p>So if you use Google advertising products such as Google AdSense or Google AdManager on your website, with which you place advertising on your website and earn money with it, you also need consent in Switzerland.<\/p>\n<p>We have explained how to <a href=\"https:\/\/devowl.io\/knowledge-base\/google-adsense-tcf-consent-wordpress\/\" target=\"_blank\" rel=\"noopener\">set up Google AdSense with TCF in Real Cookie Banner<\/a> in a separate article.<\/p>\n<\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/section>\n","protected":false},"template":"","topic":[30],"class_list":["post-237723","knowledge-base","type-knowledge-base","status-publish","hentry","topic-common-issues-rcb"],"acf":[],"_links":{"self":[{"href":"https:\/\/devowl.io\/de\/wp-json\/wp\/v2\/knowledge-base\/237723","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devowl.io\/de\/wp-json\/wp\/v2\/knowledge-base"}],"about":[{"href":"https:\/\/devowl.io\/de\/wp-json\/wp\/v2\/types\/knowledge-base"}],"version-history":[{"count":9,"href":"https:\/\/devowl.io\/de\/wp-json\/wp\/v2\/knowledge-base\/237723\/revisions"}],"predecessor-version":[{"id":238894,"href":"https:\/\/devowl.io\/de\/wp-json\/wp\/v2\/knowledge-base\/237723\/revisions\/238894"}],"wp:attachment":[{"href":"https:\/\/devowl.io\/de\/wp-json\/wp\/v2\/media?parent=237723"}],"wp:term":[{"taxonomy":"topic","embeddable":true,"href":"https:\/\/devowl.io\/de\/wp-json\/wp\/v2\/topic?post=237723"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}