The DPO is primarily an advisor. His or her main role is to advise the organization on all matters related to data processing. At Aequivalent, this is a major role, as all other roles are I am sure (laughs), because we process sensitive data from applicants’ screening on a daily basis.  In this context, the DPO also plays the role of instructor in order to provide the best possible support to our employees. Finally, the DPO has the independence to be able to act efficiently.

That’s right. In fact, the term “Data Protection Advisor” already exists in the Swiss Data Protection Act (DPA) of 1992 (the law that currently applies), but it was only an option. However, it was European law in 2018, with the introduction of the General Data Protection Regulation (GDPR), which reinforced this role towards organizations that process personal data of residents within the European Union.

Certification in the field of data processing is never an obligation in Switzerland, unlike in other countries where it is the case in the medical field, for example. It is purely a voluntary and continuous improvement process. Otherwise, ISO27001 is a tool that can be extremely useful, being an information security management system, because the law remains very abstract when it prescribes that “the organizational and technical measures” must be implemented.

For my part, I would say that it all relates to management’s ability to be aware of the financial, legal and reputational risks that such an event can entail. This is because safety is a question of corporate culture, but also of budget. At Aequivalent, a lot of questions to raise doubts arose when, very early in our existence, we announced that we would be entering an ISO27001 certification process – a long and treacherous road. For our management, there was however no doubt because “data protection is an integral part of Aequivalent’s core business. Please note that there will be no promotions handed out as a result of this interview.

This is an excellent question in view of current events. You may have read about it in the last few days, but the Council of States and the National Council have finally reached an agreement to update the current law, which will soon celebrate its 30th anniversary. Generally speaking, we are moving in the right direction because it was unlikely that Switzerland would keep its adequacy towards the European Commission in view of the standards imposed by the RGPD. I invite you to read my comment on the bill that has just been voted, put into practice in the field of human resources.

Despite several cases of leaks of personal data, for instance the Swisscom affair where at least 800’000 customers were concerned, the general opinion does not seem to be any more shocked either. Today we are evolving in a context where users are far more interested in features to benefit their private life, either because of a lack of knowledge and awareness (especially with regard to the monetary value of this data), or because of an attitude of laziness (we very often accept all cookies by default, without configuring).

To pick just one, a DPO can sometimes be seen as a kind of internal auditor, or at least someone who is looking to slow down operations. So the challenge lies in communicating with different departments, different backgrounds, in order to get a better understanding of what is at stake. Unfortunately, as change management training shows, some people are automatically resistant and despite the efforts made, the dialogue remains complicated. But here again, the support of management will be decisive.

Date of publication: 11.11.2020

Author: Aequivalent’s marketing and sales team