Over the past few weeks, the international news has been dominated by the threat of the United States introducing new and increased trade tariffs. There are many economic and political arguments in favour of and against trade tariffs. One of the arguments used in favour of tariffs is that the US wants an equal playing field with its trading partners, meaning that taxes on an American product imported into other countries should not be higher than the taxes that are levied on the same product when it is imported into the US. This got me thinking about the unfair playing field on data privacy and data protection that surely impacts services in Europe and Switzerland. Let me explain.
In the area of HR data, there are many similarities across the US, EU, and Switzerland (CH). For example:
- Protection of Personal Data: All 3 regions require companies to implement measures to secure employee data.
- Employee Rights: Employees have certain rights over their personal data, such as access and correction.
- Employer Obligations: Employers must ensure lawful processing of HR data and adopt security measures.
- Job Applicants: Employers must ensure secure handling of job applicant data, only use it for hiring decisions, and they cannot keep candidate data indefinitely without justification.
However, there are fundamental differences. For example:
Aspect | US | EU | CH |
Regulatory Framework | No single federal law; varies by state (e.g., CCPA in California) | General Data Protection Regulation (GDPR) (EU-wide) | Federal Act on Data Protection (FADP) |
Employee Rights | Varies by state; some have access/correction rights | Strong rights: access, rectification, erasure (“right to be forgotten”) | Similar to GDPR |
Data Transfers | No strict restrictions unless under sector-specific laws | Transfers outside the EU require adequate safeguards | New FADP aligns with GDPR, requiring safeguards for transfers |
Penalties for Non-Compliance | Varies; some states impose fines, but enforcement is inconsistent | Fines up to €20 million or 4% of global revenue | Fines up to CHF 250,000, lower than GDPR |
Consent for Processing | Often required but depends on state laws | Must be explicit for sensitive data | Similar to GDPR, requiring clear justification |
Recruitment Data Protection | No federal law on candidate data; state laws (e.g., CCPA) may require disclosure of data collection purposes | Employers must inform candidates how data will be used, and retention must be justified | Similar to GDPR, requiring clear purpose and deletion policies |
Retention of Applicant Data | Varies; some states require deletion after a reasonable period | Must be deleted unless the candidate consents to retention | Similar to GDPR; employers need a legal basis for keeping records |
Which Region is the Most & Least Regulated?
- Most Regulated: EU
The GDPR is the strictest framework, applying to all EU countries with severe penalties for violations. It mandates explicit consent, detailed transparency requirements, and strict data transfer rules. - Second Most Regulated: Switzerland
The new FADP (effective September 2023) is aligned with GDPR in many aspects but has lower penalties. - Least Regulated: US
The USA lacks a federal data privacy law; instead, it has a patchwork of state laws (e.g., California’s CCPA is strict, but other states have minimal regulations). Some industries (e.g., healthcare, finance) are heavily regulated, but HR data in many states remains lightly governed.
What are the Consequences for EU and Swiss Companies?
Data privacy and protection regulations are designed with good intentions – to safeguard individuals’ rights, build trust, and promote ethical and responsible business practices. PeopleWeek does not advocate reducing the standards in Europe. However, the differences in regulation and enforcement create a significant disadvantage for European service companies, including technology companies. Our start-up costs and ongoing overheads are significantly higher than for US companies. Innovation is slowed down as we need to invest more time implementing data privacy safeguards and solutions. If want to enter the US market – and other markets with weaker regulations – we still need to maintain the cost and “weight” of European standards. This means that we have a competitive disadvantage in terms of prices or profit margins.
PeopleWeek takes data security and privacy very seriously. We have invested significant time and money into building solutions that comply with EU and Swiss regulations. We continuously implement new processes and systems as the legal, risk, and technology landscape evolves.
The new US presidency is likely to pose even greater challenges for Europe. The US will reduce regulations in many industries and areas (e.g., crypto, financial services, environmental). At the same time, Europe continues to increase regulations. This creates an unlevel playing field in the same way as tariffs. Politicians, regulators, and the business community in the EU and Switzerland must work together to find solutions so that we have high standards but are not at an unfair disadvantage in international markets.