How small and medium-sized companies can easily protect themselves against data protection mishaps

Small and medium-sized companies generally have very limited resources for data protection and are also unable to deploy their own specialists for this topic. But how can I still protect myself against expensive legal disputes and data protection violations under the GDPR and DSGVO?

Incorrectly installed video cameras in guest rooms, unencrypted customer databases or inadequately disposed of address data? Violations of the Data Protection Ordinance (DSG and DSGVO) in companies happen quickly.

DSG violations and warnings

Almost all companies are obliged to comply with the DPA. However, many companies find them complicated and difficult to understand. This can lead to costly and unsightly infringements and be the reason for warnings. Surveys also show that many have not yet fully implemented the DPA and GDPR. So there are still security gaps here too. But even for companies that are largely compliant with data protection regulations, there is still a residual risk due to legal uncertainties.

High costs possible

Violations of the DPA can be expensive under criminal law. Although high fines are rather rare for small companies, costs for lawyers, courts, expert opinions or even compensation and recourse claims can threaten their existence in the event of a legal dispute.

Protection for small companies

We will show you what options are available to protect yourself and take the necessary precautions.

According to the Data Protection Act, companies are required to securely delete personal data of customers, but also of employees. This requires a concept according to which the deletions can be carried out in compliance with the Data Protection Act. Since this often involves various applications and databases, a concept should be in place that defines the uniform and GDPR-compliant processes.

An essential component of the GDPR is the principle of data minimisation, according to which data should only be stored as long as it is necessary for the intended purpose. This results in the need for a deletion concept.

An important principle is storage limitation. This means that data should only be stored for as long as it is needed. A well thought-out deletion concept reduces the risk of data protection breaches. The less data there is, the lower the risk of misuse by unauthorised persons.

A clear deletion concept creates trust. Customers and users realise that their data is not being stored unnecessarily. Deleting superfluous data increases the efficiency of databases and storage systems and thus reduces costs. The concept must define which data is stored, for what purpose and for how long.

A deletion concept is not only a legal requirement, but also demonstrates responsible data management practice. It protects the privacy of the data subjects and helps to use resources more efficiently and reduce the risk of data breaches.

We are happy to support you in this!

The Data Privacy Framework – or Privacy Shield 2.0 – is the third attempt at a data protection agreement between the EU and the US, following the Safe Harbor scheme and the Privacy Shield. According to the European Data Protection Regulation EU-DSGVO, this new regulation is intended to ensure the protection of personal data transferred from the EU to the USA.

The agreement became necessary because the European Court of Justice (ECJ) had declared the previous agreements invalid in the so-called “Schrems judgements”. The EU adopted the Data Privacy Framework in July 2023 by adequacy decision. In the Data Privacy Framework, the US commits to improving the level of data protection of personal data transferred from the EU to the US. Through the EU adequacy decision of 10 July 2023, the EU Commission declares the level of data protection of personal data transferred to the US to be adequate and in line with the requirements of the EU GDPR for data transfers to a third country.

The agreement became necessary because the European Court of Justice (ECJ) had declared the predecessor agreements invalid in the so-called “Schrems judgements”. The EU adopted the Data Privacy Framework in July 2023 by adequacy decision. In the Data Privacy Framework, the US commits to improving the level of data protection of personal data transferred from the EU to the US. Through the EU adequacy decision of 10 July 2023, the EU Commission declares the level of data protection of personal data transferred to the US to be adequate and in line with the requirements of the EU GDPR for data transfers to a third country.

This is intended to end the legal uncertainty that has prevailed since the Schrems rulings. The adequacy decision serves as the basis for the transfer of personal data to certified companies or organisations in the USA from the time of its adoption by the EU Commission. The transfer of personal data to a US company that participates in the DPF and is certified no longer requires any further security measures or additional standard contractual clauses. Whether the new agreement will actually withstand the expected legal scrutiny by the European Court of Justice is not yet foreseeable.

From Switzerland’s point of view, the question is whether it can join the agreement between the EU and the USA with a parallel solution – as it did with “Safe Harbor” and “Privacy Shield”.

It is now known that violations of the European General Data Protection Regulation (GDPR) will be punished with fines by the data protection authorities of the EU member states: The fines can amount to up to 20 million EUR, or up to 4 percent of the global annual turnover.

Up to now, it has been up to the competent national data protection authority to determine the amount of the fines. So far, each EU member state decides for itself how far the “up to max. values” provided for by the GDPR will be exhausted. There are now new rules for the assessment of fines: The European Data Protection Board (EDSA) has adopted the final guidelines for the assessment of fines.

At its meeting of 24.5.2023, the European Data Protection Board (EDPB) adopted Guidelines 04/2022 on the calculation of administrative fines under the GDPR following a public consultation.

The guidelines now provide data protection supervisory authorities with uniform standards and a harmonised framework for determining fines. However, the harmonisation only relates to the basis for calculating the fines. The final amount of the fines will continue to be determined individually by the respective national supervisory authority due to the adjustment possibilities of the guidelines model.

The guidelines provide for a five-step assessment procedure that takes into account in particular the nature and gravity of the infringements and the turnover of the undertakings concerned:

Step 1: Sanctionable acts
The supervisory authorities examine whether the case at hand involves sanctionable acts and to what extent these have led to violations of the GDPR. In particular, it will be examined whether one or more acts subject to a fine have been committed.

Step 2: Determining the starting amount
The starting amount for the fine calculation is determined from three factors: The type of infringement (a), the gravity of the infringement (b) and the turnover of the company (c).

Type of infringement (Art. 83 (4) – (6) GDPR)
Violations of Art. 83(4) of the GDPR may be punished by a fine of up to EUR 10 million or, in the case of a company, up to 2% of its total annual worldwide turnover in the preceding business year. Violations of Article 83 (5) and (6) of the GDPR may be punished with a fine of up to EUR 20 million or, in the case of a company, up to 4% of its total annual worldwide turnover in the preceding business year. This results in the statutory maximum amounts that a fine may not exceed in each case.

Severity of the breach
The criteria listed in Art. 83 (2) GDPR are used to determine the gravity of the breach. The determination must result in a severity level in order to be able to determine the starting amount as a percentage of the statutory maximum amount:

• Low severity: starting amount is between 0 and 10% of the legal maximum.
• Medium severity: Initial amount is between 10 and 20 % of the statutory maximum.
• High severity: Initial amount is between 20 and 100 % of the statutory maximum

The turnover of the enterprise
With regard to the turnover of an enterprise, further corrections are made to the initial amount previously determined. The amount can be reduced to between 0.2 % and 50 % of the initial amount determined.

Step 3: Determination of aggravating or mitigating circumstances
Supervisors identify aggravating or mitigating circumstances that may increase or decrease the amount determined in Step 2. These include, for example, the behaviour of the controllers (willingness to cooperate, countermeasures) and whether there have already been breaches of the GDPR in the past. The increase or decrease of the amount is made individually by the supervisory authority.

Step 4: Determining the upper limit
The determined amount of the fine is again compared with the statutory maximum amounts of Art. 83 (4) – (6) DSGVO. It is also decided whether the static (10 or 20 million EUR) or the dynamic (2% or 4% of the annual turnover) upper limit applies to the fine assessment. According to Article 83 (4) and (5) of the GDPR, the higher amount must be used as a basis.

Step 5: Possible readjustments
In the final step of the fine assessment, the supervisory authorities evaluate the determined fine pursuant to Art. 83 (1) GDPR with regard to effectiveness, proportionality and deterrence in order to be able to make any readjustments.