FDPIC confirms direct applicability of data protection law to AI and outlines regulatory approach

The FDPIC clarified that the FADP is technology-neutral and applies to all forms of data processing, including those involving AI, and that manufacturers, providers and users of AI systems are required to ensure the highest possible degree of digital self-determination for data subjects. The FDPIC also noted that data subjects have a legal right to transparency, alongside the right to object to automated data processing or to request human review of automated decisions. For AI systems, such as intelligent language models that interact directly with users, the FDPIC stated that this means there is a legal requirement to inform users whether they are communicating with a machine and whether their data is being used to improve self-learning programmes, or for other purposes. 

AI-supported high risk data processing is permitted under the FADP provided that appropriate protective measures to protect data subjects are implemented, including the requirement to conduct a data protection impact assessment. However, applications that undermine privacy and informational self-determination, such as comprehensive real-time facial recognition or ‘social scoring’ are prohibited under Swiss data protection law.

This update follows Switzerland’s signing the Council of Europe Convention on AI and Human Rights, Democracy and the Rule of Law, and the FDPIC confirmed the Federal Council’s announcement that amendments to Swiss law will be made to enable ratification of the Convention.

The Swiss approach to AI regulation is based on three objectives: (i) strengthening Switzerland’s position as a centre of innovation, (ii) safeguarding fundamental rights, including economic freedom, and (iii) strengthening public confidence in AI. The FDPIC emphasises that, irrespective of future AI-specific regulations, existing data protection laws must be followed for all AI-supported data processing.

The press release is available here.