Contributions

Are Swiss data protection rules ready for AI?

A comparison of Swiss data protection rules and those offered under the proposed EU AI Act

Rayan Houdrouge

Kathryn Kruglak

Proposition de citation: Rayan Houdrouge / Kathryn Kruglak, Are Swiss data protection rules ready for AI?, in : Jusletter 27 novembre 2023

Against the background of the recently introduced new Federal Act on Data Protection in Switzerland, and the proposed Artificial Intelligence Act in the EU, this article addresses the question of whether Swiss data protection rules offer sufficient protection when it comes to AI. It does this by analysing: (i) the primary personal data protection risks posed by AI; (ii) Swiss personal data protection rules applicable to AI; (iii) the personal data protections in the proposed Artificial Intelligence Act; and (iv) how the Swiss personal data protection rules compare to the personal data protections in the proposed Artificial Intelligence Act.

Table des matières

1. Introduction
2. Primary data protection risks from AI
3. Protections available under Swiss law
- 3.1. Introduction
- 3.2. Under the nFADP
  - 3.2.1. Mass surveillance
    - 3.2.1.1. Biometric data
    - 3.2.1.2. Data protection impact assessment
    - 3.2.1.3. Log
    - 3.2.1.4. Processing regulations
  - 3.2.2. Automated processing
    - 3.2.2.1. Profiling
    - 3.2.2.2. Automated decisions
- 3.3. Other sources
  - 3.3.1. International
    - 3.3.1.1. Convention 108+
    - 3.3.1.2. European Human Rights Convention
  - 3.3.2. Domestic
    - 3.3.2.1. Constitution
    - 3.3.2.2. Criminal Procedure Code
    - 3.3.2.3. Labour Law and Employment Law
      - a. Labour Law
      - b. Employment Law
4. Proposed AI-specific protections in the EU: the AI Act
- 4.1. Introduction to the AI Act
  - 4.1.1. Background
  - 4.1.2. Overview
- 4.2. Unacceptable risk
  - 4.2.1. Scope
  - 4.2.2. Rules
- 4.3. High risk
  - 4.3.1. Scope
  - 4.3.2. Rules
- 4.4. Limited risk
  - 4.4.1. Scope
  - 4.4.2. Rules
- 4.5. Minimal risk
  - 4.5.1. Scope
  - 4.5.2. Rules
- 4.6. General-purpose AI, foundation models and generative AI
  - 4.6.1. Scope
  - 4.6.2. Rules
- 4.7. Innovation
5. Comparison
- 5.1. Personal data protection
  - 5.1.1. Unacceptable risk
  - 5.1.2. High risk
  - 5.1.3. Limited risk
  - 5.1.4. Minimal risk
  - 5.1.5. General-purpose AI/foundation models and generative AI
- 5.2. Advantages of the Swiss approach
  - 5.2.1. Nuanced approach
    - 5.2.1.1. Exclusion
    - 5.2.1.2. Overreaching
  - 5.2.2. Innovation
- 5.3. Disadvantages of the Swiss approach
  - 5.3.1. Piece-meal solution
    - 5.3.1.1. Lack of legal certainty
    - 5.3.1.2. Unaddressed risks
  - 5.3.2. Timing
6. Conclusion