Das Profiling im neuen Datenschutzrecht

The revised Data Protection Act will introduce the concept of profiling into Swiss law. This term will be defined in the same way as in the European General Data Protection Regulation (GDPR) as any automated processing of personal data to evaluate certain personal aspects relating to a natural person.

Unlike the GDPR, the new Act will create a special category of high-risk profiling, which is defined as any profiling that leads to the combination of data so to allow an assessment of essential aspects of the personality of an individual.

The practical question is if profiling requires consent of the data subject. The author argues that it does not, even if qualified as high-risk profiling. Swiss data protection law remains underpinned by a foundation different to its European counterpart: In general, the controller does not need to show any legal basis for processing personal data. Consent comes into play if the controller infringes any principles of processing, such as the principle of…