Implementation of EU data protection instruments: Discretion and problem-solving at the subnational level

The subnational implementation of international instruments in federal states is an under-explored process (Thomann & Sager, 2017). Subnational entities regularly enjoy a degree of sovereignty, which raises questions such as whether––and how––international instruments are implemented at the subnational level. This paper aims to observe how international instruments are legally implemented in subnational legislations and implemented in practice (Sager, Rüefli, & Thomann, 2019; Zhelyazkova & Thomann, 2022). To structure our analysis, we ask three questions: 1. What is the level of legal and practical compliance with international law at the subnational level? 2. To what extent do subnational entities customize the implementation of international law? 3. What discretion do civil servants enjoy in the legal and practical implementation of international law, and how does such discretion influence compliance? To explore these questions, we use the implementation of EU data protection law in Switzerland as a case study. We carried out an in-depth documents analysis and 28 interviews with national and subnational actors involved in the regulation of data protection in Switzerland. We first observe a high degree of legal compliance with the directive, with little discretion except some cases of formal customization. By contrast, practical compliance is low. Our in-depth analysis reveals that mid- and street-level civil servants act as "steward", rather than "agent" of implementation, meaning that they identify with the norms and values of the instruments and work toward their implementation. Nonetheless, they are limited in implementation by the resources they have. Thus, their discretion is not a cause for non-implementation, neither for effective implementation; rather, it emerges as a consequence of the gap between ambitious international instruments and the practical realities on the ground.