Swiss Foundations as AI Data Intermediaries

Executive Summary

The proposed use of a Swiss foundation as a data intermediary could capitalize on Switzerland's robust data protection reputation and the legal framework which supports non-profit entities handling sensitive data. This setup aims to ensure that data processing adheres strictly to the purposes defined by the foundation's charter, potentially increasing trust among data subjects and regulators. Data intermediaries are recognised for their ability to facilitate secure and compliant data sharing by managing data access under strict legal and ethical standards.

I. Current Challenges in Sharing Health Data for AI Research

The technological development of artificial intelligence is currently on the cusp of fundamentally changing diagnostic procedures and treatments in the healthcare sector. The development of artificial intelligence (AI) for use in medicine requires the training of algorithms with extensive data sets. By analysing large amounts of data, AI is able to recognise patterns that remain hidden from today's technical possibilities. This opens up new possibilities in countless areas of application, such as the early detection of diseases. The key to realising this potential lies in access to comprehensive and high-quality data sets.

This data comes from the analysis and digitalisation of tissue samples, X-ray images and blood samples taken in laboratories, hospitals and GP practices. This health data will not only be used for diagnosis and treatment ("primary use"), but also for the development of AI models ("secondary use").

There is great economic potential in the secondary utilisation of this data. Collaboration between institutes that have built up high-quality data sets over decades and research institutions, pharmaceutical and technology companies often fail due to facing important obstacles in accessing the data they need to develop new products.

A) Complex Regulatory Requirements

Compliance with data protection laws such as the GDPR and the DPA poses a challenge when accessing and using patient data for AI research in the healthcare sector, as this data is regularly categorised as particularly worthy of protection. The processing of such data generally requires the explicit and specific consent of the data subject, whereby the purpose of processing must be clearly defined and communicated in advance. Declarations of consent to a data intermediary for any further use are therefore invalid. The further use or change of purpose of existing data is generally not possible without express consent. In addition to the general data protection provisions, specific national regulations must also be observed, such as the Hospital Act, the Medical Professions Act and the Human Research Act in Switzerland or the corresponding national laws in the EU.

Due to the complex legal requirements, decision-makers in hospitals are exposed to a considerable liability risk, which often leads to a cautious approach to data transfer. There is no independent organisation as a data intermediary that can carry out the complex legal clarifications and provide the necessary assurances.

B) Lack of Technical Infrastructure

There is a lack of a coordinated infrastructure that enables efficient and secure data integration across different institutions and systems. This makes the digital collection and provision of extensive data sets more difficult. In addition, the lack of interoperability between different healthcare systems and data formats is a major obstacle that hinders the seamless exchange and integration of data across platforms. In addition to inconsistent formats, there are also significant differences in the results of different data collection devices.

C) Lack of Independence

Even if the legal and technical challenges of cooperation between data source and data processor appear to have been solved, many projects fail due to the unwillingness of institutions to pass on health data directly to profit-orientated companies.

II. Requirements for the Development of a Data Economy

In order to meet these structural challenges of data management, framework conditions must be created that promote the provision of data to third parties without violating existing legal bases or jeopardizing the public image.

A) New Framework Conditions for Data Governance

After the focus on data protection in the last decade, the potential of a data market has now also been recognised. A large number of countries have now recognised the economic potential of data access by third parties and are working on the applicable framework conditions (so-called data governance frameworks). The European Commission has presented the European Data Strategy 2020 with the aim of creating a single market for data. In addition to non-personal data, this market should also include personal data. In this context. The planned European Health Data Space (EHDS) is intended to reflect the EU's efforts to optimise access to health data.¹Furthermore, as part of this data strategy, the Data Governance Act (DGA)2 and the Data Ordinance (DA)3 came into force, creating the first legal texts that define the applicable framework conditions.

It also regulates so-called data intermediary services, which act as intermediaries to facilitate access to data. Such intermediaries can also be located in other EU countries. The DGA now regulates access to data from public bodies.

With the introduction of the DGA, intermediaries will be regulated as so-called data intermediary services. Compliance with the GDPR and the principle of consent to processing described therein remains unaffected. To avoid falling within the scope of application, anonymised data can be used. This no longer constitutes personal data and can therefore be passed on to third parties. Depending on the data user and purpose of use, the research privilege may also apply, meaning that consent may not be required. Further harmonisation will be achieved through the establishment of the EHDS.

B) Setting up the Technical Infrastructure

In parallel, the development of a coordinated infrastructure that enables secure and efficient data integration across different organisations and systems must be promoted to break down data silos and facilitate data access and sharing. In particular, a clear legal framework will reduce the risk of potential legal violations.

III. The Swiss Foundation as the Legal Entity of a Data Intermediary

Against this backdrop, Switzerland offers an ideal location for data intermediaries with its research-strong universities in the fields of AI and medicine, a strong pharmaceutical and medical sector and a dynamic environment for start-ups.

The choice of a Swiss foundation as the sponsor of a data platform in the field of artificial intelligence in healthcare appears to be particularly favourable, taking into account the previously discussed legal framework conditions in the EU and Switzerland. This is due to the specific constellation of legal, location-related and organisational factors, which are described below. A data brokerage service based in Switzerland can benefit from an excellent environment. Swiss universities are recognised as leaders in the field of AI in Europe. The Swiss medical and pharmaceutical sector also has a high demand for data. Swiss AI start-ups will benefit the most, as they often do not have the means to obtain legally compliant data from a large number of data owners.

A) Non-Profit – Purpose Limitation

The statutory earmarking of the foundation's assets ensures that all activities and resources serve the foundation's purpose in the long term. A change of purpose is possible, but requires that the original purpose can no longer be achieved. This gives the data owners and users involved the certainty that the platform will serve its purpose in the long term. The purpose of the foundation is published in the commercial register and can therefore be viewed by all parties involved. In addition, the foundation is subject to supervision by the municipality, which ensures that the foundation's assets are used for the intended purpose. The organisation as a charitable foundation also enhances the foundation's reputation and offers advantages, e.g. in terms of taxation.

B) Swiss Location not Disadvantaged Compared to EU Location

If a data intermediary service within the meaning of the DPA is to be operated, this is also possible through a Swiss foundation. As a recognised safe third country within the meaning of the GDPR, cross-border data transfer between the EU and Switzerland is possible. Swiss foundations can therefore act as data intermediaries and do not have to fulfil the high hurdles for data transfers to unsafe third countries. The GDPR does not apply to non-personal data, which means that the transfer to Switzerland is unobjectionable under data protection law. The foundation can therefore fully participate in the European data market and benefit from Switzerland as a location. A voluntary commitment by the foundation to comply with the highest standards, which go beyond the legal requirements and are updated on an ongoing basis, would be recommended. Compliance could then be verified by a specially appointed auditor.

C) Requirements for Setting up a Swiss Foundation

Foundations can be set up by private individuals or companies, among others. The donated assets are separated from the legal sphere of the founder and given their own legal personality. It can be operationally active or act as an umbrella foundation. The organs of the foundation must always be orientated towards the purpose of the foundation. At least one authorised signatory member of the foundation board must be resident in Switzerland. Net assets of at least CHF 50,000 are required for the foundation to be established.

IV. Conclusion

The proposed use of a Swiss foundation as a data intermediary could capitalise on Switzerland's good reputation for data protection and the legal framework that supports non-profit organisations in the processing of sensitive data.

The purpose of this legal form is to ensure that data processing strictly complies with the purposes set out in the foundation's charter, which could strengthen the trust of data subjects and supervisory authorities. Data intermediaries are recognised for their ability to facilitate secure and compliant data sharing by managing data access under strict legal and ethical standards.

The European Union's Data Governance Act also emphasises the increasing recognition of the role of data intermediaries in ensuring the cross-border use of data, making a Swiss-based entity an attractive proposition for pan-European collaborations.

‍

¹Proposal for a Regulation of the European Parliament and of the Council on the European health data space of 3 May 2022.

² Regulation (EU) 2022/868 of the European Parliament and of the Council of 30 May 2022 on European datagovernance and amending Regulation (EU) 2018/1724 (Data Governance Act).

³ Regulation (EU) 2023/2854 of the European Parliament and of the Council of 13 December 2023 on harmonised rules for fair access to and use of data and amending Regulation (EU) 2017/2394 and Directive (EU) 2020/1828 (Data Regulation).