Purpose (PDSG)

1. This Law Aims to

a. ensure the efficient centralized processing of personal data,

b. establish, standardize, and operate centralized personal data collections,

c. maintain accurate, complete, secure, and consistent handling of personal data according to their content and intended use,

d. harmonize personal data.

2. It thus serves as the foundation for electronic administrative management within the framework of the statutory duties of the canton authorities.

1. The data, data categories, and functionalities according to Article 5 paragraph 4 are

a. Religion,

b. Information about the personal private sphere, particularly the psychological, intellectual, and physical condition,

c. Identity and document restrictions according to Article 237 paragraph 2 letter b of the Swiss Code of Criminal Procedure (StPO),

d. Information on child and adult protection,

e. Information about the household,

f. Functionalities pursuant to Article 7 paragraph 1 letter h.

2. In fulfilling the tasks according to the following laws, the processing of the listed data, data categories, and functionalities is permissible, provided that proportionality is maintained (Art. 5 para. 3 KDSG)

| No. | Law | Data, Data Categories, and Functionalities (Paragraph 1) |

| --- | --- | --- |

| I. | Federal Laws | |

| 1. | Swiss Civil Procedure Code (Civil Procedure Code, ZPO; SR 272) | a, d, e, f |

| 2. | Swiss Code of Criminal Procedure (Code of Criminal Procedure, StPO; SR 312.0) | a, c, d, e, f |

| 3. | Swiss Juvenile Criminal Procedure Code (Juvenile Criminal Procedure Code, JStPO; SR 312.1) | a, c, d, e, f |

| 4. | Federal Act on the Army and the Military Administration (Military Act, MG; SR 510.10) | c, d, e, f |

| 5. | Federal Act on Civil Protection and Civil Defense (Civil Protection and Civil Defense Act, BZG; SR 520.1) | d, e, f |

| 6. | Federal Act on the Substitute Military Duty Fee (WPEG; SR 661) | c, d |

| 7. | Federal Act on the Registration of Cancer Diseases (Cancer Registration Act, KRG; SR 818.33) | d, f |

| 8. | Federal Act on Invalidity Insurance (IVG; SR 831.20) | d, f |

| 9. | Federal Act on Health Insurance (KVG; SR 832.10) | d, f |

| 10. | Federal Act on Accident Insurance (UVG; SR 832.20) | d, f |

| II. | Laws from the Canton of Bern | |

| 1. | Law on Cantonal and Municipal Citizenship (Cantonal Citizenship Law, KBüG; BSG 121.1) | c, d, e, f |

| 2. | Law on the Settlement and Residence of Swiss Nationals (NAG; BSG122.11) | a, c, d, e, f |

| 3. | Law on Political Rights (PRG; BSG 141.1) | f |

| 4. | Law on the Government Officials (RStG; BSG 152.321) | d, e, f |

| 5. | Personnel Law (PG; BSG 153.01) | a, b, d, f |

| 6. | Law on the Organization of the Judicial Authorities and the Public Prosecutor's Office (GSOG; BSG 161.1) | a, c, d, e, f |

| 7. | Law regarding the Introduction of the Swiss Civil Code (EG ZGB; BSG 211.1) | d, e, f |

| 8. | Law on Child and Adult Protection (KESG; BSG 213.316) | b, d, e, f |

| 9. | Introductory Law to the Federal Act of December 16, 1983, on the Acquisition of Real Estate by Persons Abroad (EG BewG; BSG 215.126.1) | d, e, f |

| 10. | ... **\*** | ... **\*** |

| 11. | Cantonal Geoinformation Law (KGeolG; BSG 215.341) | f |

| 12. | Introductory Law to the Civil Procedure Code, Code of Criminal Procedure and Juvenile Criminal Procedure Code (EG ZSJ; BSG 271.1) | a, c, d, e, f |

| 13. | Law on Justice Execution (Justice Execution Law, JVG; BSG 341.1) | c, d, e, f |

| 14. | Law on Bernese National Churches (National Church Law, LKG; BSG 410.11) | a, d, f |

| 15. | Primary School Law (VSG; BSG 432.210) | d, e, f |

| 16. | Secondary School Law (MiSG; BSG 433.12) | d, e |

| 17. | Law on Vocational Training, Continuing Education, and Vocational Guidance (BerG; BSG 435.11) | d, e |

| 18. | Law on Training Contributions (ABG; BSG 438.31) | d |

| 19. | Cantonal Civil Protection and Civil Defense Law (KBZG; BSG 521.1) | d, f |

| 20. | Police Law (PolG; BSG 551.1) | c, d, e, f |

| 21. | ... **\*** | ... **\*** |

| 22. | ... **\*** | ... **\*** |

| 23. | Tax Law (StG; BSG 661.11) | a, c, d, e, f |

| 24. | Law on Lake and River Banks (Lake and River Banks Law, SFG; BSG 704.1) | f |

| 25. | Building Law (BauG; BSG 721.0) | f |

| 26. | Road Law (SG; BSG 732.11) | f |

| 27. | Law on Water Maintenance and Water Construction (Water Construction Law, WBG; BSG 751.11) | f |

| 28. | Hospital Supply Law (SpVG; BSG 812.11) | d, f |

| 29. | Cantonal Water Protection Law (KGSchG; BSG 821.0) | f |

| 30. | Law on Waste (Waste Law, AbfG; BSG 822.1) | f |

| 31. | Law on Family Allowances (KFamZG; BSG 832.71) | d, f |

| 32. | Introductory Law to the Federal Act on Old-age and Survivors' Insurance (EG AHVG; BSG 841.11) | d, f |

| 33. | ... **\*** | ... **\*** |

| 34. | Law concerning the Introduction of the Federal Acts on Health, Accident, and Military Insurance (EG KUMV; BSG 842.11) | d, e, f |

| 35. | ... **\*** | ... **\*** |

| 36. | Fire Protection and Fire Services Law (FFG; BSG 871.11) | d, e, f |

| 37. | ... **\*** | ... **\*** |

| 38. | Dog Law (BSG 916.31) | d, e |

| 39. | Law on Hunting and Wildlife Protection (JWG; BSG 922.11) | f |

| 40. | Catering Establishment Law (GGG; BSG 935.11) | d, e, f |

| 41. | Introductory Law to the Foreign Nationals and Integration Act as well as to the Asylum Act (EG AIG and AsylG; BSG 122.20) | c, d, e, f |

1. This law applies to the authorities referred to in Article 2, Paragraph 6 of the Data Protection Act of February 19, 1986 (KDSG)[3].

1. This Act regulates

a. the processing of data of natural or legal persons in central personal data collections,

b. the implementation of the RHG.

1. In this law, the following terms mean

a Collection of Personal Data: A data collection as per Article 2, Paragraph 2 of the KDSG;

b Central Collection of Personal Data: An electronic collection of personal data that enables the processing of personal data by multiple authorities and is referred to as a central collection of personal data;

c Attribute: A characteristic of a person that can be objectively recorded and described (Art. 3, Letter f, RHG);

d Basic Profile: A designated group of attributes that do not contain particularly sensitive personal data, do not allow profiling according to the relevant legislation, and whose disclosure is not restricted under Article 14 KDSG, such as name, first names, and correspondence language;

e Standard Profile: A designated group of attributes that may also contain particularly sensitive personal data;

f Functionality: A special type of data processing that is possible with the software of the data collection, such as the combination of different personal data, the determination of the geographical, temporal, or subject scope of the data collection, or the granting of processing rights;

g User Account: An authorization designated for an individual or a system to access a collection of personal data;

h Retrieval Procedure: Data acquisition from central collections of personal data via internet access;

i Notification Procedure: Data disclosure via notification through the central IT and communication platform of the federal government (Sedex).

1. The canton maintains central personal data collections that are available to authorities for the fulfillment of their legal duties.

2. A central personal data collection contains those features that are required and may be processed by multiple authorities to fulfill their legal duties under the specific legislation of the Federal and Cantonal government.

3. Authorities entrusted with the execution of specific legislation may process in central personal data collections those personal data, via retrieval or reporting procedures, that they need to fulfill their legal duties.

4. To the extent strictly necessary for fulfilling their legal duties, authorities may also process particularly sensitive personal data in central personal data collections. Appendix 1 specifies the individual data, data categories, and functionalities, and assigns them to the relevant legislation.

1. A central personal data repository contains a basic profile and as many standard profiles and functionalities as necessary.

1. The Government Council shall designate the central personal data collections by decree and regulate the following

a) the purpose of the personal data collection;

b) the authority responsible for the personal data collection within a directorate, the state chancellery, or the judiciary;

c) the personal data contained in the data collection;

d) the spatial and temporal data scope;

e) the particularly sensitive personal data;

f) the basic profile;

g) the standard profiles;

h) the functionalities that enable profiling or otherwise generate particularly sensitive personal data;

i) the authorities that are authorized to access the data despite restrictions on data disclosure according to Article 14 KDSG based on special legislation;

k) the timing and further modalities for the destruction of personal data;

l) the special requirements for information security and data protection;

m) the further technical, organizational, and financial details;

n) any restrictions on the processing of personal data collections.

1. The government council shall regulate by ordinance the entitlement to access central collections of personal data.

2. It may stipulate that

a) the directorates, the state chancellery, and the judiciary shall govern the access rights of their subordinate organizational units as well as other entities carrying out public duties within their areas of responsibility by means of directorate ordinances or regulations,

b) the authorities under the Municipal Law of March 16, 1998 (GG) and the Law of March 21, 2018, on the Bernese National Churches (National Church Law, LKG) shall regulate the access rights of their subordinate organizational units and supervised other entities carrying out public duties by ordinance.

1. Whoever issues authorization rules according to Article 8

a. shall only allow access to central personal data collections if there is an adequate legal basis for data processing in accordance with data protection legislation;

b. ensures that the authorized authorities only have access to those personal data, functionalities, and access rights which they require to fulfill their legal duties, and guarantees compliance with information security and data protection regulations.

The Government Council may stipulate that basic profiles are available to all authorities that require this personal data to fulfill their legal duties.

**Article 1: Submission of Authorization Rules and Publication of Regulations**

Whoever establishes authorization rules under Article 8 must submit them beforehand to the competent data protection supervisory authority for comment (Art. 34 para. 1 lit. k KDSG). The comment may be made in the form of a reasoned application (Art. 35 para. 3 KDSG).

The organizational unit responsible for a central personal data collection ensures that user accounts are managed according to the authorization rules.

It publishes the regulations of the authorities according to GG and LKG on the Internet, after the publication has been carried out according to the provisions of the municipal legislation.

1. The authorities of the canton use the insurance number according to AHVG as the personal identification number, the company or another federal identification number, provided that the conditions of federal legislation are met.

2. The Government Council may provide for its own identification number for natural and legal persons within the canton by issuing an ordinance.

1. The authority responsible under specific legislation for the collection and updating of personal data is accountable for the accuracy and completeness of the corresponding attributes in the central personal data collections.

2. The government council may provide that the right of access according to Article 21, Paragraph 4 of the Data Protection Act (KDSG) to central personal data collections can be exercised directly and electronically by the affected individual.

1. Every authority that operates a central personal data collection, accesses such a collection, or processes personal data in any other way, is responsible within its domain for information security and data protection in accordance with data protection and specific legislation.

**Article 13 KDSG: Information and Address Blockages and Article 14 KDSG: Restrictions on Data Disclosure**

Information and address blockages according to Article 13 KDSG, as well as restrictions on data disclosure according to Article 14 KDSG, must be implemented in the central personal data collections.

The affected person can have blockages or restrictions on data disclosure made or removed by the competent authority.

1. Personal data that, according to the determination of the responsible authority under Article 13, may no longer be maintained in the central personal data collections must be destroyed in accordance with the deadlines set forth in the special legislation and the ordinances of the government council for the relevant central personal data collection.

1. The government council shall regulate whether and according to which criteria the expenses incurred due to the unlawful collection or alteration of personal data will be charged to the responsible organizational unit operating the system by those responsible for the actions.

2. It shall regulate the allocation of costs for the use of information technology and telecommunications resources of the cantonal administration.

3. It may stipulate that fees are charged for the provision of personal data to authorities outside the central cantonal administration, provided that the personal data is also used commercially.

1. The canton maintains a central personal data collection to fulfill the tasks according to the RHG, as well as the Law of September 12, 1985, on the Settlement and Residence of Swiss Nationals (NAG)[[7]].

2. The central personal data collection particularly includes the following specially protected personal data

a. Denomination,

b. Information about the personal confidential sphere, particularly the mental, intellectual, and physical condition,

c. Document and records embargo according to Article 237 paragraph 2 letter b of the Swiss Code of Criminal Procedure of October 5, 2007 (Criminal Procedure Code, CrimPC)[[8]],

d. Information regarding child and adult protection,

e. Information about the household,

f. Functionalities according to Article 7 paragraph 1 letter h.

3. It also serves the authorities in further fulfilling their statutory tasks.

1. The municipalities maintain the resident register, including the foreigner control, as well as the electoral register electronically.

2. The government council may, by regulation, make hardware and software available to the municipalities for this purpose or provide for technical or financial support in maintaining the registers.

1. The municipalities shall continuously transmit the personal data from their resident registers to the central personal data collection as per Article 18, paragraph 1.

2. The governing council shall designate a secure transmission platform through which the data delivery must take place.

3. It shall regulate the additional technical, organizational, and financial details by ordinance.

1. The authority designated by the Executive Council ensures that the personal data specified by federal legislation are transmitted to the competent federal authority.

2. The Executive Council regulates the technical, organizational, and financial details by ordinance.

**If a Person Changes Personal Data in the Resident Registry**

When a person requests a change in data concerning them in the resident registry, they are no longer required to report this change to the cantonal authorities that have access to the respective personal data collections. Federal reporting obligations remain reserved.

The resident registry informs the affected person of which reporting obligations are fulfilled with the change notification.

If competent authorities become aware of a reportable circumstance, they shall request the affected person to report it within a reasonable additional period.

1. Personal data that, according to the municipality's report, no longer need to be maintained in the registers subject to the reporting obligation shall be destroyed by the responsible organizational unit no later than five years after the municipality's report.

1. Article 5 paragraph 4, including Annex 1, takes precedence over conflicting provisions of other laws regarding the processing of particularly sensitive personal data in centralized personal data collections.

2. Paragraph 1 applies until specific laws conclusively regulate the processing of particularly sensitive personal data within their scope of application.

1. The Tax Law of May 21, 2000 (StG)[9] is amended.

1. The Act of November 28, 2006, on the Harmonization of Official Registers (RegG) is repealed.

1. The government council determines the date of entry into force.