Ordinance on the Act on the Population Register and Voting Register Platform (VESP) - Subject (VESP)

1. This regulation governs which authorities have access to the data of the resident register platform, the nature and content of their access authorization, the retention of personal data in the resident register platform, as well as the data standards to be used.

1. There is no entitlement to the granting of access rights.

1. Authorization Bodies in the Context of the Authorization Procedure consist of the Commissioner for Information and Data Protection, the Coordination Group of GERES Municipalities, and the GERES Authorization Committee.

2. The Coordination Group of GERES Municipalities is composed of two representatives from the Association of Solothurn Municipalities (VSEG) and the Association of Municipal Personnel of the Canton of Solothurn (VGSo).

3. The GERES Authorization Committee is composed of four representatives from cantonal authorities, the Commissioner for Information and Data Protection, as well as two representatives from the Association of Solothurn Municipalities (VSEG) and the Association of Municipal Personnel of the Canton of Solothurn (VGSo).

4. The representation of the cantonal authorities is determined by the competent department.

1. The authority requesting access to data from the resident registration platform must submit a substantiated application to the competent department.

2. The department forwards the application form to the authorization bodies.

1. A two-step authorization process is provided for each application for access to data on the residents' registration platform (test phase and production stage).

2. With the approval of all authorization committees, the requesting authority is granted test authorization for access to data on the residents' registration platform.

3. The test phase is limited to a maximum of twelve months.

4. Upon completion of the test phase, the authorization committees examine whether the requested access can be definitively granted and submit a corresponding proposal to the government council.

5. The government council makes the final decision on the access of the requesting authority to the residents' registration platform.

1. The head of an authority determines which employees exercise the access authorization granted to the authority.

2. He or she reports the authorized employees and any related changes to the responsible department.

1. With the consent of all relevant authorities, the competent department may provide data from the resident registration platform to an authority in accordance with § 3 GESP on a one-time basis.

2. Authorities may request information from the cantonal resident registration platform from a central office, provided that the conditions for administrative assistance are met.

1. The competent department maintains an authorization directory, which indicates which authorities have been granted access to the data on the resident registration platform, and also shows the type and content of each respective access authorization.

2. The authorization directory according to Paragraph 1 is continuously updated by the competent department.

3. The competent department publishes the type and content of the authorities' access authorizations on the internet.

1. The Head of the Authorized Authority Ensures That

a) access is enabled at no more workstations than necessary;

b) only individuals authorized to query have access rights;

c) persons authorized to query use access solely for the fulfillment of their legal duties.

1. Each inquiry of data from the resident register platform shall be recorded electronically. The version specified by the competent department pursuant to § 14 paragraph 1 must be used.

2. The logging shall include

a) the requesting authority and the requesting person,

b) the queried person and the queried data,

c) the time of the query.

3. If authorization for a third-party system (web service) is granted by the authorization committees, the third-party system must ensure electronic logging.

4. The logs are deleted after 12 months.

1. The head of the authority entitled to access may conduct random and person-specific checks of the logged data queries for irregularities.

2. The individuals who were checked, along with the data protection officer, are informed by the head about the scope and results of the inspections conducted.

1. If the Head detects any irregularities or even abuse, he or she shall take the necessary measures. In particular, he or she may revoke the access rights of the affected person.

2. In the event of abuse by an authority, a report must be made to the authorization committees. These committees shall examine the facts of the case and, if necessary, request the government council to revoke the access rights of the authority.

1. If the need of an authority for the granted access authorization is partially or no longer substantiated, it shall be restricted or revoked by the government council upon request of the authorization committees.

1. For the exchange of personal data, the respective versions of the standards for e-Government in Switzerland (eCH-Standards) determined by the department are to be used.

1. The following data of individuals registered in the Population Register Platform shall be deleted

a) a previous date of a feature ten years after its change;

b) in the case of relocation or death of an individual, all data ten years after the relocation or death of the relevant individual;

c) data that, according to notification from a municipality, are no longer maintained in the registers, ten years after the last notification.

2. The deletion of data in the cases of paragraph 1 shall take place at the end of the current calendar year.

3. As long as the deletion of this data is not technically feasible, access to this data shall be deactivated.

1. Reserved is the obligation to offer documents to the state archive in accordance with § 8 et seq. of the Archives Act of January 25, 2006.