Data Blocking (DSV)

**1.** The responsible authority shall confirm the order of data blocking of personal data (Art. 13 KDSG[[2]](#paragraphtext_content_fn_2031057_2_2_c)) to the applicant in writing.

**2.** The request for data blocking and the confirmation can be conducted electronically, if the responsible authority has taken appropriate measures to

**a** ensure the identification of the affected person and

**b** protect the personal data of the affected person from access by unauthorized third parties during the processing of the request.

If personal data is made accessible to the public through automated information and communication services, the responsible authority ensures that the legal basis also permits the disclosure of data abroad.

1. If the supervisory authority was informed about the guarantees pursuant to Article 14a paragraph 2 letter a KDSG, the duty to inform is considered fulfilled for all further disclosures made under the same guarantees, provided that the categories of recipients, the purpose of processing, and the categories of data remain substantially unchanged.

2. The duty to inform is also considered fulfilled if data is transferred based on model contracts or standard contractual clauses that have been prepared or recognized by the Federal Data Protection and Information Commissioner, and the supervisory authority has been informed by the responsible authority in general terms about the use of these model contracts or standard contractual clauses.

3. The responsible authority shall take measures to ensure that the recipient observes the guarantees.

**1. The Responsible Authority, which Processes Personal Data or Provides a Data Communication Network, Ensures Confidentiality, Availability, and Accuracy of the Data with Technical and Organizational Measures (Art. 17 KDSG). In Particular, it Protects the Systems Against the Following Risks:**

a) Unauthorized or Accidental Destruction,

b) Accidental Loss,

c) Technical Errors,

d) Forgery, Theft, or Unlawful Use,

e) Unauthorized Modification, Copying, Access, or Other Unauthorized Processing.

**2. The Measures Must Be Appropriate. Specifically, They Shall Consider the Following Criteria:**

a) Purpose of Data Processing,

b) Nature and Extent of Data Processing,

c) Assessment of Possible Risks to the Affected Persons,

d) Current State of Technology.

**3. The Risks and Measures Shall Be Reviewed Periodically.**

1. The responsible authority shall implement the following technical and organizational measures, particularly in the electronic processing of personal data

a) Access Control: Unauthorized persons shall be denied access to facilities where personal data is processed;

b) Data Carrier Control: Unauthorized persons shall be prevented from reading, copying, altering, or removing data carriers;

c) Transport Control: During the disclosure of personal data and the transportation of data carriers, it must be ensured that the data cannot be read, copied, altered, or deleted by unauthorized persons;

d) Disclosure Control: Recipients of data to whom personal data is disclosed via data transmission facilities must be identifiable;

e) Storage Control: Unauthorized input into storage as well as unauthorized access, alteration, or deletion of stored personal data must be prevented;

f) User Control: The use of automated data processing systems via data transmission facilities by unauthorized persons shall be prevented;

g) Access Control: The access of authorized persons shall be restricted to the personal data required to perform their duties;

h) Input Control: In automated systems, it must be possible to retrospectively verify which personal data was entered at what time and by which person.

2. Data collections must be designed in such a way that the affected individuals can exercise their right to information and their right to rectification.

The responsible authority records the automated processing of particularly sensitive personal data or personal data subject to a special confidentiality obligation if the preventive measures do not guarantee data protection.

Recording must particularly take place if it cannot otherwise be determined retrospectively whether the data were processed for the purposes for which they were collected or disclosed.

The records must be kept in a manner suitable for auditing for one year. They are accessible exclusively to the entities responsible for monitoring compliance with data protection regulations and may only be used for this purpose. Deviating provisions in legislation or in operational permits remain reserved.

1. Technical means with particular risks to the rights and freedoms of the data subjects in accordance with Article 17a paragraph 1 letter d of KDSG are particularly present when personal data

a. is stored on data carriers which the data subject carries with them,

b. is stored on RFID chips (passive radio-frequency identification transponders),

c. is transmitted via wireless connections, provided these are not wireless phone connections and wireless connections of payment terminals, whose security for commercial transactions has already been verified,

d. is collected using image recording and processing devices.

2. The same applies if

a. specially protected personal data is transmitted over public networks,

b. private parties are to be granted restricted access to data from a personal data database through the internet.

3. A substantial change in accordance with Article 17a paragraph 2 of KDSG exists particularly when

a. the means or the purpose of data processing change significantly or

b. the change alone meets the prerequisites for a prior check.

4. If only the scope of data processing changes, this does not constitute a substantial change.

1. Municipalities and other municipal law entities may waive a preliminary review if

a they use data processing systems or programs that have certification according to Article 11 of the Federal Act of 19 June 1992 on Data Protection (FADP)[[4]](#enumeration_itemtext_content_fn_1262180_2_4_c) and this certification covers both information technology security and overall data protection, or

b the data processing, including electronically archived data processing, concerns fewer than 500 individuals.

1. For the information technology projects of the canton and for information technology projects to which the canton grants compensation according to specific legislation, the Department of Finance regulates by departmental ordinance

a) the analysis of information security and data protection,

b) the preliminary review and its timing,

c) the requirements for information security and data protection.

1. Data collections shall not be entered into the register if they

a) are used for a maximum of two years,

b) are stored in the state or municipal archive, or

c) are publicly accessible in the form of yearbooks.

1. The information or the reasoned decision regarding the restriction of the right to information (Art. 21 and 22 KDSG) shall be provided no later than 30 days from the receipt of the request for information. If the information cannot be provided within 30 days, the responsible authority must inform the applicant and notify them of the deadline by which the information will be provided.

2. The request for information and the provision of information may occur electronically if the responsible authority has taken appropriate measures to

a) ensure the identification of the data subject and

b) protect the personal data of the data subject from unauthorized third-party access during the provision of information.

1. If information concerning data of deceased persons is requested, it must be provided if the applicant demonstrates an interest in the information and there are no overriding interests of the relatives of the deceased person or third parties opposed to it. In the case of close kinship as well as marriage or registered partnership with the deceased person, this proof is considered provided. Special confidentiality obligations remain reserved.

1. The responsible authorities submit to the supervisory body all drafts of decrees and other measures pursuant to Article 34, paragraph 1, letter k of the KDSG, which concern the processing of personal data and data protection.

2. The departments and the state chancellery communicate their decisions and rulings in the field of data protection to the cantonal supervisory body in anonymized form.

1. If the municipalities and other entities governed by municipal law do not establish a differing regulation, their supervisory bodies have the following annual expenditure authority

a) 1,000 Swiss Francs for micro entities as per Article 64a of the Municipal Regulation[[5]](#enumeration_itemtext_content_fn_1262190_2_5_c),

b) 5,000 Swiss Francs for municipalities with up to 10,000 inhabitants and for other entities governed by municipal law,

c) 10,000 Swiss Francs for municipalities with more than 10,000 inhabitants.

1. The State Chancellery and the Directorates each designate at least one contact point for data protection. This contact point shall

a. Advise the organizational units on data protection issues,

b. Forward inquiries, which it cannot answer itself, to the cantonal data protection supervisory authority,

c. Support the responsible bodies and users,

d. Promote the information and training of employees,

e. Assist in the implementation of data protection regulations.

2. If the Directorates and the State Chancellery do not designate other offices, the legal services of the Directorates and the State Chancellery or the administrative jurists serve as the contact point.

3. The advice for municipal legal bodies on general data protection issues is provided by the Office for Municipalities and Spatial Planning of the Directorate of the Interior and Justice. For specialized data protection issues, advice is provided by the respective legal services of the Directorates and the State Chancellery or the administrative jurists. The cantonal data protection supervisory authority remains the point of contact for the data protection supervisory authorities of municipal legal bodies.

1. The jurisdictions of the authorities regarding administrative legal proceedings are generally governed by the provisions of the law on administrative legal proceedings.

2. Appeals against decisions made by institutions and corporations of the canton, as well as by private individuals fulfilling cantonal public tasks, can be filed with the directorate that supervises or is closest to the respective field.

3. Appeals against decisions made by the organs of the Grand Council can be brought before the plenary session.

1. The following enactments are amended

1. Ordinance of October 26, 1994, on Informing the Public (Information Ordinance; IV)

2. Ordinance of June 26, 1996, on the Consultation and Co-reporting Procedure (VMV)

3. Ordinance on the Organization and Duties of the Directorate of Justice, Communities and Churches of October 18, 1995 (Organization Ordinance JGK; OrV JGK)

4. Ordinance on the Fees of the Cantonal Administration of February 22, 1995 (Fee Ordinance; GebV)

5. Hospital Provision Ordinance of November 30, 2005 (SpVV)

This regulation shall enter into force on January 1, 2009.