Act on Public Information, Data Protection and Archiving (IDAG) - Subject and Purpose (IDAG)

1. This Act regulates

a) the official information of the public and access to official documents,

b) the handling of personal data by public authorities,

c) archival matters.

1. This law applies to all public authorities.

2. Judicial authorities do not fall under the scope of the duties, powers, and obligations of the individual responsible for public access and data protection in accordance with §§ 17b, 17c, and 31-33.

2bis. The rights and claims of the affected individuals during pending civil, criminal, and administrative judicial proceedings are governed by the applicable procedural law.

3. If a public authority participates in economic competition and does so under private law and not in fulfillment of a public task, the provisions of the Federal Act on Data Protection (FADP) of June 19, 1992, apply to its data processing. Oversight is governed by this law. The provisions regarding the principle of public access do not apply.

4. In the medical field, the provisions concerning the principle of public access apply subsidiarily, insofar as this is compatible with the nature of the legal relationships concerned.

1. The following terms mean

a) Official Documents: A document is considered official when cumulatively

1. the public authority has control over the document,

2. the document relates to the fulfillment of public tasks, and

3. information is stored on any type of information carrier;

b) Non-official Documents: Non-official documents include

1. provisional documents, such as drafts,

2. documents for personal use, in particular, working notes;

c) Public Authority: Public authorities are

1. all authorities, commissions, and bodies of public law institutions at the cantonal and municipal level,

2. natural and legal persons as well as commercial partnerships under commercial law that perform public tasks,

3. church corporations recognized under public law;

d) * Personal Data: Data relating to an identified or identifiable natural person,

e) * Data Subject: Natural person whose personal data is being processed,

f) * Profiling: any evaluation of data to analyze essential personal characteristics or to predict developments, particularly regarding work performance, economic situation, health, privacy, or mobility.

g) Processing: Any handling of personal data, especially obtaining, storing, using, altering, disclosing, or destroying personal data,

h) Disclosing: Making personal data accessible, such as granting access, sharing, or publishing,

i) * ...

k) Particularly Sensitive Personal Data: Data where, due to its significance, context, purpose, nature of processing, data category, or other circumstances, there is a particular risk of a personal rights violation,

l) Overriding Interests

1. An overriding public interest is particularly the assurance of free formation of opinion and will by authorities,

2. Overriding private interests notably include the protection of privacy as well as the safeguarding of professional, business, and trade secrets.

1. Public authorities are obligated to inform the population of activities and matters of general interest ex officio.

2. Information is considered to be of general interest if it pertains to matters of public concern and is significant for the formation of public opinion and the preservation of constitutional and democratic rights of citizens.

3. Official information is inadmissible if

a) it is prohibited by a formal law,

b) overriding public or private interests oppose it.

1. Every person has the right to access official documents.

2. Access may be provided on-site, through receiving a copy, or electronically.

3. Access to official documents may be restricted, deferred, or denied if

a) specific legal provisions, or

b) overriding public or private interests oppose.

1. If the official document contains personal data of third parties, these must be separated or anonymized.

2. If this is not possible or only possible with disproportionate effort, access shall be granted if there is a predominant interest in the disclosure of the document.

3. Paragraphs 1 and 2 do not apply if

a) the data subjects themselves make the personal data publicly accessible,

b) public access is obviously in the interest of the data subjects, or

c) there is an overriding interest in the disclosure of the personal data.

1. Access to

a) Minutes of non-public meetings and

b) Official documents of pending transactions, procedures, or about positions in ongoing contract negotiations

1. Public bodies may process personal data only if

a) there is a legal basis for doing so, or

b) it is necessary for the fulfillment of a legal duty of the processing body, or

c) the data subject has given consent, or

d) the consent of the data subject cannot be obtained or can be obtained only with disproportionate effort, and the consent can be presumed due to the circumstances.

2. The processing of particularly sensitive personal data and profiling are permissible only if

a) there is a legal basis for doing so, or

b) it is necessary for the fulfillment of a clearly defined legal duty, or

c) the data subject has given consent, or

d) the consent of the data subject cannot be obtained or can be obtained only with disproportionate effort, and the data processing is solely in the interest of the data subject.

3. ...

1. The principle of data minimization and economy must fundamentally be observed, particularly when using information technology systems.

1. Personal data must be accurate and, insofar as required by the purpose of processing, complete.

2. The burden of proof for the accuracy of the data lies with the responsible public body.

1. Personal data may only be processed for the purpose that

a) was stated at the time of collection,

b) is evident from the circumstances, or

c) is provided for by law.

1. Personal data must be protected against unauthorized processing through appropriate organizational and technical measures.

2. The responsible public authority is obligated to demonstrate compliance with data protection regulations. The government council shall determine the details by regulation.

1. The public authority shall collect personal data, whenever possible, directly from the individual concerned. It shall inform this individual of every collection of data. The obligation to provide information also applies when the data are collected from third parties. The information must include, in particular, details about

a) * the responsible public authority and its contact details,

b) * the processed data or the categories of data being processed,

c) * the legal basis and the purpose of the processing,

d) * the recipients of the data or their categories, if the data are disclosed to third parties, and

e) * the rights of the individual concerned.

2. The obligation to provide information is waived if

a) * the individual concerned already possesses the information in accordance with paragraph 1,

b) * the processing of personal data is expressly provided for by law, or

c) * providing the information is impossible or possible only with disproportionate effort.

3. The transmission of the information may be restricted under the same conditions as the right to access one’s own personal data (§ 25).

1. Personal data may be disclosed to public authorities within and outside the canton, subject to special confidentiality provisions, if

a) * the conditions in accordance with §§ 8 and 9 are fulfilled, or

b) * it is necessary for the fulfillment of a clearly defined legal task of the data-receiving authority. Special confidentiality provisions remain reserved.

2. ...

3. Personal data may be disclosed abroad if adequate protection of the personality of the affected persons, particularly through sufficient legislation, is ensured.

4. In the absence of legislation providing adequate protection, personal data may only be disclosed abroad if the disclosure in the individual case is either essential for safeguarding an overriding public or private interest or for the establishment, exercise, or enforcement of legal claims in court.

5. Public authorities must disclose personal data to their supervisory authorities if the latter require the data in the course of their supervisory activities.

1. Public Authorities may disclose personal data to private individuals only if

a) they are legally obligated to do so, or

b) the disclosure is necessary to fulfill a legal duty, or

c) the person requesting the information credibly demonstrates that, without the disclosure, they would be hindered in enforcing legal claims, or

d) the affected individual has consented.

2. Public Authorities must verify the identity of third parties before disclosing personal data to them.

1. The residents' registration office may disclose the name, first name, age, place of origin, and address of a person to private third parties in individual cases upon request if these parties demonstrate a legitimate interest.

2. If these personal data are used exclusively for non-commercial purposes and are not disclosed by private third parties, they can be released according to specific criteria.

3. Any person can request that their personal data not be disclosed to private third parties.

4. The residents' registration office ensures the easy exercise of this right to block disclosure through appropriate measures.

1. If the proposed data processing is likely to result in an increased risk to the personality and fundamental rights of the data subject, the public authority must conduct a data protection impact assessment in advance.

2. The data protection impact assessment describes the planned processing, the risks to the personality and fundamental rights of the data subject, and the measures that are intended to reduce the risk of violation of the personality and fundamental rights of the data subject.

1. The public body informs the appointed person for public affairs and data protection if

a) the data protection impact assessment reveals that the processing would result in an increased risk to the personality and fundamental rights of the data subject, or

b) the form of processing, particularly when using new technologies, mechanisms, or procedures, would result in an increased risk to the personality and fundamental rights of the data subject.

2. The appointed person for public affairs and data protection issues a recommendation pursuant to § 32 para. 3 within two months after receiving all necessary information, if the planned processing would violate data protection regulations. They may extend the deadline by one month.

3. The appointed person for public affairs and data protection may recommend, upon request of the responsible public body or ex officio, a trial implementation of data processing if a test phase is imperative for the practical implementation because fulfilling the task

a) requires technical innovations, the effects of which must first be evaluated, or

b) requires significant organizational or technical measures, the effectiveness of which must first be tested, particularly the collaboration between public bodies.

4. The responsible public body must resubmit the intended data processing for prior consultation no later than two years after the recommendation pursuant to paragraph 3.

1. The public authority shall immediately report any unauthorized data processing or data loss to the designated person for public relations and data protection, unless the data security breach is unlikely to result in a risk to the personal rights and fundamental freedoms of the affected person.

2. The public authority shall also inform the affected person when it is necessary for their protection or when requested by the designated person for public relations and data protection. The information may be restricted or postponed if overriding public interests so require.

3. The processors shall immediately inform the responsible public authority of any unauthorized data processing.

**1. If a public body processes personal data through third parties, it ensures data protection through agreements, stipulations, or other means. In particular, data processors may not transfer the processing of personal data to additional subcontractors without the prior written consent of the public body.**

**2. The public body remains responsible for compliance with data protection. The rights of the data subjects must be asserted against it.**

1. Public authorities may process or disclose personal data to third parties for non-personal purposes, in particular for research, planning, and statistics, provided that

a) Personal data is anonymized as soon as the purpose of processing allows,

b) The recipient only discloses the personal data with the consent of the public authority, and

c) Results are published in a manner that does not allow the identification of the individuals concerned.

2. The following do not need to be fulfilled

a) The general conditions according to sections 8 and 11,

b) The provisions regarding the disclosure of personal data according to sections 14-16.

1. Public authorities may monitor publicly accessible areas with optical-electronic devices if this is necessary for the fulfillment of a public duty or for the exercise of domiciliary rights, and there is no indication that the legitimate interests of the affected parties prevail. The surveillance must be approved by the person responsible for public and data protection. The approval may be subject to conditions.

2. The fact of observation, recording, and the responsible authority must be made recognizable through appropriate measures.

3. If personal data collected through surveillance is assigned to a specific individual, that individual must be informed about the processing. This is subject to differing provisions in other legislation, particularly in criminal and criminal procedural law.

1. If personal data is no longer needed for the fulfillment of statutory duties as well as for security and evidentiary purposes, it shall be destroyed by the responsible authority.

2. The provisions regarding archiving remain reserved.

3. The government council shall regulate by ordinance the deletion periods and the measures for regular verification of whether the personal data is still needed.

4. The judicial authority shall regulate in a regulation the archiving of records from the courts and conciliation authorities, as well as the retention period, the delivery to the state archives, and their destruction.

1. Every individual may request information from the responsible authority about which personal data concerning them is being processed in their personal data collection. They must specify the type of personal data for which information is to be provided.

2. No one can waive their right to information in advance.

3. Upon request, the concerned individual shall be granted access to their personal data instead of receiving the information.

1. The responsible authority must inform the concerned individual in a generally understandable form, usually in writing, about

a) all personal data concerning them contained in the personal data collection,

b) * the purpose and, if applicable, the legal basis of the processing, the categories of processed personal data, the retention period of the personal data or, if this is not possible, the criteria for determining this period, the origin of the personal data, and the recipients of the personal data,

c) * the rights of the concerned individual.

2. The provisions of § 15 paragraph 2 apply accordingly to the granting of information and access.

1. Disclosure and access may be deferred, restricted, or denied to the extent that such action is required by law or predominant public or private interests.

2. If the disclosure or access to personal data from the medical or psychiatric field would excessively burden the requesting person, it can be provided to a person they trust. If the requesting person expressly wishes, they shall be given comprehensive disclosure or access unless professional secrecy stands in the way.

1. Upon request, information regarding the personal data of deceased persons must be provided, if the requesting individual demonstrates an interest in the information and there are no overriding public or private interests, particularly those of the deceased person's relatives or third parties, that oppose it. Close kinship, marriage, a marriage-like cohabitation, and registered partnership with the deceased person establish an interest.

1. The affected individual may request from the public authority that incorrect personal data be corrected, supplemented, or deleted. If they have a legitimate interest, they may also request that the public authority communicate or publish the decision to third parties.

2. If the authority cannot prove the accuracy, it must delete the personal data. If there is an overriding interest in retaining the data, the authority may, as an exception, record a corresponding note. The government council shall regulate the conditions by ordinance.

**1. The affected person may request from the public authority that it**

a) refrain from unlawful processing, particularly ensuring that unlawfully processed personal data is deleted,

b) eliminate the consequences of unlawful processing,

c) ascertain the unlawfulness of the processing,

d) notify or publish the decision to third parties, provided the individual has a legitimate interest.

1. The public authority responsible for data protection is the one that processes or has personal data processed.

2. If several public authorities process personal data in a joint personal data collection, the supervisory authority designates the public organ that carries the main responsibility for data protection; each public authority remains responsible for its own area.

1. The government council appoints for a duration of 8 years a specialist in data protection as the Commissioner for Public Access and Data Protection, as well as their deputy. Re-election is permitted. Sections 33-36 of the Act on the Fundamentals of Personnel Law (Personnel Act, PersG) of May 16, 2000, apply mutatis mutandis.

1bis. The government council may remove the appointed person for Public Access and Data Protection from office if they

a) have deliberately or through gross negligence seriously violated official duties, or

b) have permanently lost the ability to perform the duties of the office.

2. The appointed person for Public Access and Data Protection carries out their tasks independently. The government council regulates the administrative affiliation by ordinance.

3. The appointed person for Public Access and Data Protection has a secretariat and its own budget.

4. The appointed person for Public Access and Data Protection may not hold any other public office, have a leading role in a political party, or engage in any other gainful employment. The government council may grant exceptions. If the appointed person for Public Access and Data Protection is employed on a part-time basis, approval for another gainful activity may not be refused, provided that such activity does not impair the performance of the function, as well as the independence and reputation of the office.

1. The Designated Person for Public Access and Data Protection

a) monitors the application of regulations concerning the principle of public access and data protection,

b) advises authorities on the application of regulations concerning the principle of public access and data protection and provides information to private individuals about their rights,

c) gives opinions on drafts of legislative acts and measures that are significant for the principle of public access and data protection,

d) facilitates mediation between authorities and private individuals,

e) raises awareness among the public, particularly vulnerable individuals, regarding data protection,

f) monitors relevant developments in the areas of data protection and the principle of public access.

2. The Designated Person for Public Access and Data Protection is the cantonal supervisory authority within the meaning of Article 37, paragraph 2 of the Federal Act on Data Protection.

1. The designated person for Public Access and Data Protection acts ex officio or upon notification. The responsible public authority must be informed of a notification and given the opportunity to comment.

2. The designated person for Public Access and Data Protection clarifies the facts ex officio. They have the right to request information, demand the submission of files and documents, and verify data processing at any time from the responsible public authorities, their representatives, as well as from recipients of personal data, regardless of any potential confidentiality obligation. The responsible public authorities and third parties are obliged to cooperate.

3. If the designated person for Public Access and Data Protection establishes that rules regarding the principle of public access or data protection are violated, they can issue a recommendation to the responsible public authorities. The public authority must declare whether it will follow the recommendation.

3a. If the privacy of affected persons is clearly endangered or violated, the designated person may provisionally order that data processing be restricted or ceased. An appeal against this provisional order does not have a suspensive effect.

4. If the public authority refuses to follow the recommendation or does not comply with it, the designated person for Public Access and Data Protection can issue the recommendation as a binding order, wholly or partially, without charge.

5. The public authority to which the order is directed can challenge it by filing an administrative appeal. The designated person for Public Access and Data Protection is entitled to appeal any decision of the appellate authority before the Administrative Court. Further legal proceedings follow the applicable federal law.

1. The Commissioner for Public Access and Data Protection

a) manages complaints from affected individuals and informs them of the results of the investigation or the status of clarifications within a maximum of three months.

b) collaborates with the data protection authorities of other cantons, the federal government, and foreign entities to fulfill control tasks.

c) provides an account of their activities to the Grand Council and the Executive Council as part of the annual report and reports on important findings as well as the assessment and impact of data protection regulations.

2. The Commissioner for Public Access and Data Protection, as well as any third parties they may involve to fulfill their duties, are subject to official secrecy regarding facts they become aware of in the course of their activities.

1. Claims pursuant to §§ 5, 23, and 28 may be asserted either orally or in writing with the responsible authority. The subject matter of the claim must be specified in detail.

1. If the authority considers partially or fully rejecting the application, it must notify the applicant in advance.

2. If third parties' protectable interests are affected, they must be granted the right to be heard before the decision is issued. If the public body contemplates granting the access request contrary to the opinion obtained, it must notify the third parties in advance.

1. Within 30 days of receipt of the notification pursuant to § 36 paragraphs 1 and 2, the applicant or the third party may request the public authority to issue a contestable decision.

1. Insofar as this law does not stipulate otherwise, the procedure and legal protection are governed by the Act on Administrative Jurisdiction (Administrative Procedure Act, APA) of July 9, 1968.

2. Appeals against final decrees and decisions of the administrative authorities may be lodged with the Administrative Court.

3. Applications to the Higher Court and complaints against decisions of lower judicial authorities are adjudicated by the Judicial Administration.

4. If further legal violations are claimed in the complaint, the court responsible for the main issue shall decide.

1. The initial-instance handling of applications pursuant to §§ 5, 16, 23, and 28 is fundamentally free of charge.

2. A reasonable fee may be charged for

a) complex procedures, such as in complicated situations or extensive anonymization of documents,

b) the preparation of copies for applicants.

3. ...

4. ...

5. ...

**1.** Anyone who, as a contractor, processes personal data without the explicit authorization of the commissioning entity, uses personal data for themselves or others, or discloses it to others, shall be punished with a fine of up to CHF 10,000.

**2.** If the offender acts with the intent of gaining profit, the court is not bound by this maximum amount.

**3.** Intentional or negligent violations are punishable.

**4.** Otherwise, the provisions of the Swiss Criminal Code of December 21, 1937, shall apply.

1. Prosecution and adjudication of offenses are governed by the provisions of criminal procedure law.

1. Public authorities are obligated to ensure the safeguarding, registration, and preservation of all documents that are of significance to the public and to science.

2. The government council shall regulate the details by ordinance.

1. The State Archive is a non-autonomous public-law institution that serves as the central archive for the canton and its legal predecessors. It preserves the cultural heritage and ensures the permanent documentation for the needs of the canton, the public, and the scientific community.

2. The State Archive is responsible for the proper storage, cataloging, and dissemination of documents. It advises public bodies on archival matters. Cantonal archives are subject to the supervision of the State Archive.

1. The following documents are to be offered to the State Archive for acquisition, organized and accompanied by a delivery list, as soon as they are no longer needed permanently: All documents

a) of the Grand Council and the Executive Council, generally 10 years after their creation,

b) of the cantonal administrative bodies, including dependent public-law institutions, generally 10 years after their creation,

c) * of the district offices, courts, and the investigation office, generally 30 years after their creation.

2. If archival material from municipal archives is to be destroyed, it must first be offered to the State Archive. The State Archive decides on the necessity of acquisition.

3. The Executive Council may temporarily exempt certain groups of documents from the obligation to offer due to overriding public or private interests and may alter the deadlines. It regulates the prerequisites by ordinance.

1. Documents preserved in the state archive must be made accessible to the public after a protection period of 30 years from their creation, unless they were already publicly accessible before their archiving.

2. Documents containing particularly sensitive personal data or personality profiles may only be made publicly accessible 10 years after the death of the individuals concerned. If the date of death is unknown, the protection period ends 100 years after birth; if this date is also unknown, 80 years after the completion of the records.

3. The submitting authorities and administrative offices generally have the right to inspect the archived materials if they require them to fulfill their duties or if it is in the interest of the individuals concerned. The archived materials must not be altered in the process.

1. The state archive may restrict, defer, or deny access if there is a particularly legitimate interest or if the protection of the archival materials requires it. The procedure is governed by §§ 35 et seq.

1. The State Archive may, upon a substantiated request, grant access to documents before the expiration of the protection periods if there are overriding public or private interests. The public authority that delivered the documents must be consulted beforehand.

2. In cases according to § 46 paragraph 2, the provisions regarding data protection pursuant to §§ 8 et seq. must be observed.

3. For research and statistical purposes, the State Archive may permit access before the expiration of the protection periods, in accordance with § 19.

1. This law must be published in the official collection of laws after the referendum period has expired without being used or after acceptance by the people. It shall be enacted by the government council following acceptance of the constitutional amendment of October 24, 2006, by the people.

1. A transitional period of five years from the enactment of this law applies for the adaptation or enactment of statutory provisions concerning the processing of particularly sensitive personal data.

2. The permit pursuant to § 20 for optical-electronic installations already in operation must be obtained within three years of the enactment of this law.

3. Registers of personal data collections that do not comply with the requirements pursuant to § 22 must be adjusted within three years of the enactment of this law.