Special rule
In addition to the provisions of the Swiss Federal Data Protection Act (DPA), the processing of employee data by an employer is governed by Art. 328b of the Swiss Code of Obligations (SCO). This provision allows an employer to process data concerning its employees only to the extent that the data relate to the employee's suitability for employment or are necessary for the performance of the employment contract. The employee cannot validly consent to more extensive processing of his or her data.
The law does not define more precisely the scope of lawful processing of employee data. In addition to data processing strictly necessary for the performance of the employment contract, such as data relating to compensation and social security benefits, data processing within the scope of widely practiced human resources management may also be permitted. The processing of data which are outside the scope of the employer-employee relationship, however, is clearly prohibited.
Centralized processing of human resources data
Transnational corporate groups often wish to establish central human resources data files. This raises various specific issues which are discussed below.
Legal restrictions on centralized human resources processing
Strictly interpreted, Art. 328b of the SCO does not allow the disclosure of employee data to other group companies because they are considered third parties and such disclosure is not necessary for the performance of the employment contract. The employee also cannot consent to such a transfer. Because the DPA authorises the outsourcing of data processing, it may be reasonably argued that, under certain conditions, central human resources management is allowed.
The employees' records usually will constitute personality profiles, especially if they contain performance reviews and personality assessments. The disclosure of sensitive data and personality profiles to third parties, such as group companies, is only lawful if there is a legitimate reason for such disclosure, which can be supplied by the employee's consent. Therefore, the employee's consent should be sought, for example through an appropriate provision in the employment contract, before human resources data is disclosed to group companies. If an employee objects to the disclosure of his or her data to a group company, such disclosure is prohibited.
Data transfer abroad
Centralized data processing often involves the transfer of employee data to other group companies outside Switzerland. Considering that data may be forwarded to other group companies in various locations, the scope of the transfer outside Switzerland may be significant. Appropriate precautions will need to be taken to ensure compliance with the DPA in this respect.