Blog

Today, 8 September 2020, the Swiss Federal Data Protection and Information Commissioner ("FDPIC") issued a press release announcing it no longer considers the Swiss-US Privacy Shield regime to provide an adequate level of data protection. The FDPIC has taken its time to consider the July 2020 Schrems II decision by the Court of Justice of the European Union ("CJEU"), which found the EU-US Privacy Shield to be inadequate. It has now issued this decision on the basis of its own annual assessment of the virtually identical Swiss-US Privacy Shield.

Startups often forget to incorporate appropriate transfer restrictions in their shareholder agreements. In our conversation with Juan Fernando Baron of Rele.ai, we are exploring the various forms of transfer restrictions, such as the right of first refusal, drag-along and tag-along rights, purchase options with triggering events as well as permitted transfers, and are discussing the benefits of incorporating them into a startup's shareholder agreement early on.

Wirecard has proven once again that stellar growth and stunning revenues do not always mean that a company is well-founded. Although the board of directors has responsibilities towards the shareholders and the latter have certain information rights, organisational failure and mismanagement often remain unnoticed until it's too late. Additional corporate governance laying down the fundamentals on management and organisation is therefore vital for long-term success, to ensure that the checks and balances among the stakeholders involved (shareholders, founders, and employees) are appropriate.

On the 16 July 2020, the Court of Justice of the European Union ("CJEU") finally rendered its long-awaited judgement in the Case C-311/18, Data Protection Commissioner v Facebook Ireland & Schrems ("Schrems II") on the validity of Standard Contractual Clauses ("SCC") as a transfer mechanism for transferring personal data from the EU/ EEA to third countries under the General Data Protection Regulation ("GDPR"). In its decision, the CJEU considers that the Commission Decision 2010/87 on standard contractual clauses is valid. However, in its decision, the CJEU also ruled on the adequacy provided by the EU-US Data Protection Shield and invalidated the protection afforded by this Decision.

Swiss data protection law also uses the protection of the SCCs and the Privacy Shield as mechanisms for data transfers. Both in Switzerland and the EU many businesses rely heavily on the SCCs and the Privacy Shield for their data transfers to countries outside of the EU/EEA or Switzerland. As a result of the CJEU's judgement, businesses will need to take immediate action or be in breach of data protection laws. Find out in our blog what this landmark decision from the CJEU means for your business.

If you are a start-up or established business providing online intermediation services or offering a search engine for business and corporate website users in the European Union, then you might have to update your terms and conditions because of a new EU Regulation. The Regulation on promoting fairness and transparency for business users of online intermediation services, which enters into effect on 12 July 2020, applies to businesses both in and outside the EU. The Regulation sets out several obligations for service providers, including requirements with regard to the terms and conditions of the service provider.

Find out in our blog whether the Regulation applies to you and how you will have to change your terms and conditions.