An association implements data protection
In order for the EU to continue to recognize Switzerland as a third country with an adequate level of data protection, the data protection law here must come closer to the EU General Data Protection Regulation (EU GDPR). Those who already implement the requirements are at an advantage - even as an association. One example.
With regard to the convergence of Swiss data protection law with the EU-DSGVO has the Association Rotary Youth Exchange Switzerland and Liechtenstein measures have been taken in advance to ensure compliance with the forthcoming legislation. Experience from projects implementing the EU GDPR has shown that certain requirements cannot be implemented easily or at short notice on existing operational processes. The Rotary Youth Exchange has therefore decided at the beginning of 2019 to critically review their current data protection organization to identify and close gaps. This is because in the event of a breach, not only the responsible persons will be punished with fines (personal liability). A breach can very well also lead to reputational damage and loss of trust.
Data protection manual developed
Two students of the MAS Risk Management course at the Lucerne University of Applied Sciences and Arts (HSLU) were motivated to work on their master's thesis using the example of the Rotary Youth Exchange Association Switzerland and Liechtenstein. In numerous meetings with Ursula Gervasi, head of the office, and Andreas Weissen, the president of the association, the two students Manuela Rapold and Frank Böhme collected information (actual state) and first created a weak point analysis (GAP analysis). Based on this, technical and organizational measures were then formulated, which ultimately resulted in a data protection manual. The measures are now being implemented step by step and optimized on an ongoing basis.
For questions: Uwe Müller-Gauss, uwe.mueller@gauss-consulting.ch, Protection Officer, Rotary Youth Exchange Association Switzerland/ Liechtenstein
