Act on the Outsourcing of IT Services (Auslagerungsgesetz, AusG) - Purpose (AusG)

1. This law governs the outsourcing of information technology services for cantonal administration.

1. This law applies to all authorities of the cantonal administration.

2. The Solothurn Hospitals AG, the independent public-law institutions of the canton, and the IT services at the cantonal schools for teaching purposes do not fall within the scope of this law.

1. In this Act, the following terms shall mean

a) Outsourcing: The delegation by the competent authority to third parties for the provision of IT services;

b) IT Services: Services related to information and communication technology, particularly concerning all applications, information systems, facilities, and products used for the electronic processing of information;

c) Third Parties: Contractors outside the cantonal administration who are commissioned to provide IT services;

d) Outsourcing Authority: An authority that outsources IT services to third parties in order to fulfill its duties;

e) Competent Authority: The authority responsible, according to § 6, for deciding on the outsourcing.

1. The outsourcing of information technology services may only occur abroad if adequate data protection according to Annex 1 of the Data Protection Ordinance (DPO) of August 31, 2022, is ensured.

2. Particularly sensitive personal data and factual data requiring enhanced protection may only be outsourced within Switzerland. Exceptions are permissible in justified individual cases.

1. Outsourcing is permissible when the competent authority ensures by law or written agreement that

a) Third parties provide IT services only in the manner that the outsourcing authority itself would be permitted to do;

b) Third parties, including their employees and auxiliary persons, assume those official secrecy, professional secrecy, and specific confidentiality obligations, and comply with the data protection provisions to which the outsourcing authority is bound;

c) Data security is ensured through appropriate technical and organizational measures;

d) Third parties may only engage other third parties to provide IT services with prior written approval from the competent authority;

e) Third parties are liable for due diligence in the selection, instruction, and supervision of their employees and auxiliary persons;

f) Provisions of the cantonal archival legislation are observed;

g) The competent and outsourcing authorities as well as the competent supervisory authorities possess the necessary rights of instruction and control; and

h) Swiss law applies to the contractual relationship, and a legal venue in Switzerland is determined, with exceptions permissible in justified individual cases.

2. The competent authority ensures that the fulfillment of state duties is guaranteed without significant impairment, even if third parties do not comply with agreements or discontinue their business activities.

1. The Government Council decides, subject to paragraph 2, on the outsourcing of IT services for the cantonal administration if they

a) are of overriding or strategic interest; or

b) are to be made mandatory for one or more organizational units; or

c) pose a high risk to the fundamental rights of the affected individuals, particularly in the case of extensive processing of particularly sensitive personal data.

2. Under the same conditions, the Judicial Administration Commission decides on the outsourcing of IT services for the courts.

3. In all other cases, the authority responsible for outsourcing is the outsourcing authority.

4. The decisions on outsourcing pursuant to paragraphs 1 and 2 are published.

1. The competent authority ensures that the risks arising from outsourcing are continuously assessed.

2. It determines the necessary measures to adequately minimize the risks.

3. Risks that are to be borne must be demonstrably accepted.

1. The responsibility for the lawful fulfillment of duties remains with the outsourcing authority.

2. The competent authority bears the responsibility for the risks arising from the outsourcing.

1. The Scope of Cantonal Data Protection and Archiving Legislation and the Applicable Financial and Procurement Law Provisions Remain Unaffected by This Law.

1. Outsourcing arrangements already commissioned must be adapted to the requirements of this decree within five years after the entry into force of this law.