Cantonal Data Protection Act (KDSG) - Purpose (KDSG)

1. This Act aims to protect individuals from unlawful processing of personal data by public bodies.

1. This law applies to the processing of personal data by public authorities.

2. As far as a public authority participates in economic competition and does not act in a sovereign capacity, the provisions of the Federal Data Protection Act are applicable to these data processes. Oversight is governed by this present law, except for public authorities that exclusively participate in economic competition and act in a private capacity.

3. The applicable procedural law regulates the processing of personal data and the rights of the affected individuals in judicial proceedings, in procedures according to federal procedural laws, as well as in administrative legal procedures, with the exception of first-instance procedures before administrative authorities.

4. Deviating and supplementary provisions in other laws remain reserved, provided they ensure the protection of the fundamental rights of persons whose personal data are processed by public authorities in the sense of this law.

1. The following are considered public bodies under this law

a) the authorities, administrations, and commissions of the canton, regions, municipalities, and associations of municipalities;

b) the authorities, administrations, and commissions of public law institutions, foundations, and corporations of the canton, regions, and municipalities;

c) natural or legal persons or other private law organizations, to the extent that they perform public tasks assigned to them.

2. Personal data as defined by this law is all information relating to an identified or identifiable natural or legal person.

3. Particularly sensitive personal data is personal data for which there is a special risk of fundamental rights violations, especially

a) data concerning religious, ideological, political, or trade union views or activities;

b) data concerning health, intimate areas, or affiliation with a race or ethnicity;

c) genetic data;

d) biometric data that uniquely identify a natural person;

e) data concerning administrative and criminal prosecutions or sanctions;

f) data concerning measures of social assistance.

4. Personality profiles are collections of data that allow for the assessment of essential aspects of the personality of a natural person.

5. Profiling is any type of automated processing of personal data that involves using this data to evaluate certain personal aspects relating to a natural person, particularly to analyze or predict aspects concerning work performance, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements of this person.

6. Processing is any handling of personal data, regardless of the means and procedures applied, especially the collection, storage, retention, use, modification, disclosure, archiving, deletion, or destruction of data.

7. Disclosure is the transmission or making accessible of personal data.

8. Breach of data security is a violation of security that leads to personal data being accidentally or unlawfully lost, deleted, destroyed, altered, or disclosed to or made accessible to unauthorized persons.

9. A processor is a third party who processes personal data on behalf of the responsible public body.

1. The public authority responsible for data protection is the one that, alone or together with others, decides on the purpose and means of processing.

2. If multiple public authorities process personal data from a data set, they must regulate responsibility among themselves and determine which public authority bears overall responsibility.

3. The responsible public authority must be able to demonstrate to the supervisory body, upon request, that it complies with data protection regulations.

1. Personal data must be processed lawfully.

2. Processing must be carried out in good faith and must be proportionate.

3. Personal data may only be collected for a specific purpose that is identifiable to the data subject; they may only be processed in a manner compatible with this purpose.

4. They must be destroyed or made anonymous as soon as they are no longer required for the purpose of processing.

5. Anyone who processes personal data must ensure their accuracy. They must take all reasonable measures to correct, delete, or destroy data that are inaccurate or incomplete with regard to the purpose of their collection or processing. The appropriateness of the measures depends in particular on the nature and extent of the processing as well as on the risk that the processing brings to the fundamental rights of the data subjects.

6. If the consent of the data subject is required, such consent is valid only if it is given voluntarily for one or more specific processing activities after adequate information.

7. Consent must be given explicitly for

a) the processing of particularly sensitive personal data;

b) profiling or processing a personality profile.

1. The responsible public authority and the data processor shall ensure appropriate data security relative to the risk through suitable technical and organizational measures.

2. The measures must enable the prevention of data security breaches.

3. The government shall issue regulations on the minimum requirements for data security.

1. Public authorities may only process personal data if there is a legal basis for doing so or if the processing is indispensable for the fulfillment of a legal obligation.

2. A legal basis is required in the following cases

a) the processing involves particularly sensitive personal data;

b) it involves a personality profile or profiling;

c) the purpose of processing or the manner in which the data is processed could lead to a serious encroachment on the fundamental rights of the affected person.

3. For the processing of personal data referred to in paragraph 2, letter a and letter b, a basis in a regulation is sufficient if the following conditions are met

a) the processing is indispensable for a task explicitly described in a law;

b) the purpose of processing poses no special risks to the fundamental rights of the affected person.

4. In deviation from paragraphs 1 to 3, public authorities may process personal data if one of the following conditions is met

a) the affected person has consented to the processing in the specific case or has generally made their personal data accessible and has not explicitly prohibited the processing;

b) the processing is necessary to protect the life or physical integrity of the affected person or a third party, and it is not possible to obtain the affected person's consent within a reasonable period of time.

1. The government may authorize the automated processing of particularly sensitive personal data or personality profiles, or profiling, before a law comes into force if

a) the tasks for which the processing is necessary are regulated in an already existing law;

b) sufficient measures have been taken to minimize the intrusion into the fundamental rights of the individuals concerned; and

c) a test phase before the law's entry into force is indispensable for the practical implementation of the data processing, particularly for technical reasons.

2. The government shall obtain the opinion of the supervisory authority in advance.

3. The responsible public body shall submit an evaluation report to the government no later than two years after the commencement of the pilot trial. It shall propose the continuation or cessation of the processing therein.

4. In any case, the automated data processing must be discontinued if, within five years of the commencement of the pilot trial, no law containing the necessary legal basis has come into force.

1. Processing of personal data may be contractually or legislatively assigned to a processor if

a) the data is processed in the same manner as the responsible public body itself would be permitted to process it; and

b) no statutory or contractual duty of confidentiality prohibits the transfer.

2. The responsible public body must ascertain, in particular, that the processor is capable of ensuring data security.

3. The processor may transfer the processing to a third party only with prior authorization from the responsible public body.

1. Public authorities may only disclose personal data if a legal basis exists according to Article 7 paragraphs 1 to 3.

2. They may disclose personal data as an exception to paragraph 1 in individual cases if one of the following conditions is fulfilled

a) The disclosure of the data is indispensable for the responsible public authority or for the recipient to fulfill a legal duty;

b) The data subject has consented to the disclosure or has made the data generally accessible and has not explicitly prohibited disclosure;

c) The disclosure of the data is necessary to protect the life or physical integrity of the data subject or a third party, and it is not possible to obtain the consent of the data subject within a reasonable period;

d) The recipient credibly demonstrates that the data subject refuses consent or objects to the disclosure in order to prevent the enforcement of their legal claims or the realization of other legitimate interests; the data subject should be given the opportunity to provide a statement beforehand, unless this is impossible or involves disproportionate effort.

3. They may also disclose the name, first name, address, and date of birth of a person upon request, even if the conditions under paragraph 1 or 2 are not met.

4. Public authorities shall refuse disclosure, restrict it, or attach conditions if

a) Essential public interests or obviously legitimate interests of the data subject demand it; or

b) Legal confidentiality obligations or special data protection regulations require it.

1. Public authorities may further disclose personal data in the context of official information to the public on their own initiative if

a) the data is related to the fulfillment of public duties; and

b) there is an overriding public interest in the disclosure.

2. They may make personal data generally accessible through automated information and communication services if a legal basis provides for the publication of these data or if they disclose data pursuant to paragraph 1. If there is no longer a public interest in making the data generally accessible, then the relevant data shall be deleted from the automated information and communication service.

3. The procedure for access to official documents is governed by the Freedom of Information Act.

1. Personal data may be disclosed abroad if the legislation of the concerned state or the international body ensures adequate protection.

2. In states whose legislation does not ensure adequate protection, personal data may only be disclosed if

a) sufficient guarantees, particularly by contract, ensure adequate protection abroad;

b) the person concerned has expressly consented to the disclosure;

c) the disclosure is directly connected with the conclusion or execution of a contract between the responsible public body and the person concerned, or between the responsible public body and its contractual partner in the interest of the person concerned;

d) the disclosure is necessary for the safeguarding of an overriding public interest or for the establishment, exercise, or enforcement of legal claims before a court or another competent foreign authority;

e) the disclosure is necessary to protect the life or physical integrity of the person concerned or a third party, and it is not possible to obtain the consent of the person concerned within a reasonable period;

f) the person concerned has made the data generally accessible and has not expressly prohibited its processing; or

g) the data originates from a statutory register that is open to the public or accessible to persons with a legitimate interest, provided that the legal requirements for inspection in the individual case are fulfilled.

3. Before the disclosure of personal data abroad, the public body must inform the supervisory authority about the guarantees according to Paragraph 2, Letter a.

1. Public bodies may process personal data for non-personal purposes, particularly for research, planning, or statistics, when

a) the data is anonymized as soon as the purpose of processing allows;

b) the public body discloses particularly sensitive personal data to private individuals only in such a way that the individuals concerned cannot be identified;

c) the recipient only forwards the data to third parties with the consent of the public body that disclosed the data; and

d) the results are published only in such a way that the individuals concerned cannot be identified.

2. Article 5 paragraph 3, Article 7 paragraph 2, and Article 10 paragraph 1 do not apply.

1. Public and publicly accessible areas may be monitored with image transmission and image recording devices for the purpose of identifying individuals, provided that

a) public safety and order are concretely endangered; or

b) it is necessary for the protection of buildings serving public purposes or their users.

2. In the processing of personal data, general principles must be respected. Additionally, it must be ensured that

a) there is an appropriate and recognizable indication of the surveillance devices;

b) areas used for activities falling under professional secrecy as defined in Article 171 of the Swiss Code of Criminal Procedure are excluded from surveillance; and

c) recorded personal data are deleted within a maximum of 90 days or handed over to the competent authority for use in criminal proceedings or for the enforcement of civil claims due to a criminal offense.

1. Surveillance of public and publicly accessible spaces may be ordered by a public authority that holds the right of use or sovereign control over the area to be monitored.

2. The public authority shall issue a general order specifying the purpose, type, and duration of the surveillance, the locations to be monitored, the positions of the surveillance devices, the measures to indicate surveillance, the access rights, and the measures taken to ensure data security. The general order is valid for a maximum of five years.

3. The public authority must publish the general order to be issued in advance. It shall consult with individuals by granting them an appropriate time period to comment.

4. Prior legal protection shall not be granted for occasion-based surveillance with a duration of no more than three months and for surveillance of buildings serving public purposes, which are put into operation based on incidents and do not record personal data.

1. The public authority offers personal data that it no longer needs to the competent archive in accordance with the applicable regulations.

2. It destroys the personal data deemed not worthy of archiving by the competent archive, unless

a) they are anonymized;

b) they must be retained for evidence or security purposes or to protect the legitimate interests of the person concerned.

**1. The responsible public body shall adequately inform the data subject about the collection of personal data; this obligation to inform also applies when the data is not collected from the data subject.**

**2. It shall provide the data subject, at the time of collection, with the information necessary for the exercise of their rights under this law and to ensure transparent data processing; it shall at least inform them of the following:**

a) the identity and contact details of the responsible public body;

b) the legal basis and purpose of processing;

c) the rights of the data subject;

d) if applicable, the recipients or categories of recipients to whom personal data may be disclosed;

e) the categories of processed personal data, provided the data is not collected from the data subject;

f) if the data is disclosed abroad, also the state or international organization and, if applicable, the guarantees or application of an exception according to Article 12, paragraph 2.

**3. If the data is not collected from the data subject, the responsible public body shall provide the data subject with the information in paragraph 2 no later than one month after obtaining the data. If it discloses the personal data before this period has expired, it shall inform the data subject no later than at the time of disclosure.**

1. The obligation to provide information when collecting personal data does not apply if one of the following conditions is met

a) the data subject already possesses the relevant information;

b) the processing is legally mandated;

c) the personal data is not collected from the data subject, and providing the information is not possible or requires disproportionate effort.

2. The responsible public authority may limit, postpone, or waive the provision of information under the same conditions as it may limit, postpone, or waive the right of access under Article 25.

1. The responsible public authority shall conduct a data protection impact assessment in advance if processing may pose a high risk to the fundamental rights of the data subject. If multiple similar processing activities are planned, a joint assessment may be conducted.

2. The high risk arises, particularly with the use of new technologies, from the nature, scope, circumstances, and purpose of the processing. It specifically occurs

a) in the extensive processing of particularly sensitive personal data;

b) when large public areas are systematically monitored.

3. The data protection impact assessment includes a description of the planned processing, an evaluation of the risks to the fundamental rights of the data subject, as well as measures for the protection of fundamental rights.

1. If a data protection impact assessment reveals that the planned processing still poses a high risk to the fundamental rights of the data subject despite the measures proposed by the responsible public authority, it shall seek the prior opinion of the supervisory authority.

2. The supervisory authority shall inform the responsible public authority of its objections to the planned processing within a reasonable period and suggest appropriate measures.

1. The responsible public authority shall report a data security breach to the supervisory body as soon as possible if it is likely to result in a high risk to the fundamental rights of the affected person.

2. In the report, it shall at least specify the nature of the data security breach, its consequences, and the measures taken or planned.

3. The processor shall report a data security breach to the responsible public authority as soon as possible.

4. The responsible public authority shall inform the affected person when it is necessary for their protection or upon the request of the supervisory body.

5. It may limit, postpone, or waive informing the affected person if

a) it is necessary due to overriding interests of third parties;

b) it is necessary due to overriding public interests, particularly to preserve internal or external security;

c) communicating the information may jeopardize an investigation, inquiry, or administrative or judicial process;

d) a statutory duty of confidentiality prohibits it;

e) the information is impossible to provide or would require a disproportionate effort;

f) informing the affected person is ensured through a public announcement in a comparable manner.

1. The public authorities designated by the government and the criminal courts shall maintain a record of their processing activities to demonstrate compliance with data protection regulations.

2. The record shall contain at least the following

a) the identity and contact details of the responsible public authority;

b) the legal basis and purpose of processing;

c) a description of the categories of data subjects and the categories of personal data processed;

d) where applicable, the recipients or categories of recipients to whom personal data are disclosed;

e) the retention period of the personal data or the criteria used to determine this period;

f) a general description of the measures taken to ensure data security;

g) an indication of whether the data is disclosed abroad, and, where applicable, the guarantees or application of an exception according to Article 12, paragraph 2.

3. The responsible public authority shall report its records to the supervisory authority and may publish them.

1. Public bodies designated by the government and criminal courts shall appoint a person responsible for data protection consultation. This person shall have the following tasks in particular

a) they advise and support employees in the processing of personal data concerning compliance with data protection regulations;

b) they ensure the execution of data protection impact assessments;

c) they serve as the contact person for the supervisory authority and collaborate with it.

**1. Right to Information**

1. Any affected person may request information from the responsible public body about whether personal data concerning them is being processed.

2. The affected person shall receive the information necessary to exercise their rights under this law and to ensure transparent data processing. In any case, the following information shall be communicated to them

a) the details specified in Article 17, paragraph 2;

b) the retention period of the personal data or the criteria used to determine this period;

c) the available information regarding the origin of the personal data, insofar as it was not obtained from the affected person.

3. Personal data concerning health may be communicated to the affected person by a health professional designated by them, with their consent.

4. If the responsible public body has personal data processed by a data processor, it remains obligated to provide information.

5. No one may waive the right to information in advance.

6. Information is generally provided within 30 days.

1. The responsible public authority may refuse, restrict, or postpone the disclosure of information if

a) a specific statutory duty of confidentiality provides for this;

b) it is necessary due to overriding interests of third parties;

c) the measure is necessary due to overriding public interests, particularly concerning internal or external security; or

d) the disclosure of the information could jeopardize an investigation, an inquiry, or an administrative or judicial proceeding.

1. The affected person who credibly demonstrates a legitimate interest may object to the disclosure of certain personal data by the responsible public body.

2. The public body shall reject the request if one of the following conditions is met

a) there is a legal obligation to disclose;

b) the fulfillment of its tasks would otherwise be jeopardized.

3. Article 11 paragraph 1 remains reserved.

1. Any person with a legitimate interest may require the responsible public body to

a) refrain from the unlawful processing of the respective personal data;

b) eliminate the consequences of unlawful processing;

c) establish the unlawfulness of the processing.

2. The applicant may particularly request that the responsible public body

a) correct, delete, or destroy the respective personal data;

b) communicate or publish its decision, notably concerning the correction, deletion, or destruction, the objection to the disclosure, or the objection note to third parties.

3. If neither the accuracy nor the inaccuracy of the respective personal data can be established, the responsible public body shall attach an objection note to the data.

1. If a public authority does not comply with a request under this Act, it shall issue a reasoned decision.

2. The exercise of the right to information and the right to rectification of personal data, as well as the request to object to the disclosure of personal data, are generally free of charge.

3. A reasonable fee may be charged if

a) the exercise of the rights involves a disproportionate effort; or

b) the request is obviously unfounded, particularly if it pursues a purpose contrary to data protection, or is obviously vexatious.

4. If the public authority does not have its own regulations regarding the imposition of a fee, the Ordinance on Costs in Administrative Procedures applies mutatis mutandis.

5. Furthermore, the procedure is governed by the Law on Administrative Justice.

1. If a procedure concerning access to official documents containing personal data, within the meaning of the Public Access to Information Act, is pending, the affected person may assert in this procedure the rights to which they are entitled under Article 27 in relation to those documents that are the subject of the access procedure.

1. The Data Protection Supervisory Authority oversees the application of data protection regulations.

2. Not subject to the supervision of the Supervisory Authority are

a) Data processing in pending civil and criminal judicial proceedings;

b) Data processing in pending constitutional and administrative court proceedings;

c) the Grand Council and its council bodies.

1. The supervisory authority consists at a minimum of the Data Protection Officer and a deputy.

2. The supervisory authority performs its tasks professionally independent and autonomous. It is free from directives in fulfilling its duties.

3. Administratively, it is subordinated to the State Chancellery.

4. The government exercises supervision over the supervisory authority.

5. The employment relations and occupational pension provision of all employees of the supervisory authority are governed by the cantonal personnel and pension fund law, unless this law provides otherwise.

6. The government classifies the positions of the Data Protection Officer and the deputy into the functional classes according to cantonal personnel law.

1. The government appoints an expert in data protection as the Data Protection Officer and a deputy for a term of four years. Reappointment is permissible.

2. The government may remove the Data Protection Officer and the deputy from office before the end of the term if they

a) have intentionally or with gross negligence severely violated official duties; or

b) have permanently lost the ability to exercise the office.

1. The Data Protection Officer and their deputy must not hold any other public office, perform a leading function in a political party, or engage in any other gainful activity. The government may grant exceptions if the performance of the function, independence, and reputation are not impaired.

2. If the Data Protection Officer and their deputy perform their duties on a part-time basis, any other gainful activity must be approved by the government. Approval may only be refused if such gainful activity impairs the performance of the function, independence, and reputation.

1. The Data Protection Officer prepares their own budget.

2. In the budget message, the government announces whether the proposal has been adopted unchanged. Deviations must be justified.

3. Within the framework of the budget, the Data Protection Officer is responsible for the hiring, termination, and restructuring of employment relationships of the employees.

1. The Supervisory Authority

a) monitors the application of data protection regulations;

b) advises the affected individuals regarding their rights;

c) mediates between the affected individuals and public authorities;

d) advises public authorities on matters of data protection and supervises data security;

e) provides opinions on decrees and IT projects, insofar as they are significant for data protection;

f) processes reports from affected individuals concerning the violation of provisions of this law and informs them of the results or status of clarifications within a maximum of three months;

g) raises awareness among public authorities about their data protection obligations and sensitizes the public to data protection issues;

h) follows developments significant for the protection of personal data;

i) collaborates with the bodies of other cantons, the federal government, and foreign entities that fulfill the same tasks to carry out its duties.

1. The supervisory authority acts ex officio or upon notification by the affected parties. The responsible public body must be informed of a notification and given the opportunity to comment.

2. The supervisory authority may, notwithstanding any confidentiality provisions, obtain all information necessary for the fulfillment of its monitoring duties concerning data processing, inspect all documents, conduct inspections, and have data processing demonstrated to it.

3. The supervisory authority may issue recommendations for the processing of personal data. The public body to which the recommendation is directed must declare to the supervisory authority whether it intends to follow the recommendation.

4. Public bodies and the commissioned processor are obligated to support the supervisory authority in fulfilling its tasks. They shall particularly assist in establishing the facts of the case.

1. If a public authority declares its intention not to follow the recommendation of the supervisory body, or in fact does not follow the recommendation, the supervisory body may issue the recommendation or parts of it as a decision.

2. The supervisory body may issue a decision directly if it is foreseeable that the public authority will reject a recommendation or not comply with it.

3. The affected public authority may appeal decisions pursuant to Article 37, paragraph 1, and paragraph 2 to the Superior Court. The law on administrative justice applies.

4. The Superior Court may appeal decisions concerning the Superior Court to the Judicial Court.

1. The supervisory authority shall annually report to the government on the scope and focus of its activities, as well as on important findings and assessments.

2. The supervisory authority shall provide the public body affected by recommendations and decisions the opportunity to submit a written statement. The statements shall be attached to the report.

3. The report shall be published.

1. The supervisory authority is bound to the same confidentiality regarding personal data as the public authority that processes the data. The duty of confidentiality extends beyond the termination of its function.

2. The supervisory authority may, subject to special confidentiality provisions, only disclose information acquired in the course of its duties to the extent necessary for the fulfillment of its responsibilities.

**1.** Any individual acting as a processor who, without explicit authorization from the commissioning public authority, intentionally or negligently uses personal data for themselves or others, or discloses it to others, shall be subject to a fine.

**2.** Any individual who intentionally or negligently processes or transfers personal data, which they have received from a public authority for processing for non-personal purposes, contrary to the obligation prescribed in Article 13 for other purposes, shall be subject to a fine.

1. Data processing operations that are based on sufficient legal grounds according to previous law may continue for two years based on the existing legal foundations.

2. Proof of compliance with the data protection regulations must be able to be provided no later than two years after the entry into force of this Act.

3. Article 19 and Article 20 do not apply to data processing operations that began before the entry into force of this Act, provided that no significant changes are made to the purpose of processing or to the processing activity.