Information Technology Act - Purpose

1. This law establishes the organization of information technology and regulates the use of information technology resources, including data protection.

1. The law applies to the cantonal administration (including hospitals and cantonal schools) and to the courts. Excluded are the Lucerne Compensation Office, the Lucerne Disability Insurance Office, the Unemployment Insurance Fund, the Building Insurance, the Lucerne Pension Fund, the universities and universities of applied sciences administered within the framework of a concordat, the University of Lucerne, and the Lucerne University of Teacher Education.

2. For the offices exempted in paragraph 1 and for other offices designated by the government council through regulation, Parts 1, 2, and 6 apply. Part 5 is applicable to them insofar as they use IT resources of the Canton of Lucerne.

3. For the municipalities, Parts 1, 2, and 6 apply.

4. The government council can exempt certain facilities from the scope of this law.

1. The terms "personal data," "sensitive personal data," "data subject," "processing of personal data," "profiling," "responsible body," and "body" are defined according to the Cantonal Law on Data Protection (Cantonal Data Protection Act) of July 2, 1990. In this law, they generally also include information about specific or identifiable legal entities or partnerships under commercial law.

2. The term "information technology" encompasses the management, planning, and introduction as well as the operation and maintenance of processes and techniques that serve the automated or machine-assisted processing of all types of information.

3. Information technology resources include devices, facilities, and services, particularly computer systems, computer programs, and communication services, that serve the electronic capture, processing, storage, transmission, evaluation, archiving, or destruction of information.

4. Central databases are composed of merged data sets from various bodies. They can be located in any place. Data warehouses and data hubs are central databases.

5. Data warehouses are used for the permanent storage of data.

6. In data hubs, data is temporarily available for data exchange.

7. Retrieval procedures are automated processes that enable third parties to process personal data without the intervention of the disclosing body.

8. Outsourcing refers to a body utilizing third-party information technology resources to fulfill its tasks. Bodies within a community are not considered third parties.

1. Information technology supports the efficiency and effectiveness of business and learning processes.

2. The use of information technology must be economical, serve the fulfillment of public tasks, and meet the needs of users.

3. Techniques that are capable of generating sensitive personal data from data or personal data or conducting profiling may only be used if the conditions pursuant to § 5 paragraph 2 of the Cantonal Data Protection Act are fulfilled.

1. The establishment and operation of central databases are permissible provided that the data protection regulations and the provisions of this Act are complied with.

2. The establishment and operation of central databases require a performance agreement concluded between the connected bodies and the operator, which has been approved by the competent authorities. This agreement must regulate at least the following points

a. Structure of the central database,

b. Content of the database, particularly with regard to personal data,

c. Techniques used, including development and maintenance,

d. Access management,

e. Security and data deletion concept,

f. Location of the hardware,

g. Control rights and obligations,

h. Responsibilities,

i. Publication in accordance with § 10.

3. The Government Council may, after obtaining the opinion of the Data Protection Commissioner, approve a central database containing particularly sensitive personal data or profiling results for a one-time limited period not exceeding five years before the enactment of a formal law, if

a. the tasks necessitating this processing are regulated in a formal law,

b. sufficient measures are taken to prevent violations of personal rights,

c. the practical implementation of data processing necessarily requires a test phase before the enactment of a formal law, and

d. the approval of the Cantonal Court is obtained, in the event that only bodies of the cantonal justice system are involved in the central database.

4. If a central database is operated based on an approval according to paragraph 3, the bodies connected to the central database shall inform the Government Council annually about the status of the project work and the necessity of continuing the operation.

1. The operator of a central database is responsible and accountable for the technical operation and technical security.

2. The operator may be an entity involved in the central database, an IT entity pursuant to § 17 Paragraph 2, or, subject to the provisions regarding outsourcing, a third party.

3. The operator is entitled to the access and processing rights necessary for fulfilling their duties with respect to the stored personal data. System administration and access management shall not be assigned to the same individual.

4. The operator and any person entrusted by them with operational tasks are obligated to maintain confidentiality regarding the personal data they handle.

5. § 6 Paragraph 3 of the Cantonal Data Protection Act is not applicable to central databases.

1. The extent of access and processing rights of bodies to personal data in a central database is determined in accordance with the Cantonal Data Protection Act and must be ensured in a suitable technical and organizational manner. Section 6, paragraph 3 remains reserved.

2. If the personal data stored in a data warehouse are no longer required by any involved body, they are to be offered to the responsible archive for acquisition. If deemed not worthy of archiving by the archive, they must be promptly deleted or destroyed.

1. Personal data intended to be stored in a data warehouse may be collected jointly for multiple entities.

2. If personal data intended to be stored in a data warehouse are collected jointly for multiple entities, the affected person must be informed, at the time of collection, about the storage of their personal data in the data warehouse and the entities involved in this process.

1. In the procurement of IT resources for central databases, the privacy-friendliness of the technologies must be adequately considered.

2. Before IT resources for central databases are procured, the relevant data protection supervisory authorities must be consulted. They may provide a statement within a reasonable period of time.

1. The establishment of data warehouses must be published by the operator in the Cantonal Gazette prior to commencement of operations. The publication must list, for each data warehouse, the participating bodies and the corresponding data inventory, as well as the operator. Furthermore, the publication must provide information for each dataset about the legal basis, the purpose, the means and procedures of processing, the type and origin of personal data, and their regular recipients, as well as the existence and storage location of copies.

2. The publication must also indicate the control rights of each person and the competent supervisory authorities for data protection according to this law and the Cantonal Data Protection Act.

3. The details according to paragraph 1 must be included in the record of data processing activities.

1. Every person may request information from the competent data protection supervisory authority

a. * regarding the contents of the directory of data processing activities,

b. whether personal data about them is stored in a data warehouse; they must prove their identity in this regard.

2. The competent data protection supervisory authority and the responsible IT officer jointly examine whether personal data about the affected person is stored in the data warehouse and which authorities have access or processing rights to it. The competent data protection supervisory authority and the IT officer have the necessary access rights to the premises and facilities of the operator as well as the necessary access and processing rights to personal data stored in the data warehouse. The operator is required to provide all necessary support for the examination.

3. The competent data protection supervisory authority provides the affected person with information about which authorities involved in the data warehouse are authorized to access or process their personal data. The competent data protection supervisory authority may restrict, impose conditions on, or refuse this information due to overriding public interests or overriding private interests of third parties or the affected person.

4. The procedure regarding information about the personal data available on an affected person as well as regarding access, correction, and other claims is governed by the Cantonal Data Protection Act. Upon request of the affected person, the competent data protection supervisory authority initiates the procedure with the authorities entitled to access or process their personal data.

5. The data protection supervisory authorities and IT officers are obliged to maintain confidentiality regarding the personal data they handle.

1. Part 2 of this Act applies mutatis mutandis to the establishment and operation of retrieval procedures. Provisions concerning publication and register are reserved.

1. The outsourcing of information technology services is permissible, provided that the data protection regulations and the provisions of this law are complied with. The financial legal regulations remain reserved.

2. Outsourcing requires a written agreement that regulates at least the following points

a. Content of the service,

b. Preservation of official secrets as well as special confidentiality obligations,

c. Responsibilities,

d. Techniques used, including development and maintenance,

e. Access and entry rights,

f. Security and data deletion concept,

g. Locations of the hardware and data processing,

h. Control rights,

i. Involvement of third parties,

j. Archiving,

k. Repatriation and deletion of data in the event of contract termination.

3. The outsourcing body ensures, through organizational or technical measures and contractually, that the fulfillment of the state task is ensured without significant impairment, even if the contractor does not adhere to agreements or ceases business operations.

1. The outsourcing of IT services of overriding or strategic interest requires the approval of the government council.

2. Other outsourcing projects must be reported in advance to the competent authority.

1. The contractor, including its employees and auxiliaries, must assume the official, professional, and special confidentiality obligations as well as comply with the data protection and information security provisions to which the outsourcing entity is bound.

2. The contractor must grant the outsourcing entity, the competent data protection supervisory authority, and the financial control access to the premises and facilities as well as the necessary access rights to the relevant data and provide them with appropriate support.

1. The entity responsible for the data collection shall be deemed the data's custodian.

2. If the contractor's rights of control are asserted in accordance with data protection law, the contractor must refer the individual concerned to the outsourcing entity and refrain from processing the requests substantively.

1. The information technology organization of the Canton of Lucerne consists of corporate IT and departmental IT.

2. The Executive Council designates the IT bodies and determines their fundamental tasks, functions, and responsibilities.

3. The departmental IT, taking into consideration the strategic directives of corporate IT, is the responsibility of the departments, the State Chancellery, and the Cantonal Court.

1. Information technology resources must be secured against loss and unauthorized access by the responsible body or the operator of a central database. Personal data must be protected from unauthorized access and unauthorized processing.

2. The information technology bodies support the responsible bodies and the operators of central databases in the determination and implementation of security measures.

1. The offices and courts, as well as the other entities subject to the scope of application pursuant to § 2 paragraph 2, classify the data and IT resources, and based on this, establish the protection objectives. They prepare an action plan to achieve the protection objectives.

2. Protection objectives and the action plan must be reviewed periodically.

3. The government council regulates the details.

1. All users are personally responsible for the use of IT resources in accordance with the applicable legal framework and this law. IT resources must not be used in an abusive manner.

2. The Executive Council regulates the use of IT resources in the workplace and specifies cases of misuse.

3. The following principles apply to monitoring and oversight measures

a. Monitoring and oversight measures primarily serve to verify and ensure the technical security, functionality, and availability of IT resources.

b. All internet accesses and email communications of users are logged. The content of emails may not be read without the consent of the affected users. This principle may only be deviated from if it is essential for fulfilling governmental tasks.

c. Log data must be evaluated in an anonymized form.

d. Personal evaluations are exceptionally permissible if the technical security, functionality, or availability of IT resources is seriously threatened and it is indispensable for troubleshooting. These evaluations must not relate to the content of emails and internet accesses.

e. In the case of a justified suspicion of misuse of IT resources, personal evaluations are possible following written announcement, which may also concern the content of emails and internet accesses.

f. Technical monitoring and control instruments as well as filter barriers are permissible, with the exception of so-called spyware programs.

4. The Executive Council shall regulate further details, particularly the monitoring procedure. It may specifically provide for anonymized plausibility checks to be conducted for a limited duration of use.

1. The Government Council shall designate the competent authority in accordance with § 5 paragraph 2 and § 14 paragraph 2.

2. In the municipalities, the Municipal Council shall designate the competent authority.

1. The following enactments are amended in accordance with Annex [4]

a. Law on the Protection of Personal Data (Data Protection Law) of July 2, 1990 [5],

b. Law on the Cantonal Police of January 27, 1998 [6].

1. Anyone who violates the provisions of §§ 4 paragraph 3, 6 paragraph 4, 10 paragraph 1, and 15 paragraph 1 shall be fined up to 5000 Swiss Francs.

2. The government council may, by regulation, provide for fines of up to 3000 Swiss Francs for breaches of the provisions of § 20 or for breaches of regulatory provisions issued based on this section.

3. Instead of a penalty, a measure may be imposed, provided the offender agrees. This consists of data protection education at the expense of the offender.

4. The Data Protection Officer organizes the data protection education. This education may be conducted by third parties.

5. The provisions of the Swiss Penal Code remain reserved.

1. The law shall enter into force on July 1, 2005. It is subject to an optional referendum.