The legal framework in Switzerland and Europe

In Switzerland, the Federal Act on Data Protection (FADP), often called the revised FADP since its revision, has been in force in its new version since 1 September 2023. It applies to any processing of personal data, including by an AI. In particular, it requires informing the people concerned, limiting data to what is needed, and assessing the impact of high-risk processing.

In the European Union, Regulation 2024/1689 on artificial intelligence, the AI Act, classifies systems according to their risk. Some practices are prohibited, such as social scoring. High-risk systems, for example in recruitment or in education for access and assessment, are subject to obligations on data quality, documentation and human oversight. A Swiss organisation that offers its services in the Union may fall within its scope.

Questions to ask

• Is personal data processed, and are the people concerned informed?
• Does the use affect access to employment, to education or to an essential service?
• Where is the data processed, and under which law?
• Can a person contest a decision and obtain an explanation?