Data Access and Disclosure within a Group of Companies

Question:
Our company is a Swiss subsidiary/branch of a multinational corporate group. Our parent company's headquarters in Norway intends to centralize the human resources data file of the whole group in Norway. Are there any restrictions applicable to such centralization?


Answer:
Yes. The intended centralization involves a disclosure and transfer of personal data abroad which is – even within the same group of companies – only permitted under certain circumstances (see section B above). Further, under Swiss employment law, the employer may only collect and process data about employees which are necessary for the performance of the employment relationship. As files of human resources data often contain sensitive personal data or personality profiles, the employees must give explicit consent to the transfer of their data abroad. Additionally, a registration of the data file with the Swiss Data Protection and Information Commissioner might be necessary (see Registration of Data Files).