Data Protection Act (DSG) - Definitions (DSG)

1. In this decree, the following terms mean

a) Personal data: Information that relates to an identified or identifiable natural person;

b) Particularly sensitive personal data: Information about

1. Religious, ideological, and political views and activities, excluding information on membership in a religious community, organization, or political party if the individual concerned has made this known themselves or is running for public office;

2. Health, intimate sphere, and ethnic origin;

2bis. Genetic data;

2ter. Biometric data that uniquely identify a natural person;

3. Benefits and measures of social assistance;

4. Criminal and disciplinary proceedings and sanctions;

c) Data subject: Natural person whose personal data is being processed;

d) Personality profile: Compilation of personal data that allows the assessment of an individual's personality;

dbis) Profiling: Any type of automated processing of personal data intended to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning the person's work performance, economic situation, health, personal preferences, interests, reliability, behavior, location, or movement;

e) Processing: Any handling of personal data, regardless of the means and procedures applied, especially the collection, storage, use, modification, disclosure, archiving, deletion, or destruction of personal data, as well as the execution of logical or computational operations with such data;

ebis) Breach of data security: Any security breach, regardless of intent or illegality, that leads to the loss, deletion, destruction, or alteration of personal data, or makes it disclosed or accessible to unauthorized persons;

f) Disclosure of personal data: Making personal data accessible, as well as granting access, sharing, and publishing;

g) Data collection: Set of personal data that is organized or can be organized by individuals;

h) Public body: Body, authority or agency of

1. Canton;

2. Autonomous public-law institution of the canton;

3. Municipality;

4. Autonomous public-law municipal enterprise;

5. Association of municipalities and association for specific purposes;

i) Recipient: Natural or legal person receiving personal data from the public body;

j) Data protection office: Authority appointed by the canton and municipality for supervision and advice on data protection;

k) Legal basis: Decree with generally binding provisions, particularly laws and ordinances. Enforcement provisions by municipalities exempted from the optional referendum are equivalent to ordinances;

l) Law: Decree that has been explicitly or tacitly accepted by the voters according to Article 67 of the Cantonal Constitution of June 10, 2001, as well as interstate agreements that, based on their content, have constitutional or legal status. The law includes the municipal order as well as the legislative regulation and the legislative agreement.

1. This decree regulates the processing of personal data by public bodies.

1bis. Private entities are equated with public bodies when they perform state tasks.

2. It does not apply

a) if the public body participates in economic competition and does not act in a sovereign capacity;

b) to personal data processed by a natural person who is in a service or contractual relationship with the public body for exclusively personal use, and which is neither handed over to nor accessible to other persons;

c)* ...

d) to personal data that the competent archive of the canton and municipality permanently preserves.

3. In pending civil, criminal, and judicial administrative proceedings, as well as in pending legal assistance proceedings, rights and claims are governed by the respective procedural laws.

1. The following are not applied in the context of cantonal statistics

a) Article 4, paragraph 1 of this decree, when using data for statistical purposes;

b) Article 4, paragraph 2 of this decree, regarding the indirect collection of statistical data according to the Statistics Act.

1. Whoever processes or has personal data processed is responsible for compliance with data protection.

2. If multiple public authorities process personal data within a data collection, they must designate the authority responsible for ensuring compliance with data protection. In the event of disagreement, the cantonal data protection authority makes the decision.

3. The public authority bears the burden of proof for compliance with data protection regulations.

1. The public authority processes personal data in accordance with the purpose specified in the legal basis, indicated at the time of collection, or evident from the circumstances.

2. It ensures that the collection of personal data and the purpose of their processing are recognizable to the affected person and that the personal data are accurate and, as required by their usage, complete.

3. It takes organizational and technical measures to safeguard the data against loss and theft, as well as unauthorized access and processing.

1. Processing of personal data is permissible if there is a legal basis or the processing is necessary to fulfill a legal obligation.

2. The processing of particularly sensitive personal data, personality profiles, and profiling is permissible if

a) the law provides for the processing, or

b) the processing is indispensable for fulfilling a legal obligation, or

c) the data subject

1. has given explicit consent in the individual case, with knowledge of the purpose and manner of the intended processing, or

2. has made their data generally accessible.

1. When a public authority systematically procures personal data through questionnaires or other forms of surveys from a large number of individuals, it must disclose

a) The purpose and legal basis for the processing;

b) The authority or department involved in the procurement;

c) The categories of recipients of the procured personal data.

1. The public authority shall anonymize personal data that it processes for a non-personal purpose, particularly for statistics, planning, and research, as soon as the purpose of processing allows for anonymization.

2. It shall ensure that the disclosure of the result precludes any conclusions being drawn about the individuals concerned.

3. It may transfer personal data to another public authority or third parties for processing for a non-personal purpose, provided that the recipient offers assurance and commits in writing to

a) fulfilling the obligations under paragraphs 1 and 2 of this provision;

b) not disclosing the personal data further.

1. The public authority shall conduct a data protection impact assessment in advance when processing may pose a high risk to the fundamental rights of the data subject. If multiple similar processing operations are planned, a joint assessment may be conducted.

2. The high risk arises, particularly when using new technologies, from the nature, scope, circumstances, and purpose of the processing. It is specifically present

a) in the extensive processing of particularly sensitive personal data or personality profiles;

b) in profiling.

3. The data protection impact assessment contains a description of the planned processing, an evaluation of the risks to the fundamental rights of the data subject, and the measures to protect those rights.

1. The public body submits to the Data Protection Office for prior consultation

a) Legislative projects that concern data protection;

b) Projects for the processing of personal data that lead to a high risk for the fundamental rights of the persons concerned.

2. The prior consultation generally occurs within two weeks of receiving the request, at the latest within six weeks.

3. The Data Protection Office specifies the essential processing activities that must be submitted to it.

1. The public authority may delegate the processing of personal data to third parties if such delegation is not prohibited by law or regulation and the third parties engaged provide assurances for the proper processing of the data in accordance with data protection laws.

2. It ensures compliance with data protection and specifically stipulates that personal data

a) are only processed in the manner that the public authority itself would be permitted to do;

b) are processed in accordance with the legal provisions applicable to the public authority;

c) are protected against loss, theft, unauthorized access, and unauthorized processing.

3. It conducts appropriate regular audits to verify compliance with data protection. If non-compliance with the obligations under paragraph 2 of this provision is discovered, or if there are breaches of other data protection regulations, it revokes the delegation.

4. The further delegation of data processing requires the prior written consent of the commissioning public authority.

1. The public authority reports a data security breach to the Data Protection Office as soon as possible if it is likely to result in a high risk to the fundamental rights of the affected person.

2. In the report, it specifies at least the nature of the data security breach, its consequences, and the measures taken or planned to rectify the breach.

3. A third party processing personal data on behalf of the public authority reports a data security breach to the public authority as soon as possible.

4. The public authority informs the affected person if it is necessary for their protection or if the Data Protection Office demands it.

5. It may restrict, delay, or refrain from providing information to the affected person if

a) it is required due to overriding interests of third parties;

b) it is required due to overriding public interests, particularly for the safeguarding of the internal or external security of Switzerland;

c) the communication of the information may endanger an investigation, an inquiry, or an official or judicial proceeding;

d) providing the information is impossible or requires disproportionate effort, or

e) the information to the affected person is ensured through a public announcement in a comparable manner.

1. The public authority offers the personal data it no longer needs to the competent archives of the canton or municipality within a reasonable period. Specific provisions regarding archiving remain reserved.

2. The public authority promptly destroys personal data deemed not worthy of archiving by the competent archives. Exempt are personal data whose destruction could violate the legitimate interests of the affected individuals.

3. Destruction may be waived if the personal data

a) are anonymized;

b) are anonymized by the public authority immediately after notification from the competent archives.

1. The judicial authorities and the police maintain a register of their processing activities.

2. The register contains at least

a) the identity of the public authority;

b) the purpose of processing;

c) a description of the categories of individuals concerned and the categories of processed personal data;

d) the categories of recipients;

e) the retention period of personal data or the criteria for determining this period;

f) a general description of the measures to ensure data security;

g) if the data is disclosed abroad, the identification of the state and the guarantees for the disclosure of personal data according to federal data protection legislation.

3. When processing personal data on behalf of another entity, the register includes

a) information on the identity of the third party and the commissioning public authority;

b) information on the categories of processing carried out on behalf of the public authority;

c) if possible, a general description of the measures to ensure data security;

d) if the data is disclosed abroad, the identification of the state and the guarantees for the disclosure of personal data according to federal data protection legislation.

4. The public authority reports the register to the Data Protection Office.

1. The disclosure of personal data is permissible if

a) there is a legal basis, or

b) the data subject has consented, or

c) the disclosure is in the interest of the data subject and their consent cannot be obtained, or

d) there is a substantial public interest that outweighs the data subject's legitimate interest in maintaining the confidentiality of the personal data, or

e) the recipient credibly demonstrates a legitimate interest that outweighs the data subject's legitimate interest in maintaining the confidentiality of the personal data.

2. The public authority shall disclose personal data to a federal authority, another canton, or another public authority if the recipient needs the personal data to fulfill a legal duty.

1. The public authority restricts the disclosure of personal data or associates it with conditions if

a) special provisions on data protection require it, or

b) public or legitimate private interests require it.

1. The disclosure of particularly sensitive personal data and personality profiles is permissible if

a) the law provides for the disclosure or

b) the concerned person has consented or

c) the disclosure is in the interest of the concerned person and it is not possible to obtain their consent.

2. The public authority discloses particularly sensitive personal data and personality profiles to a federal authority, another canton, or another public authority if the personal data is indispensable for the recipient to fulfill a legally assigned task.

1. The public authority may, upon request, disclose the name, first name, date of birth, address, as well as the arrival in or departure from the canton or municipality, provided that the recipient offers assurance and commits in writing to use the personal data exclusively for charitable or legally protected non-commercial purposes and not to disclose it further.

1. The disclosure of personal data by retrieval procedure is permissible if it is provided for in a legal basis.

2. The disclosure of particularly sensitive personal data by retrieval procedure is permissible if it is provided for in the law.

1. The disclosure of personal data abroad is conducted in accordance with the provisions of the federal legislation on data protection.

2. The public authority informs the competent data protection office of the guarantees required by federal legislation prior to the disclosure, if the state is not listed on the list of countries with adequate data protection legislation published by the Federal Data Protection and Information Commissioner.

3. The cantonal data protection office obtains information about foreign data protection from the Federal Data Protection and Information Commissioner. It provides the information to

a) the public authorities within its jurisdiction;

b) the municipal offices for forwarding to the public authorities within their jurisdiction.

1. The government can, after obtaining the opinion of the data protection authority, authorize the automated processing of sensitive personal data or personality profiles in a pilot trial prior to enacting a law, if

a) the tasks necessitating this processing are regulated by law;

b) sufficient measures are taken to prevent violations of personal integrity;

c) the practical implementation of data processing mandatorily requires a test phase before the enactment of the law.

2. The practical implementation of data processing may mandatorily require a test phase if

a) the fulfillment of a task requires technical innovations, the effects of which must first be evaluated, or

b) the fulfillment of a task demands significant organizational or technical measures, the effectiveness of which must first be tested, particularly in cooperation between public bodies, or

c) it requires the transmission of sensitive personal data or personality profiles in a retrieval process.

3. The government shall designate the public body responsible for conducting the pilot trial and regulate the modalities of automated data processing in an ordinance.

1. The competent public authority shall submit an evaluation report to the government no later than two years after the commencement of the pilot project.

2. It shall propose the continuation or termination of the pilot project.

3. The pilot project shall be terminated if no law containing the necessary legal basis has become legally valid within five years of its commencement.

1. The public authority shall, upon a fundamentally written request and upon proof of identity, provide the affected person with information about the personal data that is being processed about them. The information is generally provided in writing.

2. It grants access to the personal data at the request of the affected person.

1. The public authority rejects access to information and inspection, restricts them, or conditions them with requirements, insofar as overriding public or legitimate private interests of third parties prevail or if a formal law provides for this.

1. The processing of requests for information and access is generally free of charge.

1. The affected person is entitled to have the public authority correct inaccurate personal data free of charge. If neither the accuracy nor the inaccuracy can be proven, the public authority shall attach a corresponding note to the personal data and restrict its processing.

2. The affected person is entitled to have the public authority

a)* cease the unlawful processing of personal data, delete inaccurate data, and block its disclosure to third parties;

abis)* determine the unlawfulness of the processing;

ater)* eliminate the consequences of unlawful processing;

b) destroy unlawfully processed personal data.

3. The public authority shall inform recipients of inaccurate or unlawfully processed personal data about the measures taken. This information may be omitted if it is not possible or only possible with disproportionate effort.

1. The public authority informs the concerned individual about the collection of personal data from official agencies or third parties.

1. The Duty to Inform Is Waived When

a) the data subject already possesses the information according to Article 20a of this decree;

b) the processing of personal data is expressly provided for by law; or

c) providing the information is impossible or only possible with disproportionate effort.

2. The transmission of information can be restricted under the same conditions as the right to information according to Article 18 of this decree.

1. The public authority restricts the disclosure of personal data upon request if the individual concerned has a legitimate interest worthy of protection.

1. The public authority discloses personal data despite a restriction if

a) there is a legal obligation to disclose, or

b) the fulfillment of a statutory duty would be hindered, or

c) the recipient credibly demonstrates that the restriction was obtained abusively.

1. The public authority issues a decision when it rejects an application submitted by the affected person to enforce their rights.

1. The Canton establishes the Cantonal Office for Data Protection, which is responsible for the state administration and the autonomous public-law institutions.

2. The Municipality establishes the Municipal Office for Data Protection, which is responsible for the administrative offices of the municipality and the autonomous public-law municipal enterprises.

3. It may designate, through an agreement with another municipality, their Municipal Office for Data Protection as responsible for itself.

1. The municipality may establish a joint municipal specialist office by agreement with other municipalities. The agreement specifies

a) the municipality responsible for administrative allocation;

b) the key for financing the expenses of the municipal specialist office.

2. The government may oblige municipalities to establish a joint municipal specialist office if effective task fulfillment and efficient use of resources require it. It determines the municipality responsible and the key for financing the expenses of the municipal specialist office if the municipalities cannot agree.

3. For the municipal association or the purpose association, the municipal specialist office of the member municipality in which the association’s headquarters is located is responsible.

1. The Data Protection Office carries out its tasks independently and autonomously.

2. It is administratively assigned

a) in the canton, to the department or the state chancellery designated by the government through regulation;

b) in the municipality, to the council of the municipality or the host municipality.

1. Supervision is exercised by

a) the commission responsible for the oversight of government and state administration by the Cantonal Council over the cantonal data protection office;

b) the cantonal data protection office over the municipal data protection office.

1. The government appoints the head of the cantonal data protection office for a term of four years. It may terminate her or his employment relationship prior to the end of the term in the event of a breach of official duty or professional inadequacy. Both the appointment and termination of the employment relationship require the approval of the presiding body of the cantonal council.

2. The council appoints the head of the municipal data protection office for a term of four years. It may revoke the appointment in case of a breach of official duty or professional inadequacy. Both the appointment and revocation require the approval of the business audit commission.

3. If several municipalities establish a joint municipal data protection office, they shall regulate the procedure and competence for the appointment of the head and for revocation, as well as the approval by an independent body in the agreement.

3bis. The head of the data protection office shall refrain from all activities that are incompatible with the duties of the office and shall not engage in any other paid or unpaid activity incompatible with the office during the term.

4. The head of the data protection office employs staff within the framework of the budget.

5. The employment relationship of the head and the staff of the cantonal data protection office is governed by the Personnel Act of January 25, 2011.

1. The Data Protection Office independently prepares its section of the budget proposal.

2. The government, in the municipality the council, announces in the draft budget for the attention of the cantonal council, in municipalities for the attention of the municipal parliament or the citizens' assembly, whether the budget proposal prepared by the Data Protection Office has been adopted without changes. Deviations are justified.

1. The Data Protection Office

a)* reviews compliance with data protection regulations upon notification, on its own initiative, or according to its audit program. The notifying person must be informed of the manner of resolution within three months;

b) advises public authorities and affected individuals on data protection issues;

c) may propose to the government, or in municipalities to the council, the issuance of directives concerning technical and organizational measures to ensure data protection;

d) provides opinions on draft enactments that

1. contain provisions on data protection;

2. regulate data protection-relevant matters;

e)* participates in projects that involve or have implications for data protection;

f)* raises awareness among public authorities about their data protection obligations and raises public awareness about data protection concerns;

g)* collaborates with the bodies of other cantons, the federal government, and foreign entities that fulfill similar functions to achieve its objectives.

1bis. Excluded from the supervision of the Data Protection Office under Para. 1 let. a of this provision are

a) the Cantonal Council and government, municipal parliament and council, as well as courts, to the extent they act in a judicial capacity;

b) data processing in pending civil, criminal, and judicial administrative proceedings, as well as in pending legal assistance proceedings.

2. The cantonal Data Protection Office advises the municipal data protection offices.

3. It provides an opinion on the intended automated processing of personal data in pilot projects before the issuance of the authorization under Article 16a of this enactment.

1. The fulfillment of duties by the Data Protection Office is generally free of charge for the data subject.

2. The Data Protection Office may charge the costs to the data subject or refrain from taking action in cases that are clearly unfounded or disproportionately frequent.

1. The Data Protection Office is entitled to access the data essential for the performance of its tasks, including particularly sensitive personal data and personality profiles, from the data collections of the public authority.

1. The public authority supports the data protection office in the fulfillment of its duties by, upon request, particularly

a) providing information;

b) submitting documents and granting access to documents;

c) explaining the procedures for processing personal data;

d) demonstrating the processing of personal data;

e) providing expert information.

2. It is released from official secrecy.

1. The Data Protection Office issues recommendations and submits them to the public authority for written comments

a) if it identifies deficiencies in the processing of personal data;

b) in the case of intended processing of personal data with particular risks to the protection of fundamental rights.

1. The cantonal office for data protection may apply to the competent department or the state chancellery for the order of measures if the public authority does not wish to implement the recommendations, only implements them partially, or fails to provide a response within the set deadline. If the competent department, the state chancellery, or an independent public-law institution of the canton acts as the public authority, the application shall be addressed to the government.

2. The competent department, the state chancellery, or the government issues measures, except in cases where the public authority issues a decision against the affected person.

3. Legal protection is governed by the legislation on administrative procedures. The cantonal office for data protection is entitled to lodge complaints.

1. The Municipal Office for Data Protection may request the Council to issue measures if the public entity does not wish to implement the recommendations, only implements them partially, or does not provide a response within the set deadline. If the Council, a municipal association, or an independent public-law municipal enterprise acts as a public entity, the request must be directed to the competent department.

2. The Council or the competent department shall order measures, except in cases where the public entity issues an order to the affected person.

3. Legal protection is governed by the legislation on administrative legal proceedings. The Municipal Office for Data Protection is entitled to appeal and lodge complaints.

1. The Data Protection Authority may issue an order in cases of significant breaches of data security if it is foreseeable that the public authority will reject or not comply with a recommendation.

2. The public authority may contest the order by filing an appeal with the Administrative Appeals Commission within fourteen days.

3. If the public authority is a higher court, it may contest the order by filing a complaint with the Administrative Court within fourteen days.

1. The Data Protection Office shall annually report to the government, in municipalities to the council, or to the councils involved in the jointly established municipal data protection office, on

a) the application of data protection law and compliance with data protection;

b) the scope and focus of audit activities;

c) findings and their assessment.

2. The Cantonal Data Protection Office shall report to the Cantonal Council annually on its activities. The Cantonal Council shall take note of the report.

1. The Data Protection Office maintains the register of data collections within its jurisdiction.

2. Responsibility for maintaining the register of data collections in the private sector fulfilling state duties lies with

a) the cantonal Data Protection Office when performing cantonal duties;

b) the municipal Data Protection Office when performing municipal duties.

1. The Register shall provide information in particular about

a) Legal basis and purpose;

b) Methods of processing;

c) Type and origin of personal data;

d) Third parties authorized to enter and modify data;

e) Regular recipients.

2. The register of data collections shall be updated periodically, at least annually.

3. It is public.

1. The public authority shall report to the competent data protection office changes

a) in the inventory of data collections it manages;

b) in matters relevant to the content of the register.

2. It shall report

1. new data collections prior to their commencement;

2. other changes annually at the beginning of the next calendar year.

1. On application, the following shall be punished with a fine

a) anyone who processes personal data on behalf of the public authority and intentionally acts contrary to the terms of the assignment;

b) anyone who uses or discloses personal data for purposes other than those intended, which were disclosed to them by the public authority under Art. 14 of this decree.

1. The government determines the commencement of this decree's enforcement.