FDPIC recommends more data settings in customer account

Jonathan Keller

17.4.2024

Translation: Patrik Stainbrook

The Federal Data Protection and Information Commissioner has accused us of violating the principles of transparency and proportionality in the Data Protection Act. Both we and recognised data protection experts clearly see things differently. Nevertheless, we’re following a few of the recommendations, even though some of them go beyond the European market standard.

Customers expect top service from us – and rightly so. It’s precisely why we invest a lot of time and energy into the user-friendliness of our shop and its search functions, as well as in the speedy processing of returns, repairs and warranty cases and the protection of minors. To ensure that shopping runs smoothly and efficiently, we need to know who is ordering what from us.

Someone complained to the Federal Data Protection and Information Commissioner (FDPIC) that we also process certain personal data beyond the actual delivery of ordered products. The government body then initiated proceedings. In technical jargon, this is referred to as clarification of facts. That was in 2021. In a final report at the end of January 2024, the FDPIC provided us with some points of criticism and six recommendations, which we’ll briefly summarise here:

This much in advance – we take the FDPIC’s criticisms seriously. However, we only partially share their opinion, as do recognised data protection lawyers. «The FDPIC’s recommendations on transparency go far beyond what is required by law,» says lawyer David Vasella from law firm Walder Wyss, who also advised us in these proceedings. We consider it neither sensible nor necessary to further expand our already extensive data protection declaration. The consequence of this would be an even longer and constantly changing privacy notice. In our mind, this does not seem to be in the interests of customers. After all, who wants to deal with the privacy notice again and again? However, the implementation of five of the six FDPIC recommendations would result in exactly this. Since the procedure was initiated in 2021, we’ve comprehensively revised our privacy notice anyway. We are of the opinion that the current version fulfils all legal requirements and shows our customers transparently how Galaxus handles personal data.

We will implement this recommendation on so-called informational self-determination, although this is already possible to some extent today. Our cookie settings, for example, can be used to restrict personalised collection of behavioural data. Notifications can be set individually, and there is also the option of deleting an account completely. We’ll be working on further measures in the coming months. Our focus here is on data processing, which we can use to personalise content or recommendations. In future, customers will be able to adjust this directly in their account.

However, it is clear to us that the implementation of this informal self-determination should offer customers added value without making the purchasing process unnecessarily difficult or restricting our services. In the aforementioned recommendation, however, the FDPIC brings a point into play that we do not consider consistent with this principle. They mention guest checkout as an obvious way of structuring data processing in a proportionate manner. The following arguments show why we do not think guest purchasing is a good idea:

1) Services
Without a customer account, it is very difficult for us to provide basic services. Processing returns, warranty claims or transport damage would only be possible if customers keep purchase receipts sent electronically at the time of purchase themselves. Today, these documents are clearly stored in customer accounts and can be accessed online at any time.

2) Personalisation & Community
Personalisation helps us provide customers with suitable and attractive offers. This way, they can find the products relevant to them more quickly in the store and shop more efficiently. All most definitely in the interests of customers. Galaxus is also much more than just an online store. We are a platform for inspiration, information and communication that invites visitors to actively participate and help shape the future. Community spirit is part of our DNA. Our users actively engage in dialogue with each other, provide product reviews or offer detailed assistance with technical questions from other customers. They also lead lively discussions about what they like and do not like in our stores. Without a customer account, this lively dialogue between users would be impossible.

3) International competition
We are in direct competition with international online giants such as Amazon and Aliexpress – even in our domestic market. Anyone shopping with the aforementioned competitors today must set up a customer account. The FDPIC’s unilateral recommendation would lead to unequal treatment. To the detriment of a Swiss online retailer of all things, a company providing economic benefit to our country. We provide over 2,000 jobs in Switzerland, ranging across a wide spectrum of services.

Data protection expert David Vasella is not surprised by the authority’s recommendations. «The FDPIC’s recommendations often go beyond what is required by data protection law, even in the case of harmless processing. In doing so, it sets requirements for the design of an offer and thus interferes with economic freedom instead of limiting itself to the correct application of data protection law.»

Note: a detailed analysis of David Vasella’s decision can be found on legal blog datenrecht.ch. https://datenrecht.ch/edoeb-i-s-digitec-galaxus-sehr-strenge-transparenzanforderungen-aber-gastkauf-nicht-zwingend/

Jonathan Keller

Data Protection Officer

Jonathan.Keller@digitecgalaxus.ch

These articles might also interest you