Purpose (KDSG)

1. This law is intended to protect individuals from abusive data processing by authorities.

1. Personal data refers to information about an identified or identifiable natural or legal person.

2. A data collection is considered to be any set of personal data that is structured so that the information is accessible according to the individuals concerned.

3. A register under the meaning of Article 18 is a directory of data collections.

4. The processing of personal data encompasses any handling of personal data, such as obtaining, storing, modifying, linking, disclosing, or destroying.

5. Disclosure constitutes any act of making personal data accessible, such as granting access, providing information, transferring, or publishing.

6. Authorities under the meaning of this law are

a. Offices of the canton and municipalities with their employees,

b. Bodies of corporations and institutions as well as private entities, insofar as they are entrusted with public tasks,

c. Bodies of the national churches and their regional units.

7. Supervisory bodies under the meaning of this law are

a. The cantonal supervisory authority pursuant to Article 32,

b. The bodies designated by municipalities, municipal statutory bodies, as well as by the national churches and their regional units in accordance with Article 33 paragraph 1.

1. Particularly sensitive personal data includes information about

a) religious, philosophical, or political beliefs, affiliations and activities, as well as racial origin;

b) the personal private sphere, particularly the mental, spiritual, or physical condition;

c) measures of social assistance or welfare support;

d) police investigations, criminal proceedings, offenses, and the penalties or measures imposed for them.

1. This law applies to any processing of personal data by authorities.

2. It does not apply

a) when an authority is in economic competition with private individuals and does not act in a sovereign capacity. However, supervision is governed by Articles 32-37;

b) when an employee of an authority processes personal data for exclusively personal use, particularly to maintain a personal working tool;

c) * to pending civil or criminal law proceedings, to pending administrative law proceedings with the exception of administrative procedures, and to investigations by a parliamentary inquiry commission.

Personal data may only be processed if the law expressly authorizes it or if the processing serves the fulfillment of a legal duty.

The purpose of the processing must be specified.

The personal data and the manner of processing must be suitable and necessary for fulfilling the duty.

Personal data may not be processed for a purpose that is incompatible with the principles of good faith, for which they were originally obtained or disclosed to the authority. Articles 10, 12, and 15 are reserved.

Official confidentiality obligations or special secrecy obligations remain reserved.

1. Processing of Particularly Sensitive Personal Data

Particularly sensitive personal data may only be processed if, in addition,

a. the permissibility is clearly derived from a legal basis, or

b. the fulfillment of a legal obligation requires it imperatively, or

c. the affected person has given explicit consent.

1. Personal data must be accurate and, insofar as required by the purpose of processing, also complete.

1. The authority responsible for data protection is the one that processes or has processed personal data in order to perform its legal duties.

2. If multiple authorities process personal data in a data collection, one must be designated to ensure overall data protection. Each authority remains responsible for their respective area.

1. Personal data must generally be obtained from the affected person and not from another private individual.

2. The procurement of data within the administration is permissible if this law does not prohibit it.

3. If there is no legal obligation to provide information, the voluntary nature of the information must be indicated.

4. The legal basis and the purpose of the processing must be communicated to the individuals concerned when

a) they request it, or

b) personal data is systematically collected, particularly by means of questionnaires.

1. Personal data will be disclosed to another authority when

a. the responsible authority is legally obligated or authorized to fulfill its duties, or

b. the authority requesting the personal data demonstrates that it is legally authorized to process the data and there is no obligation of confidentiality conflicting with this, or

c. despite the incompatibility of purposes, the affected person has expressly consented or it is in their interest.

2. The resident registration office grants access to the register of residents and non-resident stayers for official purposes and provides information.

1. Personal data may be disclosed to private individuals if

a) the responsible authority is legally obliged or authorized to fulfill its duties, or

b) the data subject has explicitly consented or it is in their interest.

2. Personal data contained in a publicly accessible official or officially approved publication may be disclosed upon request to the extent and in the order in which they are published.

3. The government council regulates the disclosure of personal data for directories and similar reference works of general interest or with long-standing tradition.

1. The residents' register shall disclose to a private individual, upon request, the name, first name, gender, address, marital status, place of origin, date of arrival and departure, and year of birth of an individual, if the applicant demonstrates a legitimate interest.

2. Under the same conditions, the municipal regulations may also permit the disclosure of the title and language of an individual.

3. The municipal regulations may allow the systematic disclosure of the data according to paragraph 1 in a general manner or for specified purposes.

1. Any affected person may request to block the disclosure of their data if they demonstrate a legitimate interest.

2. Disclosure is permissible despite the block if

a. the responsible authority is legally obligated to disclose, or

b. the affected person is acting in an abusive manner.

3. The affected person may block data as per Article 12, paragraph 2, and the systematic disclosure of data as per Article 12, paragraph 3 without demonstrating a legitimate interest.

1. The disclosure of personal data may be refused, restricted, or subject to conditions if there are overriding public interests or especially protected private interests.

2. If personal data is subject to special confidentiality regulations, it may only be disclosed if the recipient is subject to a corresponding confidentiality obligation.

1. Personal data may not be disclosed abroad if such disclosure would seriously endanger the personality of the individuals concerned, particularly because of the absence of legislation ensuring adequate protection.

2. Despite the absence of legislation ensuring adequate protection, personal data may be disclosed abroad if

a) adequate safeguards, particularly through a contract, ensure adequate protection abroad,

b) the individual concerned has consented in a specific case,

c) the processing is directly related to the conclusion or performance of a contract and involves the personal data of the contracting party,

d) the disclosure in the specific case is either essential for safeguarding an overriding public interest or for the establishment, exercise, or enforcement of legal claims in court,

e) the disclosure in a specific case is necessary to protect the life or physical integrity of the individual concerned, or

f) the disclosure takes place within the same legal entity or company, or between legal entities or companies under common control, provided that the parties are subject to data protection rules ensuring adequate protection.

3. The supervisory authority must be informed in a timely manner about the safeguards under paragraph 2 letter a before personal data is disclosed abroad.

1. A responsible authority may process personal data for a non-personal purpose, namely for research, practical training, statistics, or planning, if it

a) anonymizes the personal data as soon as the processing purpose allows, or at least uses it without direct personal identification, and

b) discloses the results of the processing in such a way that the individuals concerned cannot be identified.

2. The responsible authority may disclose personal data for processing for non-personal purposes if assurance is provided that the recipient

a) meets the requirements set forth in paragraph 1,

b) does not pass on the personal data to third parties, and

c) ensures data security.

1. Any person who processes personal data on behalf of an authority is subject to the law as is the principal. Disclosure of personal data to third parties requires the express consent of the principal.

1. Anyone who processes personal data must ensure its security.

1. If an authority intends to process personal data of a large number of individuals electronically, it must submit the intended data processing to the supervisory authority for an opinion before it begins if

a. there is doubt about the existence of a sufficient legal basis,

b. particularly sensitive personal data are to be processed,

c. a special confidentiality obligation exists, or

d. technical means with particular risks to the rights and freedoms of the affected individuals are used.

2. The authority must also submit significant changes to such data processing to the supervisory authority.

3. Upon request from the responsible authority, the supervisory authority shall provide a recommendation within the scope of the preliminary inspection as per Article 35 paragraph 3.

1. The oversight authority shall publish on the internet a register of data collections established in the canton, in the municipality, or in another municipal legal entity, as well as in the national church or its regional entity.

2. The register shall include, for each data collection, the information on

a. the legal basis;

b. the responsible authorities;

c. the purpose and means of processing;

d. the type and scope of the processed personal data;

e. the personal data regularly disclosed to other authorities or private persons, as well as the recipients;

f. the standard retention period of the personal data.

3. Data collections that shall not be included in the register are those that

a. are maintained only for a short term or

b. are lawfully published.

4. The responsible authority shall prepare the part of the register concerning their data collections according to the specifications of the oversight authority and maintain it accordingly.

5. The municipalities and other municipal legal entities, as well as the national churches and their regional entities, may

a. regulate the responsibility for the preparation and maintenance of the register differently from Paragraph 4;

b. refrain from publishing the register on the internet.

1. Data that is no longer needed must be destroyed.

2. The responsible authority shall determine for each data collection when the personal data is to be destroyed.

3. Personal data may only be retained beyond this time if they

a. serve security or evidentiary purposes;

b. are of significance for scientific research.

4. Special retention regulations and the provisions concerning public archives remain reserved.

Every individual has the right to examine the register of data collections.

**1. Right to Information**

Any person may request information from the responsible authority about what data concerning them is being processed in a data collection. They must provide proof of their identity.

This right cannot be waived in advance.

The information is provided in an easily understandable form and, upon request, in writing.

The person concerned shall, upon request, be granted access to their data unless there are important and overriding public interests or particularly worthy interests of third parties that oppose such access.

1. The disclosure may be refused or postponed to the extent that a law requires it or particularly worthy interests of third parties necessitate it.

2. If the disclosure cannot be provided to the applicant themselves because it would unduly burden them, it may be given to a person they trust.

1. Every person has the right to have incorrect or unnecessary personal data about them corrected or destroyed.

2. If the responsible authority denies the incorrectness, it must prove the accuracy of the personal data. The affected person must cooperate within reasonable limits in the clarification process.

3. If neither the correctness nor the incorrectness of personal data, particularly those containing an assessment of human behavior, can be proven, the affected person may request that an appropriate counterstatement be recorded.

1. Every individual has the right to have personal data that has been unlawfully processed destroyed or otherwise remedied to remove the consequences of the illegality.

2. If the affected individual demonstrates a legitimate interest, the decision must be disclosed to the authorities and third parties designated by them.

1. Liability for damages caused to individuals by the unlawful processing of personal data by their authorities, bodies, employees, and agents rests with

a) the canton,

b) the municipalities,

c) corporations, institutions, and private individuals, insofar as they are entrusted with public tasks,

d) the national churches and their regional units.

2. If justified by the severity of the violation and if it cannot be otherwise remedied, there is an entitlement to compensation for moral damages.

3. If the damage was caused intentionally or with gross negligence, the person obligated to provide compensation has the right of recourse.

1. Unless otherwise specified by this law, the provisions of the procedural rules applicable to the respective legal area shall apply to the procedure and legal protection.

1. Appealable are the decisions of the responsible authority, in particular rulings on requests pursuant to Articles 21-24, as well as their refusal and delay.

Authorities whose requests are rejected are also entitled to lodge a complaint.

No fees shall be charged for the inspection and information pursuant to Articles 20 and 21.

1. The Grand Council shall, upon the proposal of the Council of State, appoint a Commissioner for Data Protection to serve as the head of the cantonal supervisory authority. It shall ensure that the Commissioner for Data Protection is proficient in both official languages.

2. The term of office for the Commissioner is four years.

3. The cantonal supervisory authority is administratively assigned to the Department of the Interior and Justice.

1. Municipalities and other municipal legal entities, as well as the state churches and their regional units, shall designate their own supervisory authority for their respective areas.

2. The cantonal supervisory authority shall exercise supreme oversight.

1. The supervisory authority shall perform the duties under this law autonomously and independently. It is bound only by the constitution and the law.

2. The financial management, expenditures and expenditure approvals, as well as the management of finances and services of the cantonal supervisory authority, are subject to the financial budget legislation, unless this law contains specific provisions.

3. The cantonal supervisory authority shall annually set its performance targets and derive its resource needs therefrom. It shall prepare the task and financial plan and the budget estimate for its area, determining the products and product groups. The government council shall incorporate these unchanged into the task and financial plan and budget estimate of the canton. It may comment on them for the benefit of the grand council.

4. The cantonal supervisory authority decides on the employment of personnel within the framework of the resources approved with the budget estimate. It gives final approval to the ongoing operating expenditures within the scope of the budget estimate. The ordinary expenditure powers apply to investments.

5. The supervisory authorities of the municipalities and other community law corporations, as well as the national churches and their regional entities, must have sufficient independent expenditure powers which may not be restricted by orders from other authorities.

1. The cantonal data protection supervisory authority maintains a special account in accordance with Article 55 of the Financial Budget Act of June 15, 2022 (FHG)[2].

2. Contrary to Article 55 paragraph 2 of the FHG, the Grand Council regulates the manner of accounting by decree.

1. The Supervisory Authority

a) maintains the register of data collections in accordance with Article 18;

b) monitors the application of data protection regulations;

c) conducts prior checks according to Article 17a;

d) treats submissions from affected individuals regarding violations of this law's provisions as regulatory notifications;

e) advises affected individuals on their rights;

f) mediates between affected individuals and responsible authorities;

g) advises the responsible authorities on data protection issues and makes suggestions for improvements;

h) monitors data security;

i) safeguards the interests of individuals who receive limited or no information;

k) provides opinions on drafts of regulations and other measures, insofar as they are significant for data protection;

l) submits opinions on data protection issues to decision-making and appellate authorities upon request;

m) periodically informs the public about its activities;

n) collaborates with other supervisory authorities in Canton Bern as well as with those of other cantons, the federal government, and abroad, ensuring the exchange of relevant information.

2. If rights under Section IV of this law are allowed to be restricted according to specific legislation, the Supervisory Authority informs the affected individuals about the review conducted based on submissions under paragraph 1 letter d, even if the affected individuals do not request it.

1. The responsible authorities are obligated to assist the supervisory body in the fulfillment of its duties.

2. The supervisory body may obtain written or oral information from authorities, notwithstanding any confidentiality obligations. It may inspect all documents related to specific processes, conduct inspections, and have processes demonstrated.

3. It recommends the elimination of violations and deficiencies in the form of a request accompanied by a statement of reasons.

4. If the responsible authority does not or only partially complies with the request of the supervisory body under paragraph 3, it must issue a corresponding order or decision within 30 days.

5. The supervisory body may challenge the order or decision pursuant to paragraph 4. Procedures and jurisdiction are governed by Article 26.

6. If the legitimate interests of an affected person are obviously endangered or violated, the supervisory body requests the responsible authority or its superior authority to take the necessary measures immediately.

1. The supervisory authority is bound by the same duty of confidentiality regarding personal data as the authority that processes them.

2. Furthermore, it is obliged to maintain confidentiality if the nature of the matter or specific regulations require secrecy.

The cantonal supervisory authority can cooperate with data protection supervisory bodies of other public-law entities to fulfill its tasks in accordance with Article 34.

The nature and scope of the cooperation shall be defined in a written agreement. The data protection officer is responsible for signing this agreement.

Data protection supervisory bodies of other public-law entities may perform data protection supervision tasks in the Canton of Bern, as far as this is agreed upon.

The cantonal supervisory authority may perform data protection supervision tasks in other public-law entities, as far as this is agreed upon.

1. The cantonal supervisory authority shall annually submit a report on its activities to the Grand Council and the Executive Council. In this report, it shall specifically point out identified deficiencies and desirable changes.

2. In cases of general interest, the cantonal supervisory authority shall inform the public after briefing the responsible director or the state secretary.

3. Municipalities and other municipal legal entities, as well as the national churches and their regional units, shall regulate the reporting of their supervisory authorities.

1. The Government Council shall enact the provisions necessary for the implementation of this law. It may

a) authorize the directorates to issue such provisions insofar as the subject of regulation is of a highly technical nature, subject to rapidly changing conditions, or of minor importance;

b) authorize the competent authority of the Finance Directorate to issue administrative regulations.

1. The governing council determines when this law shall come into effect. It may bring certain provisions into effect early, particularly the regulations concerning supervision.