Data Protection, Information and Archiving Act (DIAG) - Purpose (DIAG)

1. This law governs the handling of data by public entities, particularly personal data.

2. It regulates the related rights of the individuals concerned and the public and establishes the principles for archiving and retention.

1. This law applies to the canton, the districts, the municipalities, public corporations, and, insofar as they perform public tasks, the public institutions with headquarters in the canton. It does not apply to the Appenzell Cantonal Bank.

2. If public tasks are performed by third parties, the law applies correspondingly.

3. The rights and claims in pending civil, criminal, and administrative judicial proceedings are governed by the respective procedural law. The processing of personal data in these proceedings is not subject to the supervision of the Data Protection Officer.

1. Public bodies are authorities, commissions, offices, and representations acting on behalf of a corporation, a corporate body, or an institution, as well as private individuals, insofar as they perform public tasks.

2. Public bodies that bear responsibility for duties under this law are considered responsible bodies.

3. Official documents are records managed by public bodies.

4. Data, irrespective of the form of presentation and data carrier, are all records that serve the fulfillment of public tasks.

5. Personal data are details concerning identified or identifiable natural persons.

6. Particularly sensitive personal data are those whose processing poses an increased risk of fundamental rights violations, specifically details about

a) political opinions, religious or ideological beliefs, and affiliation with a political or socio-partnership association or organization;

b) ethnic origin or affiliation;

c) sexual life or sexual orientation;

d) health, as well as genetic and biometric data;

e) social assistance procedures and measures, as well as child and adult protection;

f) administrative and criminal measures and sanctions.

7. Data collections are sets of personal data that are organized or can be organized by individuals.

8. Profiling is the evaluation of data to analyze personal characteristics or to predict developments, particularly with regard to work performance, health, privacy, or mobility. Results from profiling are considered particularly sensitive personal data.

1. The processing of personal data includes, irrespective of the methods and procedures applied, every form of handling such data, namely the collection, transfer, storage, use, modification, disclosure, archiving, and deletion of information.

**1. Public Authorities May Process Personal Data**

1. Public authorities are permitted to process personal data if it is necessary for the implementation of federal or cantonal law.

2. The processing of particularly sensitive personal data or profiling is permissible if

a) it is provided by law or required for a legally defined task, or

b) the data subject has already made the data generally accessible, or

c) the data subject has consented to the processing, or if consent cannot be obtained or can only be obtained with disproportionate effort, but the processing is in their interest.

3. The responsible authority must be able to demonstrate compliance with data protection provisions.

4. Personal data must be accurate as well as suitable and necessary for the fulfillment of the task. They must not be processed in bad faith.

1. Processing of personal data may be transferred if

a) there is a general-abstract or written contractual arrangement for it,

b) the mandate is clearly defined, and

c) compliance with legal requirements is ensured through appropriate measures.

2. The commissioning public body remains jointly responsible. Further delegation is only possible with its written consent.

1. Personal data may be processed for non-personal purposes, in particular for research, planning, and statistics, provided that

a) they are anonymized as soon as the purpose of the processing allows, and

b) the results are published in such a way that conclusions about the individuals concerned are not possible.

2. Personal data may also be disclosed to private parties for a non-personal purpose, provided they ensure compliance with the provisions of this regulation and maintain confidentiality.

1. If a data processing operation is likely to result in an increased risk to the personality or fundamental rights of the affected individual, the responsible body shall conduct a data protection impact assessment in advance.

2. This assessment shall include at a minimum

a) a general description of the planned processing operations,

b) an evaluation of the potential impact on the personality and fundamental rights of the affected individuals, and

c) a presentation and evaluation of the planned measures for the protection of the fundamental rights of the affected individuals, which are intended to reduce the risk of infringement of the personality and fundamental rights of the affected individuals.

1. Personal data must be adequately protected against unauthorized processing through technical and organizational measures.

2. The entity responsible for processing or having data processed is responsible for data protection and security.

3. If multiple entities process a shared data set, the primary responsibility lies with the owner of the data set. Each entity remains responsible for its own area.

1. Personal data that is no longer needed must be anonymized or deleted.

1. Personal data may only be collected from sources other than the individuals concerned under special circumstances.

1. Personal data may be collected in public places using technical devices for the protection of individuals and property, when

a) the surveillance is made clearly recognizable in an appropriate manner,

b) the stored personal data is deleted after a maximum of 100 days or, within this period, handed over to the law enforcement authorities through a criminal complaint, and

c) the data protection officer is informed about the surveillance.

2. The deployment of surveillance devices is ordered by the highest executive body of the corporation, institution, or entity that holds the right of use or authority over the place to be monitored.

1. The responsible authority informs the affected individuals about

a) the collection of personal data,

b) the legal basis,

c) the nature of the data,

d) the purpose of processing, and

e) their rights.

2. It discloses the parties involved in the data collection as well as any potential recipients of personal data.

3. The obligation to inform is waived if the processing of personal data is legally required, the affected individual already possesses the information, or providing the information would only be possible with disproportionate effort.

1. Personal data may be disclosed if and to the extent that the legal prerequisites for processing such data are met.

2. Non-sensitive data may also be disclosed to

a) public authorities, if this is indispensable for fulfilling a statutory duty, particularly for the exercise of a supervisory function;

b) private individuals, if they can credibly demonstrate a legitimate interest that outweighs confidentiality interests.

3. The Professional Commission may regulate what is necessary for the disclosure of data to public authorities.

1. **The Residents' Register Office may disclose the following personal data to private individuals upon request:**

a) Name, given name, date of birth, and address; in the case of relocation, also the new address;

b) Additional data, provided they are not particularly sensitive personal data and a legitimate interest is credibly demonstrated.

2. **If personal data is used exclusively for non-commercial purposes, it may be disclosed in an organized manner.**

3. **Personal data contained in publicly accessible official or officially approved publications may be disclosed to the extent and in the manner in which they are published.**

1. Personal data may be disclosed to public authorities abroad if adequate data protection is also guaranteed there.

2. In the absence of legislation that ensures adequate protection, disclosure is permitted if

a) sufficient alternative safeguards, particularly through contractual agreements, ensure adequate protection abroad; or

b) the data subject has consented in the individual case, or the data has been made generally and unconditionally accessible.

3. In individual cases, disclosure is permitted if it is essential for

a) safeguarding an overriding public interest,

b) the establishment, exercise, or enforcement of legal claims before a court, or

c) the protection of the life or physical integrity of the data subject.

1. The canton maintains a central public register of collections containing personal data.

2. The register includes

a) the designation of the data collection,

b) the categories of data subjects and their number,

c) the purpose of the collection and the legal basis,

d) the type of information,

e) the body responsible for the data collection,

f) the regular recipients of the personal data, and

g) the type of processing.

3. The registered data collections and any significant changes made to them must be regularly reported to the data protection officer.

1. Any person may request the blocking of certain personal data concerning them upon demonstrating a legitimate interest.

2. Despite an existing block, personal data may be disclosed, provided that the affected person has the opportunity to comment beforehand, if

a) there is a legal obligation to disclose,

b) the fulfillment of a task would otherwise be jeopardized, or

c) the receiving person credibly demonstrates that the data is necessary to enforce their legal claims, or a block was obtained abusively.

1. Any person may demand from the holder of a data collection that

a) incorrect personal data concerning them be corrected,

b) the unauthorized processing of personal data be ceased,

c) the unlawfulness of an unlawful processing be established,

d) the consequences of the unlawful processing be rectified, and

e) the corresponding data be deleted or blocked.

2. If the entity disputes the inaccuracy of the personal data, the burden of proving its accuracy lies with the entity. The affected person must cooperate in the clarification process within reasonable limits.

3. If neither the accuracy nor inaccuracy of personal data can be established, a note must be added to the corresponding data and processing should be restricted if necessary.

1. If processed personal data is unintentionally or unlawfully deleted, modified, disclosed, or made accessible to unauthorized persons, the responsible body shall report this to the Data Protection Officer.

2. In consultation with the Data Protection Officer, the report shall also be made to the affected individuals as well as to the recipients of the personal data.

3. A report may be waived if the incident does not endanger the fundamental rights of the affected individuals or if overriding public or private confidentiality interests exist. It may also be omitted for recipients of data if it is not possible or only possible with disproportionate effort.

4. The responsible body reports significant changes in personal data to the data processors; in turn, they must immediately report unauthorized processing of personal data to the responsible body.

1. The Standing Commission appoints a specialist in data protection matters as the Data Protection Officer, subject to approval by the Grand Council, for a term of four years. Reappointments are possible.

2. The Data Protection Officer is independent and not subject to directives.

3. The Grand Council has the authority to assign the function of the Data Protection Officer to an inter-cantonal or extra-cantonal data protection authority.

1. The Data Protection Officer shall have the following duties and powers

a) Monitoring developments relevant to the protection of personal data,

b) Conducting independent or sample reviews upon notification by affected individuals to ensure compliance with data protection regulations,

c) Raising awareness among the public, especially vulnerable individuals, concerning data protection,

d) Advising public authorities and affected individuals on data protection issues and providing recommendations for handling personal data,

e) Pre-assessment of processing methods that may violate the personality of a large number of individuals,

f) Handling supervisory notifications from affected individuals regarding data protection matters, with the requirement to inform about the results or status of inquiries within three months,

g) Providing opinions on decrees and projects and making recommendations concerning technical and organizational measures to ensure data protection, when they are significant for data protection,

h) Authority to challenge decisions in the area of data protection, lodge complaints, and file supervisory notifications against violations,

i) Cooperation with data protection authorities of other cantons, the federal government, and foreign entities to fulfill control tasks,

j) Submitting the annual budget, which is forwarded unchanged by the Executive Council to the Grand Council, and

k) Reporting annually to the Executive Council for the attention of the Grand Council.

2. The responsible authorities are obliged to provide the Data Protection Officer with information on data processing and grant access to their records.

3. If an authority does not follow recommendations, the Data Protection Officer may issue an order if the interest in enforcement is significant.

1. The responsible public body shall submit legislative projects concerning data protection and projects for the processing of personal data, which involve the risk of infringing fundamental rights, as well as data protection impact assessments, to the Data Protection Officer for prior consultation in a timely manner.

2. The Data Protection Officer may create a list of processing operations that must be submitted for prior consultation.

1. The public shall be informed about significant activities and matters of general interest in an appropriate manner, while striving to respect legitimate third-party interests.

2. Information is typically provided through public orientation meetings, official publications, media releases, or availability on the internet.

3. Information shall be withheld if it is prohibited by law or if overriding public or private interests oppose its disclosure.

4. Information on pending proceedings may be disclosed if necessary to correct or prevent false reports, or if warranted in particularly severe or sensational cases. Divergent provisions according to applicable procedural law are reserved.

1. Upon request, existing official documents can be accessed.

2. There is no entitlement for official data to be prepared for inspection.

1. No Right of Access to Official Documents Exists If

a) differing regulations in other decrees or overriding public or private interests oppose it,

b) it concerns tax files, or

c) it involves minutes of non-public sessions; sessions of public bodies are considered non-public unless they are explicitly declared as public.

2. No access is further granted to data that

a) is commercially utilized by an authority,

b) relates to negotiation positions,

c) is still under processing, for example in unfinished proceedings or in the preparation of decisions, or

d) is intended for personal use, namely working notes.

1. If predominant public or private interests can be adequately considered with reasonable effort through the anonymization of data or the removal of parts, a corresponding partial inspection or summary information shall be granted.

2. If conflicting interests cannot be adequately considered with reasonable effort otherwise, the inspection or information may be granted subject to conditions.

3. Corporations and institutions may grant the right of inspection in such a manner that a special interest must be demonstrated.

4. Further restrictions may also arise from the nature of the assignment or from special regulations, for example, in the medical field.

1. Public authorities may provide general information about official activities upon request, particularly regarding matters that have already been published.

2. The information is usually provided in the same format as the request.

3. There is no entitlement to the provision of the requested information.

1. Every individual has the right to request information about their personal data stored in a data file.

2. Access to this data shall be granted if the processing procedure permits it.

3. If access to personal data is likely to cause significant harm to the affected individual, access may be granted to a trusted person who will inform the affected individual in an appropriate manner.

4. Information and access may be restricted if substantial public or legitimate private interests necessitate such restrictions.

1. Requests for inspection or information must be submitted in writing and signed.

2. The documents for which inspection is requested should be described as precisely as possible, at least to the extent that they can be identified by the authority.

3. If inspection of large volumes of documents is desired, the public authority may require a restriction to documents related to a specific matter.

4. The requests are processed by the highest authority of the corporation, establishment, or institution. This authority may designate a different jurisdiction for processing.

5. Requests for general information may be made without a written application at the office with the appropriate subject-matter jurisdiction.

1. Inspection is customarily granted by

a) providing documents on-site,

b) delivering copies, or

c) electronic delivery.

2. There is no entitlement to a specific form of inspection.

1. If access to personal data or information or access to official documents is denied, a conciliation procedure can be requested from the Data Protection Officer within 30 days of the notification of the denial.

2. If the denial persists after the conclusion of the conciliation procedure, the public authority shall issue a decision upon simple written request.

1. Public authorities are obligated to ensure and systematically file official data, insofar as it is significant for the public, the transparency of governmental actions, or the preservation of cultural heritage.

2. They are obligated to offer the data to the State Archive.

1. Archival material is subject to a protection period of 30 years; if it contains particularly sensitive personal data, a protection period of 90 years applies.

2. During the protection period, the right of access to official documents applies mutatis mutandis, after which the archival material becomes public.

1. Data not transferred to the state archive must be retained for as long as they are relevant to fulfilling the public task.

2. Statutory retention periods are reserved.

1. The Statutes Commission shall regulate the further measures for archiving and may also establish the necessary provisions for storage.

2. It may deviate from the provisions of the section on data protection.

1. Fees for activities and services are levied according to the incurred labor and material expenses and the accrued cash outlays.

2. In the following cases, subject to abusive behavior and the reimbursement of cash outlays, no fees are charged

a) simple oral information;

b) information about and access to one's own data;

c) activities of the data protection officer.

3. The Grand Council regulates what is necessary; it may establish flat rates and provide reductions or exemptions from fees for special cases.

1. As far as this law does not provide for any other jurisdiction, the Great Council shall regulate what is necessary for the enforcement.

1. Ongoing procedural steps can be completed according to the existing law.

2. Legally acquired information, for which differing provisions apply under the new law, may be retained.

3. The right to access official documents applies to documents that were created or received by a public authority after the entry into force.

1. This law shall enter into force on January 1, 2020.