Switzerland's data protection laws are way behind the GDPR. Switzerland is struggling to adapt its data protection laws to keep its adequacy status with the EU. It has still not signed Convention 108.
Switzerland's surveillance system is growing and growing. The latest revision of the relevant law was targeted at services like ProtonMail and ProtonVPN (Federal Act on the Surveillance of Post and Telecommunications). Switzerland's federal secret service has got almost unlimited power without any meaningful control and is known as a close partner of the US (thanks to Snowden leaks). Every communication in Switzerland is under mass surveillance 24/7, the metadata is stored for at least six months (civil security authorities) or longer (secret services). Switzerland's armed forces work in close cooperation with NATO.
I am actually wondering whether Proton is a honeypot.