Act on Information and Data Protection (InfoDG) - Subject Matter and Purpose (InfoDG)

1. This Law Regulates

a) the official information provided to the public;

b) access to official documents;

c) protection against the misuse of personal data by authorities (data protection).

2. It aims to promote transparency in governmental activities and to protect the privacy, confidentiality, and fundamental rights of individuals whose data is processed by authorities.

1. This law applies to all authorities as defined in Section 3.

2. Title 4 of the law applies

a) to judicial authorities only insofar as they perform administrative tasks;

b) not to other authorities regarding official documents from pending civil proceedings, criminal proceedings, as well as administrative legal claims, complaints, and objection procedures.

3. Title 5 of the law does not apply to

a) authorities, insofar as they participate in economic competition and do not act in a sovereign capacity;

b) personal data processed exclusively as personal work resources;

c)* pending civil proceedings, criminal proceedings, and administrative legal claims, complaints, and objection procedures. §§ 16bis and 16ter remain reserved.

1. Authorities within the meaning of this Act are

a) the authorities and departments as well as the commissions of the canton and the municipalities;

b) the bodies of autonomous corporations and institutions of public law;

c) natural and legal persons, insofar as they perform public duties.

1. An official document is any information that

a) is recorded on an information carrier;

b) is in the possession of an authority from which it originates or to which it has been communicated; and

c) pertains to the fulfillment of a public task.

2. A document is not considered an official document if it

a) is not finalized or

b) is intended exclusively for personal use.

1. A protectable private interest particularly includes the assurance of privacy and the confidentiality of professional, business, and manufacturing secrets.

2. An important public interest particularly includes the preservation of public safety and the freedom of opinion and decision-making by authorities.

1. Access to official documents is the inspection and receipt of information.

2. Personal data (data) refers to information relating to an identified or identifiable natural or legal person (data subject).

3. Particularly sensitive personal data includes information about religious, philosophical, political, or trade union views or activities, health, intimate sphere, racial and ethnic origin, measures of social assistance, as well as administrative or criminal prosecutions and sanctions.

4. A personality profile is a compilation of data that allows the assessment of essential aspects of the personality of a natural person.

5. Processing is any handling of data, namely collecting, procuring, recording, gathering, storing, using, reorganizing, modifying, making accessible, disclosing, publishing, archiving, and destroying.

6. A data collection is any set of data structured in such a way that the data can be accessed according to the data subjects.

1. Authorities shall inform the public about their activities of general interest, unless a law or protectable private or significant public interests oppose such disclosure.

2. The information must be prompt, comprehensive, factual, and clear.

3. Municipalities shall inform to the best of their abilities.

1. Information on pending proceedings is provided only when special circumstances require it, namely when

a) the proceedings concern a matter that attracts significant attention;

b) the provision of information is necessary to avoid or correct false reports or to reassure the public.

1. The State Chancellery is the information office of the Cantonal Council, the Government Council, and the cantonal administration.

2. The Cantonal Council may designate special information offices for its bodies, and the Government Council may designate them for the cantonal administration.

3. The judicial authorities and the other authorities designate their information offices.

1. Information from the cantonal authorities is generally disseminated through the media; all media outlets are treated equally. Exceptionally, direct information may be provided, particularly for the protection or warning of the population.

2. Official announcements are governed by special legislation. The State Chancellery may publish official announcements on electronic data carriers within the framework of this law.

3. Other authorities determine the means and methods of official information themselves.

1. Media professionals who regularly report on the activities of cantonal authorities are accredited by the State Chancellery. The Higher Court can regulate the accreditation of media professionals at the courts.

2. Accreditation is revoked if information is obtained abusively or disclosed in deviation from § 7 paragraph 2.

1. Every person has the right to access official documents.

2. If access would require a special effort by the authority, it may be made dependent on proof of a legitimate interest.

3. Inspection occurs on-site, through the delivery of a copy, or by electronic media.

4. Official documents that are accessible under this law remain accessible even after archiving.

1. Access to official documents is restricted, deferred, or denied insofar as

a) a law or protectable private or significant public interests oppose it;

b) the access would disclose information provided voluntarily and under assurance of confidentiality to the authority by third parties.

2. The right of access exists only after a protection period of 30 years from the last record

a) for official documents from non-public negotiations; resolutions are accessible unless a law or protectable private or significant public interests oppose;

b) regarding positions in contract negotiations.

3. The authority may grant access before the expiration of the protection period (para. 2) if protectable private or significant public interests exist or if the data are required for scientific research or legal interpretation.

1. Access to personal data contained in official documents is governed by the provisions of this law concerning the disclosure of personal data (§ 21 - § 23) and the rights of the individuals concerned (§ 26 - § 30), as well as by special legislation.

1. Authorities may process personal data,

a) if it is provided for in a law or ordinance;

b) if it is necessary to fulfill a task based on a law or ordinance;

c) if and to the extent that the data subject has made the data publicly accessible or

d) if the data subject has consented in the specific case.

2. They may only process particularly sensitive personal data and personality profiles,

a) if a law expressly permits it;

b) if it is indispensable to fulfill a task that is clearly defined in a law;

c) if and to the extent the data subject has made the data publicly accessible or

d) if the data subject has expressly consented in the specific case.

1. Processing of Personal Data

a) Respects proportionality and acts in good faith;

b) Ensures that the data is correct and, as far as required by the purpose of processing, up-to-date and complete;

c) Protects the data against unauthorized processing with appropriate technical and organizational measures.

2. Personal data may only be processed for the purpose specified at the time of collection or acquisition, evident from the circumstances, or provided for in a law or regulation.

3. For non-personal purposes, namely for research, planning, and statistics, personal data may be processed if it is anonymized as soon as the purpose of processing allows it. With respect to particularly sensitive personal data, the requirements of § 15 paragraph 2 (Legal Basis) do not need to be met.

1. In public and generally accessible places, authorities may employ surveillance equipment to protect individuals and property from criminal acts and to identify offenders, under the conditions set forth in § 15 and § 16. Such measures must be appropriate and necessary.

2. The processing of personal data is permissible under the conditions specified in paragraph 1.

3. At the location under surveillance, there must be an indication of the visual surveillance and the responsible authority.

4. If the data collected through visual surveillance is associated with a specific individual, that person must be informed about the processing, as soon as the purpose allows it.

5. Recorded personal data must be destroyed or overwritten immediately after evaluation, or no later than 96 hours after recording. This is subject to the provision for data transfer in accordance with § 16ter.

1. Transfer of Data to Other Government Agencies is Permissible on a Case-by-Case Basis Upon Written Request, Provided That

a) the requesting authority needs the data to pursue a purpose that is substantively related to the original purpose of collection, and

b) the requesting authority requires the data for evidentiary purposes in a criminal, civil, or administrative legal proceeding, and

c) the transfer is proportionate under the specific circumstances.

2. The receiving authority may retain the data as long as it is necessary for evidentiary purposes. Thereafter, the data must be destroyed.

1. If an authority allows personal data to be processed by third parties, it ensures data protection through agreements, conditions, or other means.

1. Personal data must be collected from the affected individual. The authority collecting the data shall inform about the purpose of data processing, potential recipients of the data, and whether there is an obligation to provide information and the potential consequences of refusing to provide the information.

2. Unlike the affected individual, personal data may only be collected if there is a legal basis for doing so pursuant to § 15.

1. The authority must anonymize or destroy personal data that it presumably no longer needs for the fulfillment of its duties or for security and evidentiary purposes.

2. Reserved is the special legislation, particularly concerning the obligation to deliver documents to an archive.

1. Archived personal data must not be altered.

2. The authority that transferred the data to the archive may continue to access the data.

1. Personal data may be disclosed if there is a legal basis for doing so pursuant to § 15.

2. ...

3. Personal data may be reported to other authorities without request and made accessible to authorities or private individuals through a retrieval process, if explicitly provided for in a law or regulation. Particularly sensitive personal data and personality profiles may only be made accessible through a retrieval process if explicitly provided for by law.

4. Personal data may only be disclosed for remuneration if provided for in a law.

5. Particularly sensitive data of deceased persons may, if no legal basis exists pursuant to § 15 paragraph 2 letter a, b, or c, be disclosed to private individuals only after the expiration of a protection period; the protection period is 30 years from the date of death, or, if the date of death is uncertain, 110 years from the date of birth. If neither the date of death nor the date of birth can be determined, the protection period is 80 years from the last recorded entry. The authority may grant exceptions if there are protectable private or significant public interests, or if the data is necessary for scientific research.

1. Personal data may not be disclosed abroad if doing so would severely endanger the personality of the affected individuals, particularly because of a lack of legislation that ensures adequate protection.

2. If there is a lack of legislation ensuring adequate protection, personal data may only be disclosed abroad if

a) Sufficient guarantees, particularly through a contract, ensure adequate protection abroad;

b) The affected individual has consented in the specific case;

c) The disclosure is essential in the specific case either for safeguarding an important public interest or for the establishment, exercise, or enforcement of legal claims in court;

d) The disclosure is necessary in the specific case to protect the life or physical integrity of the affected individual;

e) The affected individual has made the data generally accessible and has not expressly prohibited processing.

1. The residents' registration office provides private individuals with information about the last name, first name, gender, date of birth, place of origin, nationality, address, place and date of arrival and departure of individual persons. Marital status and date of death are disclosed if a legitimate interest can be credibly demonstrated.

2. These data may only be disclosed in a systematically arranged manner if they are used exclusively for legitimate non-material purposes.

1. The disclosure of personal data is refused, restricted, or subject to conditions insofar as a law or legitimate private or important public interests oppose it.

1. Each authority shall maintain a register of the data collections it has established. Every person has the right to inspect the register.

2. The register shall contain at least the following information about each data collection

a) Name and address of the authority;

b) Name, purpose, and legal basis of the data collection;

c) Categories of affected persons and processed personal data;

d) Categories of authorities and third parties to whom the data is reported without request or made accessible through a retrieval procedure (§ 21 para. 3).

3. Data collections that are maintained for a maximum of two years, serve exclusively internal administrative purposes, or are lawfully published shall not be included in the register.

4. A copy of the register shall be provided to the Information and Data Protection Officer (§ 31).

1. The Data Protection and Information Officer (§ 31) maintains a central register of the data collections registered under § 24. The central register contains the information specified in § 24 paragraph 2.

2. Any person may inspect the register.

1. Any affected person, who identifies themselves, has the right to request information regarding which data about them is being processed in a specific data collection. The information is provided in a generally understandable form and, upon request, in writing.

2. The affected person has the right to request access to the data.

3. The provision of information and access can be restricted, postponed, or denied if a law or protectable private or significant public interests oppose it.

1. Any affected person may request the authority not to disclose certain personal data to private individuals.

2. The restriction becomes effective no later than 10 days after receipt of the written request.

3. The authority may order the disclosure despite the restriction if

a) it is required to do so by law or regulation;

b) disclosure is necessary to fulfill a task based on a law or regulation; or

c) the person seeking information credibly demonstrates that the restriction hinders them in the enforcement of legal claims.

1. The affected person may request that the authority correct or supplement incorrect data. If they have a legitimate interest, they may also request that the authority communicate or publish the decision to third parties.

2. If neither the accuracy nor the inaccuracy of personal data can be proven, the authority must attach a corresponding note to the data.

1. The affected person may request from the authority that it

a) cease the unlawful processing;

b) eliminate the consequences of unlawful processing;

c) determine the unlawfulness of the processing.

**1. Concerning Archived Personal Data**

Blocking and correction cannot be requested concerning archived personal data; however, the affected person can request that the dispute of accuracy be noted.

1. The Cantonal Council elects a Commissioner for Information and Data Protection upon the proposal of the Government Council for a term of four years. Re-election is permitted.

2. The Government Council may terminate the employment relationship with the Commissioner for important reasons, pursuant to § 28 of the State Personnel Act. Termination of the employment relationship requires approval by the Cantonal Council. Legal protection is otherwise governed by the State Personnel Act dated 27 September 1992, the Collective Employment Agreement (CEA) dated 25 October 2004, and the Court Organization Act dated 13 March 1977.

3. The Government Council determines the remuneration of the Commissioner.

4. The Commissioner performs duties independently and without external influence on a professional basis; he or she is administratively affiliated with the State Chancellery.

5. The Commissioner has his or her own budget. Within the framework of the budget, he or she is responsible for the hiring, termination, and restructuring of employment relationships with his or her employees. Furthermore, the Personal Law dated 27 September 1992 and the Collective Employment Agreement (CEA) dated 25 October 2004 apply to the personnel of the Commissioner.

6. Municipalities may elect their own Commissioners for Information and Data Protection; these have the duties and competences according to this law and are subject to the supervision of the cantonal Commissioner.

1. The Information and Data Protection Officer

a) Monitors the application of regulations concerning access to official documents and data protection; the Cantonal Council and the Executive Council are exempt from this supervision;

b) Advises and supports the authorities in the application of the regulations and provides private individuals and affected persons with information about their rights;

c) Mediates between private individuals, affected persons, and authorities and conducts the conciliation procedure (§ 36);

d) Ensures the updating of the registers of data collections (§ 24 f.);

e) Provides opinions on draft legislation and measures that are significant for access to official documents or data protection;

f)* Reports annually and as needed to the Cantonal Council on activities and periodically informs it and the public about important findings and assessments as well as the impact of data protection provisions and the principle of transparency; the annual reports are published;

g) Fulfills additional tasks assigned to him or her by law or ordinance.

h)* Reviews planned data processing activities in advance that involve particular risks to the rights and freedoms of the affected persons; § 38 applies correspondingly;

i)* Collaborates with the supervisory authorities of other cantons, the federal government, and foreign countries to fulfill supervisory tasks.

2. The Information and Data Protection Officer is a cantonal supervisory authority within the meaning of the Federal Act on Data Protection.

1. The Information and Data Protection Officer acts ex officio or upon notification.

2. He or she may request information from authorities as well as from third parties who are entrusted with data processing (§ 17) or to whom data have been disclosed, notwithstanding any potential confidentiality obligations. He or she may demand the submission of records and documents and have data processing demonstrated. The authorities and the third parties must cooperate in establishing the facts.

1. Management of fiscal administration is governed by the Act on Performance-Oriented Administration (WoV Act) dated September 3, 2003.

2. The Executive Council adopts the budget, the integrated task and financial plan, as well as the annual report of the appointed individual unchanged.

3. The appointed individual independently executes the budget.

4. The appointed individual may engage experts within the scope of the budget, provided that the execution of tasks requires special expertise or cannot be ensured with regular staff.

1. The request for access to official documents must be addressed to the authority that holds the documents. The official documents must be sufficiently specified.

1. The authority shall respond to the request as quickly as possible. Regarding archived documents, the authority responsible is the one that delivered the documents to the archive; after 30 years since the last recording, the archival authority is responsible.

2. Upon request, the authority shall provide in writing the reasons why it restricts, postpones, or denies access to official documents.

1. The applicant may submit a written request for mediation to the Information and Data Protection Commissioner if access to official documents is restricted, postponed, or denied.

2. If mediation is reached, the procedure is considered resolved.

3. If no mediation is achieved, the Commissioner issues a written recommendation.

1. The authority shall issue an order if the applicant or any potentially affected third party so requests.

**1. If the Information and Data Protection Officer determines that data protection regulations have been violated, he or she shall issue a recommendation to the authority.**

2. If the recommendation is not followed, he or she may submit the matter to the next higher authority (ultimately the Department or the Municipal Council) for a decision. The decision is communicated to the affected persons as well as to the Officer in the form of an order.

3. The Information and Data Protection Officer may file an administrative court complaint against the final order pursuant to paragraph 2 with the administrative court.

1. Unless otherwise specified by this law, the procedure and legal protection shall be governed by the Court Organization Act and the Administrative Procedure Act.

2. Appeals against decisions by the highest-instance authorities of municipalities and other authorities (§ 3) may be filed as administrative court complaints with the Administrative Court.

1. No fees shall be charged for access to official documents, conciliation proceedings, and the procedure for issuing a decree (§ 34 - § 37); paragraph 2 is reserved.

2. The cantonal authorities shall levy the fees provided for in the fee schedule for

a) access to official documents if it causes significant expenditure (§ 12 para. 2);

b) the provision of photocopies and data carriers (§ 12 para. 3).

3. Municipalities and other authorities (§ 3) may also levy fees for their activities as outlined in paragraph 2.

1. No fees shall be charged for inspecting the registers of data collections and for exercising the rights of the affected individuals (§ 26 - § 30).

1. A fine shall be imposed on anyone who

a) is tasked or authorized by an authority with handling personal data (§ 17) and, without explicit authorization from the authority, uses the personal data for themselves or for others, or discloses it to others;

b) fails to cooperate in the determination of the facts (§ 33 para. 2) despite a written request.

1. The authorities must establish the register of data collections (§ 24) within two years after the entry into force of this law.

2. Data collections containing particularly sensitive personal data or personality profiles that exist at the time of entry into force of this law may be used for five years after the entry into force of this law without fulfilling the requirements according to § 15 paragraph 2.

1. The amendments have been incorporated into the respective decrees.

1. The Ordinance on the Introduction of the Federal Data Protection Act of February 2, 1994, is repealed.

1. The Executive Council determines the commencement date. It is entrusted with the execution.