Question 1: Is the transfer from Switzerland to the United States of personal information collected in the context of the employment relationship covered by the Safe Harbor?
Yes, where a company in Switzerland transfers personal information about its employees (past or present) collected in the context of the employment relationship, to a parent, affiliate, or unaffiliated service provider in the United States participating in the Safe Harbor, the transfer enjoys the benefits of the Safe Harbor. In such cases, the collection of the information and its processing prior to transfer will have been subject to Swiss data protection laws, and any conditions for or restrictions on its transfer according to those laws will have to be respected.
The Safe Harbor Principles are relevant only when individually identified or identifiable records are transferred or accessed. Statistical reporting relying on aggregate employment data and/or the use of anonymized or pseudonymized data does not raise privacy concerns.
Question 2: How do the Notice and Choice Principles apply to such information?
A U.S. organization that has received employee information from Switzerland under the Safe Harbor may disclose it to third parties and/or use it for different purposes only in accordance with the Notice and Choice Principles. For example, where an organization intends to use personal information collected through the employment relationship for non-employment-related purposes, such as marketing communications, the U.S. organization must provide the affected individuals with choice before doing so, unless they have already authorized the use of the information for such purposes. Moreover, such choices must not be used to restrict employment opportunities or take any punitive action against such employees.
In addition, employers should make reasonable efforts to accommodate employee privacy preferences. This could include, for example, restricting access to the data, anonymizing certain data, or assigning codes or pseudonyms when the actual names are not required for the management purpose at hand.
To the extent and for the period necessary to avoid prejudicing the legitimate interests of the organization in making promotions, appointments, or other similar employment decisions, an organization does not need to offer notice and choice.
Question 3: How does the Access Principle apply?
The FAQs on access provide guidance on reasons which may justify denying or limiting access on request in the human resources context. Of course, employers in Switzerland must comply with local regulations and ensure that Swiss employees have access to such information as is required by Swiss law, regardless of the location of data processing and storage. The Safe Harbor requires that an organization processing such data in the United States will cooperate in providing such access either directly or through the Swiss employer.
Question 4: How will enforcement be handled for employee data under the Safe Harbor Principles?
In so far as information is used only in the context of the employment relationship, primary responsibility for the data vis-à-vis the employee remains with the company in Switzerland. It follows that, where Swiss employees make complaints about violations of their data protection rights and are not satisfied with the results of internal review, complaint, and appeal procedures (or any applicable grievance procedures under a contract with a trade union), they should be directed to the Commissioner or labor authority in the jurisdiction where the employee works. This also includes cases where the alleged mishandling of their personal information has taken place in the United States, is the responsibility of the U.S. organization that has received the information from the employer and not of the employer and thus involves an alleged breach of the Safe Harbor Principles, rather than of the FADP. This will be the most efficient way to address the often overlapping rights and obligations imposed by local labor law and labor agreements as well as data protection law.
A U.S. organization participating in the Safe Harbor that uses Swiss human resources data transferred from Switzerland in the context of the employment relationship and that wishes such transfers to be covered by the Safe Harbor must therefore commit to cooperate in investigations by and to comply with the advice of the Commissioner in such cases. The Commissioner in this way will notify the Department of Commerce. If a U.S. organization participating in the Safe Harbor wishes to transfer human resources data from Switzerland and the Commissioner has not so agreed, the provisions of the FAQ 5: The Role of the Commissioner will apply.