Data Protection Act (Datenschutzgesetz) - Purpose

1. This Act serves to protect the fundamental rights of individuals whose data is processed by public authorities.

1. Public Authority (Authority) refers to anyone who fulfills public duties of the canton, municipalities, or public law corporations and institutions.

2. Personal Data (Data) are details about a natural person or an association of persons (data subject), insofar as they are identified or identifiable.

3. Particularly sensitive personal data are data concerning

a) religious, ideological, or political views and activities,

b) the intimate sphere, health, ethnic origin, as well as genetic or biometric data,

c) proceedings and measures in the areas of child and adult protection, social assistance, and criminal law.

4. A Personality Profile is a compilation of data that allows the assessment of essential aspects of a natural person's personality.

5. Processing of personal data encompasses any handling of data, such as acquisition, storage, use, alteration, disclosure, or destruction.

5bis. Profiling is the automated processing of data to evaluate essential aspects of a natural person, in particular to analyze or predict their work performance, economic situation, health, personal preferences, interests, reliability, behavior, location, or change of location.

6. A Data Collection is a compilation of data that is accessible or can be made accessible based on the data subject.

1. This law applies, unless federal or special cantonal law takes precedence, to any processing of data, regardless of the means and procedures used.

2. All authorities are subject to the law, with the exception of those of ecclesiastical bodies; Articles 8 paragraph 3 and 15 remain reserved.

1. Authorities may process data when and as long as it is necessary for fulfilling a statutory duty.

2. Particularly sensitive data and personality profiles may only be processed if it is indispensable for a task clearly defined in a formal law. This applies mutatis mutandis to any profiling.

3. The data may not be processed in bad faith and only for the purpose specified at the time of collection, apparent from the circumstances, or prescribed by law.

4. Specific provisions regarding archival matters remain reserved.

1. Data Must Be Accurate.

1. The authority responsible for data protection is the one that processes or causes the data to be processed for the fulfillment of its duties.

2. If multiple authorities process data from a data collection, one authority must be designated to carry the primary responsibility.

1. The responsible authority is obliged to inform the affected individuals in an appropriate manner about the collection of data; the obligation to inform also exists if the data are collected from third parties.

2. The obligation to inform encompasses the information necessary to exercise the rights under this law. This includes at a minimum

a) the identity and contact details of the responsible authority;

b) the legal basis and the purpose of the data processing;

c) the categories of processed data;

d) the circle of recipients, if the data are disclosed;

e) the contact details of the data protection supervisory authority.

3. The obligation to inform does not apply if

a) the affected individual is already in possession of the respective information;

b) it is clearly evident from the legal basis for data processing which data are processed for which purpose;

c) the information requires disproportionate effort or other overriding public interests speak against it.

1. Prior to any systematic processing of personal data, the responsible body shall assess the risk of potential infringement of the fundamental rights of the affected individuals and limit such risk as much as possible and reasonable through technical and organizational measures.

2. If the risk of an infringement of fundamental rights is high, particularly based on the nature, scope, circumstances, or purpose of the processing, an impact assessment and the measures must be documented and submitted to the data protection supervisory authority for prior consultation.

3. The documentation shall at least include a general description of the planned processing activities, an assessment of the risks, and a depiction and evaluation of the measures.

1. Data may be disclosed to other bodies if

a) the responsible body is legally obligated or authorized to do so,

b) the recipient requires the data in the particular instance for the fulfillment of legal duties, or

c) the affected person has expressly consented or their consent can be presumed based on the circumstances.

2. Particularly sensitive data may only be disclosed if

a) the responsible body is obligated or authorized to do so based on a clear legal foundation,

b) the recipient requires the data in the particular instance for the fulfillment of a clearly defined legal duty, or

c) the affected person has expressly consented.

3. If the recipient is not subject to this law, the data may only be disclosed if it is ensured that the processing is carried out according to the principles of this law.

1. Data may be disclosed to private entities if

a) the responsible body is legally obligated or authorized to do so, or

b) the data subject has explicitly consented or their consent can be presumed under the circumstances.

2. Particularly sensitive data may only be disclosed if

a) the responsible body is obligated or authorized to do so based on a clear legal basis, or

b) the data subject has explicitly consented.

1. The residents' registry shall, upon request, disclose the name, first name, address, as well as the arrival and departure of a person to private individuals in individual cases.

2. It shall disclose the date of birth, marital status, place of citizenship, and profession in individual cases upon request, if the applicant credibly demonstrates a legitimate interest.

3. It may disclose these data in a systematically organized manner, provided it is ensured that they are used exclusively for legitimate non-commercial purposes and are not disclosed to third parties.

1. The data subject may request to block the disclosure of their data to third parties.

2. Disclosure is permissible despite the blocking if

a) the responsible body is legally obligated to do so, or

b) it is convincingly demonstrated in the application that the blocking was performed abusively.

1. Data may be disclosed in publicly accessible publications if

a) no legitimate interests of the affected person are impaired and they have not objected in advance to the publication after being informed beforehand, or

b) the responsible body is legally obligated or authorized to do so.

1. The disclosure of data may be restricted, subjected to conditions, or refused due to overriding public interests or the legitimate interests of the affected individual.

1. Personal data shall not be disclosed abroad if such disclosure would seriously endanger the personality of the persons concerned, particularly due to the absence of legislation ensuring adequate protection.

2. In the absence of legislation ensuring adequate protection, personal data may only be disclosed abroad if

a) sufficient guarantees, particularly by contract, ensure adequate protection abroad;

b) the person concerned has consented in the specific case;

c) the disclosure is essential in the specific case for safeguarding an overriding public interest or for the establishment, exercise, or enforcement of legal claims in court;

d) the disclosure is necessary in the specific case to protect the life or physical integrity of the person concerned;

e) the person concerned has made the data generally accessible and has not expressly prohibited processing.

1. The Authority may, notwithstanding Art. 4 para. 2 and 4 as well as Art. 8 to 11, process data for a non-personal purpose, namely for statistics, planning, and research, if

a) the data is anonymized as soon as the processing status permits, and

b) the results of the processing are disclosed in such a manner that inferences about the individual concerned are not possible.

1. Data processing may be delegated to a third party, provided no statutory or contractual provision dictates otherwise. The third party may only process the data in the manner that the commissioning body itself would be permitted to do.

2. Prior to the delegation, the commissioning body must ascertain that the third party is capable of ensuring data security. It ensures data protection through requirements, agreements, or other means.

3. Any further delegation by the third party requires prior written consent from the commissioning body.

1. Anyone who processes data must secure it through technical and organizational measures against loss, theft, as well as unauthorized access and processing.

1. If a data security breach results in data being lost, destroyed, altered, or accessed by unauthorized persons, the responsible body shall immediately report this to the data protection supervisory authority and inform any co-affected data recipients. If there is no risk of an impairment to fundamental rights, the reporting obligation is waived.

2. The responsible body shall, in consultation with the data protection supervisory authority, inform the affected person if it is necessary for their protection or otherwise deemed necessary to safeguard fundamental rights.

3. The information to the affected person may be restricted or omitted if public or private confidentiality interests prevail.

4. If the data security breach occurs during processing by a third party, that party must immediately notify the commissioning body. The commissioning body must then proceed according to paragraphs 1 to 3.

1. The bodies annually review their data. Data that is no longer needed shall be offered to the competent archive for archiving. If the archive, in accordance with the provisions of the archival system, decides not to preserve the data, the data must be destroyed within one year.

1. The canton, municipalities, and public law corporations and institutions shall each maintain a central register of their data collections.

2. The canton bodies shall maintain a register of the data collections existing within their area of responsibility.

3. The registers are public and contain, for each data collection, information regarding

a) the type and origin of the data,

b) the legal basis, purpose, and means of processing,

c) the responsible body,

d) the regular recipients of the data or copies thereof, and

e) the access authorization for data collections.

4. An indication of the public nature of the central registers of the canton and municipalities, as well as the location where they can be accessed, shall be published annually by the bodies in their official publication organs.

1. Data collections are not registered if they

a) are not intended to be permanent,

b) are only copies or processing tools, or

c) are used exclusively by individuals as personal working tools.

1. Every person may inspect the registers of data collections.

1. The responsible authority shall provide any person with information about the data being processed about them in a specific data collection and grant them access to this data.

2. Anyone requesting information or access must provide proof of their identity.

3. Information shall be provided in an easily understandable form and, upon request, in writing.

1. Information and access may be restricted or denied if overriding public interests or legitimate interests of a third party necessitate it.

2. If providing information to the affected person could cause them significant harm, it may be given to an authorized representative.

3. The restriction or denial of information and access must be justified.

**1. The Data Subject and any other person who credibly demonstrates a legitimate interest may request the correction of incorrect data.**

2. If the authority disputes the inaccuracy of the data, it is responsible for proving the accuracy. The data subject shall participate in the clarification to the extent reasonable.

3. If neither the accuracy nor the inaccuracy can be proven, the authority shall make an appropriate note on the data.

1. The affected person and anyone else who can credibly demonstrate a legitimate interest may request that

a) the unlawful processing of data be ceased,

b) unlawfully collected, stored, or used data be destroyed, or that the consequences of unlawful processing be otherwise remedied, or

c) the unlawfulness of a processing be established.

1. The responsible authority shall decide on applications pursuant to Articles 21 to 24. The decisions are to be delivered to the Data Protection Supervisory Body. Affected data recipients must be informed of corrections and other measures.

2. Procedures and legal protection are governed by the Administrative Procedure Act. The Data Protection Supervisory Body is entitled to file legal remedies.

3-4

1. The Cantonal Council shall elect an expert in data protection matters as an independent and non-subordinate cantonal data protection supervisory body. The election is for a term of office lasting four years; re-election is permitted.

1bis. The data protection supervisory body shall not engage in any other public or private activity that could compromise the independence or reputation of the office.

2. The cantonal data protection supervisory body oversees the application of this law by the canton, the municipalities, and public corporations and institutions. The costs are borne by the canton.

2bis. The Cantonal Council shall regulate the remuneration of the data protection supervisory body through a performance agreement. It may, instead of a performance agreement, provide for subordination under the canton’s personnel law; the independence of the data protection supervisory body must not be compromised by this.

3. The Cantonal Council is authorized to assign the duties of the data protection supervisory body to an inter-cantonal data protection office.

1. The Data Protection Supervisory Authority

a) monitors compliance with data protection regulations,

b) * informs the public about data protection and advises affected individuals about their rights,

c) * handles complaints concerning the violation of data protection regulations,

d) * advises public authorities on data protection issues and may issue general recommendations on the handling of personal data,

e) * conducts prior reviews of processing methods when there is a high risk of infringing fundamental rights,

ebis) * provides opinions on enactments that are significant for data protection,

f) * collaborates with supervisory authorities of other cantons, the federal government, and foreign countries to fulfill supervisory tasks and observes technical and legal developments relevant to the protection of personal data,

g) * determines the necessary human and material resources and requests the necessary credits from the Cantonal Council as part of the budget,

h) * submits an annual report to the Cantonal Council on its activities.

2-4

...

1. The Data Protection Supervisory Authority initiates an investigation ex officio or upon notification if there are indications of a violation of data protection regulations. It may provisionally prohibit or restrict data processing for the duration of the investigation.

2. The responsible bodies and their representatives are obliged to provide information to the Data Protection Supervisory Authority and grant it access to all documents and data necessary for the investigation. The Data Protection Supervisory Authority may request demonstrations of data processing activities and seek information from recipients of data.

3. The Data Protection Supervisory Authority informs the notifier about the result or status of the investigation within three months.

1. If the data protection supervisory authority identifies a significant breach of data protection regulations, it shall make a binding decision on appropriate remedial measures and set a reasonable deadline for the responsible entity to implement them. It may, in particular, order that personal data be deleted or destroyed, or that data processing activities be adjusted or terminated.

2. The data protection supervisory authority informs the supervisory body of the responsible entity about the ordered remedial measures.

3. Decisions regarding remedial measures can be appealed to the Superior Court in accordance with the Administrative Procedure Act (VRPG).

1. The provision of information, access to records, correction, and blocking of data are free of charge.

2. A fee may be charged if

a) the processing of a request requires a disproportionate amount of effort, or

b) the request was made frivolously.

3. The application of special fee rates for other activities remains reserved.

1. The municipalities and public-law corporations and institutions must establish their central registers no later than one year after the entry into force of this law.

1. Upon effect, Article 9 of the Ordinance on the Establishment and Residence of Swiss Nationals shall be repealed.

2. This law is subject to an optional referendum.

3. The government council shall determine the commencement date.