Question:
As an employer, we regularly process personal data relating to our employees (name, occupation, salary, health, appraisals, etc.) in Switzerland. Do we have to register such processing with the Swiss Federal Data Protection and Information Commissioner if we have not either designated an internal data protection officer or acquired a data protection quality mark?

Answer:
Unless you process the data in terms of a statutory obligation, registration is necessary if the personal data of the employees includes personality profiles or sensitive personal data. In general, employee data contains sensitive personal data (such as, for example, information about health, trade union beliefs, etc.). Often employee data may also constitute personality profiles because the data might reveal essential characteristics of employees.

In many cases, the processing of sensitive personal data and of personality profiles of employees is based on a statutory obligation of the employer (e.g. the obligation to provide a certification of employment, process certain health data to meet social security requirements, etc.). However, this might not always be the case. For example, if more than objectively necessary information about employees is processed and such information is shared with other group companies, this would go beyond merely meeting statutory requirements and the prior registration of the data file with the Swiss Federal Data Protection and Information Commissioner would therefore be required.