Act on Information and Data Protection (Information and Data Protection Act, IDG) - Subject Matter and Purpose (IDG)

1. This Law regulates the handling of information by public authorities.

2. It aims to

a. ensure transparency in the actions of public authorities, thereby promoting free opinion formation and the exercise of democratic rights, insofar as overriding public or private interests do not stand opposed, and

b. protect the fundamental rights of natural persons whose personal data is processed by the public authorities.

3. The Government Council and the Cantonal Parliament ensure that inter-cantonal institutions with the participation of Basel-Landschaft provide equivalent data protection.

1. This law applies to all public bodies in accordance with § 3 paragraph 1.

2. It does not apply

a. insofar as a public body participates in economic competition and acts under private law.

b. ...

c. ...

2bis. The rights and claims of the affected person during pending procedures of civil and criminal justice, constitutional and administrative jurisdiction, as well as during pending mutual legal assistance proceedings, are exclusively governed by the applicable procedural law.

3. Diverging and supplementary provisions in other laws remain reserved, provided they ensure the protection of the fundamental rights of individuals whose personal data are processed by public bodies, within the meaning of this law.

1. Public bodies within the meaning of this law are

a. the organizational units of the canton and the municipalities that fulfill a public task;

b. the organizational units of legal entities under cantonal and municipal public law that fulfill a public task;

c. private entities insofar as the realization of public tasks has been delegated to them by the canton or municipalities.

2. Information within the meaning of this law refers to all records that pertain to the fulfillment of a public task, regardless of their form of representation and their information medium.

3. Personal data are information related to an identified or identifiable natural person.

4. Sensitive personal data are

a. Personal data whose processing poses a particular risk of violating fundamental rights, especially information regarding

1. religious, ideological, political, or trade union views or activities,

2. * the health, genetic data, intimate sphere, or ethnic origin,

2bis. * disabilities,

3. measures of social assistance,

4. * administrative or criminal prosecutions and sanctions,

5. * personal data obtained through special technical means relating to physical, physiological, or behavioral characteristics of a natural person that allow or confirm the unique identification of this person (biometric data).

b. Collections of information that allow an assessment of essential aspects of a natural person's personality (personality profile).

5. Processing is any handling of information, regardless of the means and procedures used, especially obtaining, storing, reading, modifying, disclosing, archiving, deleting, or destroying, as well as performing logical and/or computational operations with this information.

6. Disclosure is any act of making information accessible, such as granting insight, forwarding, or publishing.

7. Profiling is any evaluation of information to analyze essential personal characteristics or predict developments, particularly regarding work performance, economic situation, health, intimate sphere, or mobility.

8. A data processor on behalf is the private person or the public body that processes information on behalf of the public body responsible for the processing.

1. The public body structures the handling of information in such a way that it can inform rapidly, comprehensively, and objectively.

2. In doing so, it observes the requirements of the Disability Rights Act BL.

1. The public authority manages its information in accordance with the regulations on record keeping pursuant to the Archiving Act.

1. The responsibility for handling information lies with the public authority that processes the information to fulfill its statutory duties.

2. If multiple public authorities process a shared information resource, they shall regulate their responsibilities among themselves and determine which public authority will assume overall responsibility.

3. The responsible public authority must be able to demonstrate to the Data Protection Supervisory Authority that it complies with data protection regulations.

4. The government council shall regulate the specifics for the cantonal administration, while the municipal council shall regulate the specifics for the municipal administration. In the absence of regulations issued by municipalities, those applicable to the cantonal administration shall apply.

1. The public authority may delegate the processing of information to a data processor if

a. no legal provision or contractual agreement prohibits it, and

b. it is ensured that the information is processed only in the manner the public authority would be permitted to process it.

2. The public authority remains responsible for handling information under this law.

3. The data processor may not delegate the processing of information to another data processor without the prior written consent of the commissioning public authority.

1. The public authority protects information against loss, theft, as well as unlawful processing and disclosure through appropriate organizational and technical measures.

2. The measures to be taken are determined by the type of information, the nature and purpose of its use, and the current state of technology.

3. The government council shall regulate the specifics.

1. A public authority may process personal data if

a. there is a legal basis for doing so, or

b. it is necessary for the fulfillment of a statutory duty.

2. Special categories of personal data may be processed and profiling may only be conducted if

a. the permissibility is expressly provided by law, or

b. it is necessary for the fulfillment of a task explicitly described by law.

3. The processing of personal data must be carried out in good faith and must be proportionate.

4. Personal data may only be processed for as long as it is necessary for the fulfillment of the statutory duty.

**1. The Executive Council may, after obtaining the evaluation of the Data Protection Supervisory Authority (§ 35) within the framework of a preliminary consultation (§ 12), authorize the processing of special personal data before the enactment of a law, if:**

a. the tasks that necessitate this processing are regulated by a law, and

b. sufficient measures to prevent violations of personal rights are taken, and

c. the practical implementation of data processing mandatorily requires a test phase before the law comes into force.

**2. The practical implementation of data processing may mandatorily require a test phase if the fulfillment of a task:**

a. requires technical innovations whose impacts must first be evaluated, or

b. requires significant organizational or technical measures whose effectiveness must first be tested, especially in cooperation with public bodies of the federal government and other cantons and private parties, or

c. requires the disclosure of special personal data to third parties through a retrieval procedure.

**3. Pilot projects are limited to a maximum of 5 years.**

**4. Every pilot project must be evaluated.**

**5. The Executive Council shall regulate the modalities of data processing in an ordinance.**

1. Personal data must be accurate and, insofar as the purpose requires, complete.

2. Anyone who processes personal data must verify their accuracy.

3. All reasonable measures must be taken to correct or destroy data that are incorrect or incomplete with regard to the purpose for which they were collected or processed.

1. Personal data may only be processed for the purpose for which it was collected, unless a legal basis explicitly provides for further use or the data subject gives consent in an individual case.

2. For a non-personal purpose, the public authority may process personal data if the data is anonymized as soon as the purpose of processing permits; the evaluations must not allow any inferences to be drawn about the data subjects.

1. The responsible public authority shall assess, for each project involving the processing of personal data, whether there is likely to be a high risk to the fundamental rights of the data subjects.

2. If a high risk is likely, a Data Protection Impact Assessment must be conducted.

3. The Data Protection Impact Assessment shall include at least

a. a general description of the planned processing activities;

b. an assessment of the risks to the fundamental rights of the data subjects; and

c. an account and evaluation of the planned remedial measures, guarantees, security precautions, and procedures that are to ensure the protection of the fundamental rights of the data subjects and demonstrate that data protection provisions are being complied with.

1. The responsible public authority shall submit the following to the Data Protection Supervisory Authority (§ 35) for prior consultation at an early stage

a. * Legislative projects concerning the processing of personal data, and

b. * Projects for the processing of personal data that, due to the nature of the processing or the data to be processed, are likely to result in a high risk to the fundamental rights of the data subjects.

2. The Data Protection Supervisory Authority may establish criteria for processing operations that must be submitted to it for prior consultation.

1. The public authority designs information technology systems in such a way that no personal data, or as little as possible, is collected or processed as personally identifiable data.

2. In particular, the possibilities of anonymization and pseudonymization are to be utilized, insofar as this is possible and the effort is proportionate to the intended purpose of protection.

1. The responsible public authority shall appropriately inform the data subject about any data acquisition; this duty to inform also applies when the data is obtained from third parties.

2. To ensure transparent data processing and to enable the data subject to exercise their rights, the information shall include at least details regarding

a. * the responsible public authority along with contact details;

b. * the processed data or the categories of processed data;

c. * all available information about the origin of the personal data if it was not collected from the data subject;

d. * the legal basis and the purpose of the processing;

e. * the data recipients or the categories of data recipients, in case the data is disclosed to third parties; and

f. * the rights of the data subject.

3. The duty to inform does not apply if

a. * the data subject already possesses the information according to paragraph 2;

b. * the processing of personal data is expressly provided for by law; or

c. * providing the information is impossible or only possible with disproportionate effort.

4. The disclosure of information may be restricted under the same conditions as access to one's personal data.

1. Personal data that is no longer needed and deemed not worthy of archiving by the authority responsible under the Archiving Act must be destroyed by the public body.

2. Deadlines must be established for all information holdings that contain personal data to assess whether the personal data is still needed for task fulfillment, or whether it should be archived or destroyed.

1. A data protection breach occurs when security is compromised so that

a. processed personal data is irretrievably destroyed or lost, accidentally or unlawfully altered or disclosed; or

b. unauthorized persons gain access to such personal data.

2. The responsible public authority shall report a data protection breach to the Data Protection Supervisory Authority (§ 35) without undue delay.

3. The data processor shall promptly inform the commissioning public authority of a data protection breach.

4. The public authority is not obliged to report if the data protection breach is not likely to result in a risk to the fundamental rights of the affected person. The Data Protection Supervisory Authority may establish criteria for data protection breaches that must be reported to it.

5. The public authority shall inform the affected persons if the circumstances require it or if the Data Protection Supervisory Authority demands it.

6. The notification to the affected persons may also be wholly or partially omitted or deferred, if a restriction pursuant to § 27 is permissible.

1. The public authority may have its procedures, organization, and technical facilities audited and evaluated by an independent and recognized body to ensure the quality of information processing.

1. The public authority shall inform the public about its activities and matters of general interest.

2. Of general interest are pieces of information that pertain to matters of public concern and are significant for the formation of opinion and for safeguarding the democratic rights of the population.

3. The public authority shall provide information about its structure, its responsibilities, and its contact persons.

4. The public authority may provide information on pending proceedings if this is necessary to correct or prevent false reports or if in an exceptionally serious or attention-grabbing case it is deemed appropriate to inform without delay.

5. The governmental council shall regulate the information activities for the cantonal administration. The information shall be provided in an objective, simple, and cost-effective manner, preferably via the internet.

1. The public authority discloses personal data if

a. there is a legal basis that obliges or authorizes it to do so, or

b. it is necessary for the fulfillment of a legal obligation, or

c. in an individual case, the affected person has explicitly consented, or if they are unable to do so, the disclosure is in their interest and their consent may be presumed in good faith.

2. Personal data may only be made accessible through a retrieval system if the legal basis expressly provides for it.

1. The public authority may disclose special personal data or the results of profiling if

a. a law expressly obligates or authorizes it, or

b. it is necessary for the fulfillment of a task expressly defined in the law, or

c. in individual cases, the affected person has explicitly consented, or, if they are unable to do so, the disclosure is in their interest and their consent may be presumed in good faith.

2. Special personal data may only be made accessible through a retrieval procedure if a law expressly provides for it.

1. The public body may disclose personal data for processing for a non-personal purpose provided that this is not excluded by a specific confidentiality provision.

2. The recipient must undertake to

a. anonymize or pseudonymize the personal data as soon as the purpose of processing allows;

b. disclose the evaluations only in such a way that no conclusions can be drawn about the individuals concerned.

3. Personal data may be disclosed to private parties only if they additionally undertake not to process the data for other purposes, not to pass it on to third parties, and ensure data security is maintained.

1. Public authorities may disclose personal data to other authorities or private entities that do not fall under the jurisdiction of a state that has acceded to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, only if

a. the legislation of the recipient state ensures adequate protection;

b. adequate protection is guaranteed through contractual agreements;

c. in individual cases, it is essential either for the protection of an overriding public interest or for the establishment, exercise, or defense of legal claims in court, or

d. the individual concerned has expressly consented to the disclosure in a specific case, or, if they are unable to do so, the disclosure is in their interest, and their consent may be reasonably presumed in good faith.

2. Subject to statutory provisions concerning the exchange and further processing of personal data within the framework of the Schengen Information System (SIS).

1. The prosecution, criminal jurisdiction, and penal enforcement authorities shall maintain a complete register of their procedures in which personal data is processed.

2. The register shall be made easily accessible to the public, in particular through public data networks.

3. The government council shall regulate, by ordinance, the content of the register and the exceptions to the publication requirement.

1. Every person has the right to access information held by a public body as defined in § 3 para. 1 lit. a and b, except for records that are not completed.

2. In pending administrative and administrative complaint procedures, the right to access information is governed by the relevant procedural law.

1. Every person has the right to know whether personal data about them is held by a public authority and, if applicable, to access their own personal data.

2. Access includes

a. the information pursuant to § 14 paragraph 2 and

b. all personal data concerning the requesting person.

1. Any affected person may request from the public authority that it, free of charge

a. corrects incorrect personal data or, if correction is not possible, destroys it;

b. refrains from unlawfully processing personal data;

c. rectifies the consequences of the unlawful processing of personal data;

d. confirms in writing the unlawfulness of the processing of personal data.

2. If the public authority disputes the inaccuracy, it must prove the accuracy of the personal data.

3. If, by the nature of the data, neither the accuracy nor the inaccuracy of personal data can be proven, particularly for those containing an evaluation of human behavior, the affected person may request the inclusion of a counterstatement.

1. The affected person can request in writing that the responsible public authority restrict the disclosure of their personal data.

2. Disclosure is permissible despite the restriction if

a. the public authority is legally obligated to disclose, or

b. the disclosure is necessary to fulfill a legal duty, or

c. the person requesting disclosure credibly demonstrates that the personal data is necessary to enforce their legal claims.

1. Any individual may report facts to the Data Protection Supervisory Authority (§ 35), indicating that a public body or a data processor has violated data protection regulations in the processing of personal data concerning them.

2. The reporting individual does not have the rights of a party, but must be informed of the outcome or status of the investigations within a maximum of 3 months.

1. The public authority must refuse or postpone the disclosure of or access to information in individual cases, either wholly or partially, if there is a specific legal obligation of confidentiality or if overriding public or private interests are opposed.

2. An overriding public interest exists in particular if the disclosure of the information or access to the information

a. endangers the security of the state or public safety, or

b. impairs relations with another canton, the federal government, or foreign countries, or

c. impairs the free opinion and will formation process of public authorities, or

d. impairs the position in negotiations, or

e. impairs the targeted implementation of specific official measures, particularly those by police authorities.

3. An overriding private interest exists in particular if

a. the disclosure of the information or access to the information impairs the protection of privacy, or

b. the disclosure of the information or access to the information reveals professional, manufacturing, or business secrets or violates copyright, or

c. the disclosure of or access to information is requested, which was voluntarily provided to the public authority by third parties and whose confidentiality has been assured.

4. Access to one's own personal data, particularly for personal data in medical records and files in medical and social areas as well as in criminal and enforcement proceedings, may also be restricted if required due to the interests of the person requesting access.

1. If access to personal data held by a public authority is not already to be partially or entirely denied under § 27, this personal data must be anonymized before access is granted.

2. If anonymization is not possible or not fully possible, the public authority may grant access to non-anonymized personal data if

a. there is an overriding public interest in access to the non-anonymized personal data, or

b. the conditions for the disclosure of personal data are met (§ 18 ff.).

1. Any person who wishes to obtain access to information pursuant to §§ 23 and 24 must submit a request in writing or orally, specifying the desired information with sufficient precision.

2. A person requesting access to their own personal data must verify their identity, unless their identity is unequivocally established for the requested public body.

1. If a request pertains exclusively to information that is already publicly available and reasonably accessible, the public body shall dismiss the request with reference to the source.

2. Should the interests of third parties or other public bodies be affected in the sense of § 27, the public body shall afford these persons or bodies an opportunity to comment within an appropriate time period, unless it is clear even without such comments that access must be wholly or partially denied.

1. If there are no obstacles to accessing information, the public body grants access to the requesting person.

2. If the public body, based on its assessment or the obtained opinions, considers a complete or partial denial of the access request, it informs the requesting person.

3. If it considers granting the access request contrary to the obtained opinions, it informs the affected third parties or other public bodies.

4. Within 30 days after receipt of the notification pursuant to paragraphs 2 and 3, the requesting person and the third party may request the public body to issue a contestable decision.

1. The public authority grants access to information by

a. providing the information in writing, in the form of copies, or on data carriers, or

b. with the consent of the requesting person, communicating the information orally or granting them on-site access to the information.

2. For an orally submitted request for access, the public authority may communicate the information orally to the requesting person.

1. The public authority must, within 30 days of receiving the request

a. grant the applicant access to the information,

b. send a notification in accordance with § 31 paragraph 2, or

c. if the deadline cannot be met, inform the applicant of the reasons and indicate when the decision will be made.

1. In general, no fees are charged for the procedure to access information.

2. A reasonable fee based on the effort may be charged, but in no case for access to one's own personal data

a. for demanding procedures, such as in complex situations or extensive anonymization of information;

b. for the creation of copies or other data carriers for the applicant person.

3. The public authority shall inform the applicant person if the application involves significant costs; in such a case, it may demand an advance payment before further processing the application.

4. If the information is suitable for commercial use, a fee may be charged based on the market.

5. The government council shall issue a fee schedule.

1. The canton establishes an independent oversight authority under the name "The Data Protection Officer."

2. It may jointly manage the oversight authority with other cantons based on an interstate treaty.

1. The supervisory authority performs its duties independently of instructions.

2. The supervisory authority does not oversee

a. the members of the cantonal council, the cantonal executive council members, or the government council as authorities;

b. data processing in ongoing proceedings of civil and criminal justice, constitutional and administrative judiciary, as well as in ongoing legal assistance procedures.

3. The cantonal council exercises overall supervision over the supervisory authority.

4. The supervisory authority is administratively assigned to the state chancery.

1. The cantonal supervisory authority is headed by an expert in data protection matters ("The Data Protection Officer").

2. He or she is elected by the cantonal parliament based on a proposal from the government council for a term of office. The cantonal parliament is bound by the nomination proposal.

1. The Data Protection Officer is responsible for the hiring and promotion of other staff members of the oversight office within the budgetary credit for employment approved by the District Administrator.

1. The financial management of the supervisory body is governed by the financial budget legislation, insofar as this law does not contain any special provisions.

2. The Data Protection Officer

a. independently manages the budget credits approved by the Landrat;

b. independently decides on budget overruns and budget transfers;

c. independently authorizes expenditures for which the Landrat is not responsible;

d. ensures appropriate controlling.

3. Requests for supplementary credits from the supervisory body are submitted to the Landrat without alteration.

4. The government council may submit a request to the Landrat to amend the supplementary credit requests of the supervisory body.

1. The supervisory authority prepares its own task and financial plan.

2. The government council adopts the supervisory authority's task and financial plan unchanged into that of the canton.

3. It may submit a proposal to the cantonal council to amend the task and financial plan of the supervisory authority.

1. The Supervisory Authority

a. monitors the application of the provisions concerning the handling of information according to an audit program autonomously set up by it;

b. * provides opinions on legislative projects and other initiatives submitted to it for prior consultation (§ 12);

c. advises public authorities on issues related to the handling of information;

d. advises affected individuals on their rights;

e. mediates between affected individuals and public authorities;

f. provides opinions on enactments significant to information handling or data protection;

g. * deals with regulatory notifications (§ 26a) and informs the notifier of the outcome or status of clarifications;

h. * raises awareness among public authorities of their data protection obligations and sensitizes the public to the concerns of data protection and transparency;

i. * follows developments significant to the protection of personal data and the principle of public access.

1. The supervisory authority may obtain information about data processing, regardless of any confidentiality obligations, in writing or orally from public bodies, data processors, and third parties who have received personal data from a public body. It may also inspect all documents, conduct on-site inspections, and have data processing demonstrated.

2. The public bodies, data processors, and third parties are obligated to support the supervisory authority in fulfilling its tasks. They particularly assist in the establishment of facts.

3. The reports that the supervisory authority prepares or has prepared in the context of its supervisory activities are not public in the sense of § 23 para. 1, along with the materials upon which they are based.

1. If the legitimate interests of an affected person are evidently endangered or violated, the supervisory authority shall request the public body or its superior authority to immediately take the necessary provisional measures.

1. The supervisory authority may issue recommendations regarding the handling of information.

2. The public body to which the recommendation is directed is generally required to declare to the supervisory authority within 4 weeks whether it intends to follow the recommendation.

1. If a public body declares that it does not intend to follow the recommendation of the supervisory authority, or does not actually follow the recommendation, the supervisory authority may, insofar as the interest in enforcement is significant, issue its recommendation or parts thereof as a directive in the form of an order.

2. No directive can be issued against the Cantonal Court.

3. The supervisory authority may issue a directive directly if it is foreseeable that the public body will reject a recommendation or not comply with it.

4. The public body to which the directive is addressed may challenge it by lodging an appeal with the Executive Council in accordance with §§ 27 et seq. of the Administrative Procedure Act.

5. Institutions of cantonal public law direct their appeal directly to the Cantonal Court.

6. The supervisory authority is entitled to lodge an appeal against the decision of the Executive Council.

1. The supervisory authority collaborates with the bodies of the municipalities, other cantons, the federal government, and foreign entities that perform similar functions to fulfill its tasks.

1. The head and the staff of the supervisory authority are subject to the same duty of confidentiality concerning the information they become aware of in the course of their work as the processing public body.

2. The duty of confidentiality extends beyond the termination of the function.

1. The supervisory body shall periodically report to the electoral authority on the scope and focus of activities as well as on important findings and assessments.

2. The report shall be published.

1. The municipality may establish its own supervisory authority for the municipal sector.

2. If it refrains from doing so, or if the municipal supervisory authority does not meet the requirements for independence, the cantonal supervisory authority is responsible.

3. The municipal appointee and any additional staff members may not hold any other official functions within the municipality.

4. Sections 40-47 apply mutatis mutandis to the municipal supervisory authority within its area of responsibility.

1. Any third party who, as designated under § 7, uses or discloses personal data for themselves or others without the express authorization of the commissioning public authority, either intentionally or negligently, shall be punished with a fine.

2. Anyone who intentionally or negligently discloses personal data, which they have received from a public authority for processing for a non-personal purpose, to third parties in contravention of the obligation under § 20 paragraph 3, shall be punished with a fine.

1. The following are amended

1. Cantonal Statistics Act: The Cantonal Statistics Act of February 21, 2008, is amended as follows: ...

2. Registration and Register Act; The Registration and Register Act (ARG) of June 19, 2008, is amended as follows: ...

3. Land Council Act: The Act of November 21, 1994, concerning the organization and proceedings of the Land Council (Land Council Act, LRG) is amended as follows: ...

4. Administrative Organization Act: The Act of June 6, 1983, concerning the organization of the Council of Government and the cantonal administration (Administrative Organization Act) is amended as follows: ...

5. Personnel Act: The Act of September 25, 1997, concerning the employment relationships of the staff of the Canton (Personnel Act) is amended as follows: ...

6. Archiving Act: The Act of May 11, 2006, concerning archiving (Archiving Act) is amended as follows: ...

7. Municipal Act: The Act of May 28, 1970, concerning the organization and administration of the municipalities (Municipal Act) is amended as follows: ...

8. Police Act: The Police Act of November 28, 1996, is amended as follows: ...

1. The Law of March 7, 1991, on the Protection of Personal Data (Data Protection Act) is hereby repealed.

1. Within 2 years after the entry into force of this law, the registers of information inventories containing personal data in accordance with § 22 must be published.

2. The Executive Council may, upon a substantiated request, extend the deadline by one year.

1. The government council enacts the commencement of this law.