Act on Data Protection (Cantonal Data Protection Act, kDSG) - Purpose (LPCD)

1. This law aims to protect the personality and fundamental rights of individuals whose data is processed.

1. This law applies to the processing of data of natural and legal persons by cantonal and municipal authorities.

2. It is not applicable to

1. the non-sovereign actions of authorities participating in economic competition;

2. transactions decided upon by the electorate or the Cantonal Council;

3. pending civil proceedings, criminal procedures, as well as state and administrative legal proceedings, except for first-instance administrative procedures;

4. public registers in the context of private law transactions;

5. internal administrative documents such as notebooks and agendas used as personal working tools.

3. For private individuals and federal authorities, the provisions of the DSG (Data Protection Act) apply.

1. The following terms mean

1. Personal data (Data): all information relating to an identified or identifiable person;

2. Data subjects: natural or legal persons whose data is processed;

3. Particularly sensitive data: data concerning

a) religious, ideological, political, or trade union views or activities;

b) health, intimate sphere, or racial origin;

c) social welfare measures;

d) administrative or criminal prosecutions and sanctions;

4. Personality profile: a compilation of data that allows for the assessment of essential aspects of the personality of a natural person;

5. Processing: any handling of data, irrespective of the means and procedures used, including in particular obtaining, storing, using, modifying, disclosing, archiving, or destroying data;

6. Disclosure: making data accessible, such as by granting access, transmitting, or publishing;

7. Data collection: any set of data that is structured in such a way that data can be accessed according to data subjects;

8. Agencies

a) authorities or administrative bodies of the canton, municipalities, and municipal associations, as well as cantonal and communal independent public bodies and institutions;

b) persons, insofar as they are entrusted with public tasks by authorities or administrative bodies within the meaning of lit. a;

9. Holder of the data collection: agencies that decide on the purpose and content of the data collection;

10. Law in the formal sense

a) enactments and decisions within the meaning of Art. 3 lit. j DSG;

b) cantonal laws, municipal regulations, as well as all other cantonal and municipal enactments subject to a referendum.

1. Data may only be processed lawfully.

2. Processing shall be carried out in good faith and must be proportionate.

3. Data may only be processed for purposes that

1. were specified upon collection;

2. are evident from the circumstances; or

3. are provided for by law.

4. The collection of data, and particularly the purpose of its processing, must be apparent to the affected individual.

5. If the consent of the affected individual is required for data processing, such consent is only valid if it is given voluntarily after being adequately informed. In the processing of particularly sensitive data or personality profiles, consent must also be expressly given.

1. Anyone who processes data must ensure its accuracy.

2. Any affected person may request that incorrect data be corrected.

**1. Data may not be disclosed abroad if doing so would severely endanger the personality of the persons concerned, particularly because of the absence of legislation that ensures adequate protection.**

**2. In the absence of legislation that ensures adequate protection, data may only be disclosed abroad if:**

1. sufficient guarantees, particularly through a contract, ensure adequate protection abroad;

2. the person concerned has consented in the specific case;

3. the disclosure in the specific case is either essential for safeguarding an overriding public interest or for the establishment, exercise, or enforcement of legal claims in court;

4. the disclosure in the specific case is necessary to protect the life or physical integrity of the person concerned;

5. the person concerned has made the data generally accessible and has not expressly prohibited processing.

**3. The supervisory authority must be informed about the guarantees according to paragraph 2, item 1.**

1. Data must be protected against unauthorized processing through appropriate technical and organizational measures.

2. The executive council shall issue regulations concerning the minimum requirements for data security.

1. The holder of a data collection is obliged to inform the affected person about the acquisition of particularly sensitive data or personality profiles. This obligation to provide information also applies when the data is obtained from third parties.

2. The affected person must be informed, at a minimum, of

1. the holder of the data collection;

2. the purpose of data processing;

3. the categories of data recipients, if data disclosure is planned.

3. If data is not collected from the affected person, their information must occur at the latest at the start of data storage or, if storage is omitted, with the first disclosure to third parties.

4. The obligation of the holder of the data collection to provide information ceases if the affected person has already been informed or, in cases pursuant to paragraph 3, if

1. the storage or disclosure of the data is expressly provided for by a law in the formal sense;

2. the information is impossible or only possible with disproportionate effort.

1. Data processing may be transferred to third parties by agreement or by law, provided that

1. the data are processed only in a manner that the mandator themselves would be permitted to do;

2. no statutory or contractual confidentiality obligations prohibit it.

2. The mandator must specifically ensure that the third party guarantees data security.

1. The body responsible for data protection is the one that processes or has the data processed in fulfillment of its legal duties.

2. If multiple bodies process data from a shared data collection, the primary responsibility lies with the owner of the data collection; each body remains responsible for its own scope.

3. The owner of the data collection must be permitted to conduct checks on compliance with data protection regulations by the other bodies.

1. Authorities may process data if there is a statutory basis for doing so.

2. They may process particularly sensitive data and personality profiles only if a statute formally allows it, or, exceptionally

1. it is indispensable for a task clearly defined in a statute;

2. the executive council grants permission in individual cases because the rights of the affected person are not endangered;

3. the affected person has consented in an individual case or has made their data generally accessible and has not expressly prohibited processing.

1. In systematic surveys, particularly those involving questionnaires, the authorities disclose the purpose and legal basis of the processing, the categories of participants in the data collection, as well as the recipients of the data.

1. Organs may disclose data if there are legal bases within the meaning of Art. 11 or if

1. the data is indispensable for the recipient in an individual case to fulfill their legal task;

2. the affected person has consented in an individual case;

3. the affected person has made their data generally accessible and has not expressly prohibited the disclosure; or

4. the recipient credibly demonstrates that the affected person refuses consent or blocks disclosure to prevent the enforcement of legal claims or the exercise of other protectworthy interests; the affected person should be given the opportunity to comment in advance, if possible.

2. If there is a legal authorization or obligation for this, or if the data-receiving organ demonstrates that it is entitled to process the requested data subject to confidentiality provisions, data may also be made accessible to public organs through a retrieval procedure. Particularly sensitive data and personality profiles may only be made accessible through a retrieval procedure if a law in the formal sense explicitly provides for it.

3. Organs shall deny disclosure, restrict it, or attach conditions if required by

1. essential public interests or obviously protectworthy interests of the affected person; or

2. statutory confidentiality obligations or special data protection provisions.

1. The resident registration office may disclose to third parties upon request

1. Individual information about name, first name, gender, and current address (including date and place of departure in case of relocation) without any prerequisites; requests and disclosures can be made in writing or orally;

2. Individual information about date of birth, marital status, place of origin, nationality, and place of arrival, provided a legitimate interest is credibly demonstrated; requests and disclosures are made in writing;

3. Group information about name, first name, gender, date of birth, current address, and persons who moved in within a certain period, provided that

a) an interest is credibly demonstrated;

b) the data is used for an ideal purpose;

c) the requesting natural or legal person has a residence or headquarters in the canton.

2. The group information may be disclosed sorted according to one or more of the aforementioned criteria. Requests and disclosures are made in writing. The applicants must commit in writing to use the data solely for the specified purpose and not to disseminate it further.

3. ...

1. An affected person who credibly demonstrates a legitimate interest may request the data controller to block the disclosure of certain data.

2. The authority shall refuse to block or lift the block if

1. there is a legal obligation to disclose;

2. the fulfillment of its duties would otherwise be jeopardized.

**1. Organs may process data for non-personal purposes, in particular for research, planning, and statistics, when:**

1. the data is anonymized as soon as the purpose of processing allows;

2. the recipient discloses the data only with the consent of the organ;

3. the results are published in such a way that the individuals concerned cannot be identified.

**2. The requirements of the following provisions do not need to be fulfilled:**

1. Article 4 paragraph 3 regarding the purpose of processing;

2. Article 11 paragraph 2 regarding the legal basis for processing particularly sensitive data and personality profiles;

3. Article 13 paragraph 1 regarding the disclosure of data.

1. Publicly accessible places may be monitored with technical devices, such as in particular image recording devices, for the protection of persons and property, if

1. the monitoring is made recognizable in an appropriate manner;

2. the stored data is deleted after no more than 30 days or handed over to the police within this period with a criminal complaint or report;

3. the supervisory authority has been informed in advance about the introduction of the monitoring.

2. The deployment of technical devices can be ordered by the authority that holds the right of use or sovereignty over the location to be monitored.

1. If data are no longer needed for the fulfillment of statutory tasks or for evidence or security purposes, they must be destroyed, unless they are to be archived in accordance with the provisions of archival legislation.

1. The canton, the municipalities, the municipal associations, as well as the cantonal and communal autonomous public law corporations and institutions shall each maintain a public register of the data collections of their agencies.

2. The supervisory authority shall maintain

1. the register of the canton;

2. a central register of the other registered data collections.

3. It may issue directives to other entities responsible for maintaining registers. Changes to the register must be reported to the supervisory authority.

1. The Register contains information for each data collection regarding

1. the holder of the data collection;

2. the legal basis;

3. the purpose, means, and procedure of data processing;

4. the type and origin of the data;

5. the regular recipients of the data;

6. other bodies involved in the data collection;

7. the location of copies.

2. Data collections that are not to be included in the Register are those that

1. are only maintained temporarily;

2. are lawfully published;

3. constitute auxiliary data collections.

1. Any person may inspect the registers.

1. Every person has the right to request information from the owner of a data collection regarding whether data about them exists or is being processed.

2. The owner of the data collection must inform the affected person of

1. all available data concerning them in the data collection, including available information about the origin of the data;

2. the purpose and, if applicable, the legal basis for the processing as well as the categories of processed data, the parties involved in the collection, and the data recipients.

3. Data concerning health can be communicated to the affected person by the owner of the data collection through a doctor designated by them.

4. If the owner of the data collection has data processed by a third party, they remain obliged to provide information. The third party is obligated to provide information if they do not disclose the owner or if the owner does not have a residence in the canton.

5. The information should generally be provided in writing, in the form of a printout or a photocopy.

6. No one can waive their right to information in advance.

1. The holder of the data collection may refuse, restrict, or defer the information according to Art. 8 or the disclosure according to Art. 22, insofar as

1. a formal law provides for it;

2. it is necessary due to overriding public or private interests;

3. the information or the disclosure questions the purpose of a criminal investigation or another investigative procedure.

**1.** Anyone who has a legitimate interest may request from the holder of the data collection that they

**1.** cease the unlawful data processing;

**2.** eliminate the consequences of unlawful processing;

**3.** establish the unlawfulness of the processing.

**2.** If neither the accuracy nor the inaccuracy of the data can be proven, the authority shall make a corresponding note.

**3.** The affected person may, in particular, request that the authority

**1.** correct, destroy, or block the disclosure of data to third parties;

**2.** communicate its decision, namely the correction, destruction, blocking, or the note regarding the dispute, to third parties.

1. If a request for information or fulfillment of a claim in the sense of Art. 24 is not fully granted and the concerned person demands it, the authority shall issue a contestable decision.

2. This decision must also be communicated to the supervisory authority.

1. The government council appoints a commissioner for data protection as a supervisory authority for the constitutional term of office.

2. The supervisory authority performs its tasks independently and is administratively assigned to the state chancellery.

3. The government council may delegate the tasks of the supervisory authority to an office of another canton or establish a joint supervisory authority with other cantons.

1. The Supervisory Body is the oversight authority within the meaning of Art. 37 Para. 2 DSG and

1. monitors compliance with data protection regulations by the organs, by conducting inspections ex officio or upon notification;

2. advises the organs on issues of data protection;

3. provides affected individuals with information about their rights;

4. mediates between the organs and affected individuals in all matters concerning data protection;

5. takes early positions on enactments and projects that may affect aspects of data protection, particularly in terms of a preliminary check concerning intended data processing with specific risks to the rights and freedoms of individuals;

6. informs the organs about significant data protection concerns;

7. publishes opinions;

8. collaborates with oversight bodies of other cantons, the federal government, and foreign countries;

9. submits an annual report to the government council, which is made publicly accessible.

1. The supervisory authority may, notwithstanding any confidentiality provisions, obtain information from the bodies regarding data processing, inspect data collections, documents, and records, and request demonstrations of data processing. It may engage external experts for specific tasks.

2. It is subject to the same confidentiality provisions as the body processing the data, even after the termination of professional activity.

3. The bodies are obligated to support the supervisory authority in the fulfillment of its duties.

1. If the investigations of the supervisory authority reveal that data protection regulations have been violated, it recommends to the holder of the data collection that the processing be changed or discontinued.

2. It informs about its recommendations

1. in the case of authorities or administrative bodies

a) for the canton, the competent directorate or the state chancellery;

b) for municipalities, the administrative council;

c) for municipal associations, the board;

d) for independent public-law corporations and institutions at the cantonal and municipal level, the executive management;

2. for individuals, insofar as they are entrusted with public tasks, the instance to be informed according to item 1.

1. If a recommendation is not followed or is rejected, the supervisory authority may submit the matter to the designated authority for a decision.

2. The decision is communicated to the affected person and the supervisory authority in the form of an order.

1. Orders based on Art. 25 and Art. 30 in conjunction with Art. 29 para. 2 no. 1 letters a-c can be appealed to the Government Council within 20 days after delivery.

2. The remaining orders as well as the appeal decisions of the Government Council can be appealed to the Administrative Court within 20 days after delivery.

1. The supervisory authority may exercise the legal remedies available under cantonal law.

1. The authorities and supervisory office do not charge fees for requests from individuals exercising their rights of control as granted by this law.

2. A fee of up to CHF 1,000 may be charged to applicants in the case of

1. Requests that require significant effort;

2. Repeated or abusively filed requests.

3. The obligation to pay fees according to the fee legislation for the disclosure of data to third parties is reserved, provided it does not serve exclusively non-material purposes.

1. A fine of up to CHF 100,000 shall be imposed on

1. anyone who does not use collective information as defined in Art. 14 para. 1 no. 3 for non-profit purposes or who discloses it to third parties;

2. anyone who misuses data provided for non-personal purposes according to Art. 16 or who discloses it to third parties.

1. Registers of data collections must be established within one year after the entry into force of this Act.

2. The data collections must be adapted to the new law within two years after the entry into force of this Act. The government council may extend this period for individual data collections for important reasons.

1. The Law of April 27, 1980, on the Establishment of Swiss Nationals is amended as follows: ...

1. The Law of June 3, 1998, on Public Employment Relationships (Personnel Law) is amended as follows: ...

1. The Regulation of June 12, 1975, on the State Archives is amended as follows: ...

1. The Law of 26 April 1987 on Police Matters (Police Law) is amended as follows: ...

1. The Government Council shall enact the provisions necessary for the implementation of this law.

1. This law is subject to the optional referendum.

2. The government council shall determine the date of commencement.