Act on Information and Data Protection - Subject Matter and Purpose (IDG)

1. This Act regulates the handling of information by public authorities.

2. It aims to

a) make the actions of public authorities transparent, thereby promoting free formation of opinion and the exercise of democratic rights, unless overriding public or private interests oppose it, and

b) protect the fundamental rights of natural persons whose personal data is processed by public authorities.

1. This Act applies to all public bodies in accordance with § 3 para. 1.

2. It does not apply insofar as a public body participates in economic competition and acts under private law. For the processing of personal data, the Federal Act on Data Protection (FADP) of June 19, 1992, is applicable. Oversight is exercised by the Data Protection Officer pursuant to §§ 37ff., except for public bodies that exclusively participate in economic competition and act under private law.

a) *

b) *

c) *

2bis. In pending civil and criminal proceedings, as well as in constitutional and administrative jurisdiction, the rights and claims of the affected person, the information duty of the public body in the collection of personal data, the disclosure of personal data to participants in the proceedings, the information of the public, and the general public access to information are exclusively governed by the applicable procedural law.

3. Divergent and supplementary provisions in other laws remain reserved, provided they ensure the protection of the fundamental rights of individuals about whom public bodies process personal data within the meaning of this Act.

4. The cantonal government ensures that inter-cantonal institutions with the participation of Basel-Stadt provide equivalent data protection.

**1. Public Bodies within the Meaning of this Law Are:**

a) the organizational units of the canton and municipalities that fulfill a public task;

b) the organizational units of legal entities of cantonal and municipal public law that fulfill a public task;

c) private entities insofar as they have been assigned the fulfillment of public tasks by the canton or municipalities.

**2. Information within the Meaning of this Law Is:**

All records relating to the fulfillment of a public task, regardless of their form of presentation and the medium on which they are stored.

**3. Personal Data Is:**

Information relating to an identified or identifiable natural person.

**4. Special Categories of Personal Data Are:**

a) Personal data for which processing poses a particular risk of infringing fundamental rights (sensitive personal data), in particular

1. Information about religious, ideological, political, or trade union views or activities;

2. Information about health, genetic data, personal privacy, sexual life, sexual orientation, or ethnic origin;

3. Information about measures of social assistance;

4. Information about administrative or criminal prosecutions and sanctions; and

5. Personal data obtained through special technical procedures relating to the physical, physiological, or behavioral characteristics of a natural person that enable or confirm the unique identification of this person (biometric data).

b) Compilations of information that allow assessment of essential aspects of a natural person's personality (personality profile).

**5. Processing Is:**

Any handling of information, regardless of the means and procedures used, in particular acquiring, storing, using, modifying, disclosing, archiving, deleting, or destroying as well as performing logical or arithmetic operations with this information.

**6. Disclosure Is:**

Any making of information accessible such as granting access, transmitting, or publishing.

**7. Profiling Is:**

Any automated evaluation of information to analyze significant personal characteristics or predict developments, particularly concerning work performance, economic situation, health, personal preferences, interests, reliability, behavior, location, or change of location.

**8. Data Processor Is:**

The private person or public body that processes information on behalf of the public body responsible for publishing the processing.

1. The public body organizes the handling of information in such a way that it can inform quickly, comprehensively, and objectively.

1. The public authority manages its information according to the record-keeping regulations in compliance with the Archives Act.

1. Responsibility for handling information lies with the public authority that processes the information to fulfill its statutory duties.

2. If multiple public authorities process a shared information database, they shall regulate the responsibility and determine which public authority holds overall responsibility.

3. The public authority must be able to prove that it complies with data protection regulations. The government council shall regulate the specifics for the cantonal administration. For the courts, municipalities, other corporations, and autonomous institutions, the cantonal regulation applies correspondingly, unless they have enacted their own.

1. A public authority may delegate the processing of information to third parties if

a) there is no legal provision or contractual agreement to the contrary, and

b) it is ensured that the information is processed only in the manner in which the public authority itself is permitted to do.

2. The public authority remains responsible for the handling of information pursuant to this law.

3. A data processor may not delegate the processing of data to another data processor without the prior written consent of the commissioning public authority.

1. The public authority protects information through appropriate organizational and technical measures.

2. The measures are based on the following protection objectives

a) Information must not unlawfully be disclosed (Confidentiality);

b) Information must be accurate and complete (Integrity);

c) Information must be available when needed (Availability);

d) Processing of information must be attributable to a person (Accountability);

e) Changes to information must be detectable and traceable (Traceability).

3. The measures to be taken are determined by the type of information, the nature and purpose of its use, and the current state of technology.

4. The government council regulates the specifics for the cantonal administration, and the municipal council does so for the municipal administration. For the courts, municipalities, other bodies, and autonomous institutions, the regulation of the canton applies mutatis mutandis, insofar as they do not enact their own.

1. A public body may process personal data if

a) there is a legal basis for doing so, or

b) it is necessary for the fulfillment of a legal task.

2. Sensitive personal data may be processed and profiling may be carried out if

a) a law expressly authorizes or obligates it, or

b) it is strictly necessary for a clearly defined task in a law.

3. The processing of personal data must be carried out in good faith and must be proportionate.

4. Personal data may only be processed for as long as it is necessary for the fulfillment of the legal task.

1. The Government Council may, after obtaining an assessment from the data protection officer(s) as part of a preliminary consultation pursuant to § 13, authorize the processing of special personal data or profiling before a law comes into effect, if

a) the tasks necessitating such processing are regulated by law,

b) sufficient measures are taken to prevent violations of personal rights, and

c) the practical implementation of data processing mandatorily requires a testing phase before the law takes effect.

2. The practical implementation of data processing may mandatorily require a testing phase when

a) fulfilling a task requires technical innovations whose effects must first be evaluated,

b) fulfilling a task requires significant organizational or technical measures whose effectiveness must first be tested, particularly when cooperating with federal public bodies, other cantons, and private entities; or

c) it requires the transmission of special personal data or the results of profiling to third parties through a retrieval procedure.

3. Pilot projects are to be limited to a maximum of five years.

4. Each pilot project is to be evaluated.

5. The Government Council shall regulate the modalities of data processing by ordinance.

1. A public body may process personal data for a non-personal purpose, namely for statistics, planning, or research, if it

a) does not use or disclose this data for any personal purpose, and

b) anonymizes or pseudonymizes these data as soon as the processing purpose allows, and

c) discloses the results of the processing only in such a way that no conclusions can be drawn about affected individuals.

2. ...

1. Personal data must be accurate and, as far as the purpose of use requires, complete.

2. The public authority processing personal data must ensure its accuracy.

3. All reasonable measures must be taken to rectify or destroy data that is incorrect or incomplete in view of the purpose of its collection or processing.

1. Personal data shall only be processed for the purpose for which it was collected, unless a legal basis expressly provides for further usage or the data subject consents in a specific instance.

1. The responsible public body must assess, for each project involving the processing of personal data, whether there is likely to be a high risk to the fundamental rights of the affected individuals. The high risk arises, particularly with the use of new technologies, from the nature, scope, context, and purpose of the processing.

2. If a high risk is likely, a data protection impact assessment must be conducted.

3. The impact assessment must include at least

a) a general description of the intended processing operations;

b) an evaluation of the risks to the fundamental rights of the affected individuals; and

c) a presentation and assessment of the proposed remedial measures, guarantees, security precautions, and procedures that are intended to ensure the protection of the individuals' fundamental rights and demonstrate compliance with this law.

1. The responsible public authority shall submit the following to the data protection officer for prior consultation at an early stage

a) Legislative projects that concern the processing of personal data or are significant for handling information, and

b) Projects for the processing of personal data that, due to the nature of processing or the data to be processed, result in a high risk to the fundamental rights of the individuals concerned.

2. The data protection officer shall prepare a list of processing activities that must be submitted for prior consultation.

1. The public authority shall, from the outset of data processing, implement measures that reduce the risk of violations of fundamental rights and prevent such violations.

2. It shall ensure, through appropriate default settings, that only those personal data which are necessary for the respective intended purpose are processed by default.

1. The responsible public body shall inform the affected person about any acquisition of personal data. This obligation to inform also applies when the data is obtained from third parties.

2. The information includes, in particular, details regarding

a) * the responsible public body along with contact details;

b) * the processed data or the categories of processed data;

c) * the legal basis and purpose of the processing;

d) * the data recipients or categories of data recipients, if the data is disclosed to third parties, and

e) * the rights of the affected person.

3. The obligation to inform does not apply if

a) * the affected person already possesses the information according to paragraph 2;

b) * the processing of personal data is expressly provided by law or

c) * providing the information is not possible or only possible with disproportionate effort.

4. The transmission of the information may be restricted under the same conditions as access to one's own personal data.

1. The personal ID is a non-disclosing and immutable number that uniquely identifies a person.

2. It is to be used systematically and exclusively internally for the exchange and linking of personal data between and within public bodies pursuant to § 3 paragraph 1 letters a and b.

3. A personal ID is assigned to a natural or legal person who has their residence or registered office in the Canton of Basel-Stadt or when this is necessary for interaction with public bodies. The assignment is carried out by a central authority.

4. The competent authority sets guidelines for the correct use of the personal ID and monitors compliance with them.

1. Personal data that are no longer needed and deemed not worthy of archiving by the authority responsible under the Archive Act must be destroyed by the public body.

2. For information holdings containing personal data, deadlines must be set for their destruction or for reviewing whether the data are still necessary for fulfilling tasks.

1. The responsible public body shall report a data protection breach to the data protection officer without undue delay.

2. The data processor shall immediately inform the commissioning public body of any data protection breach.

3. A data protection breach occurs when personal data, processed as a result of an information security breach, is irretrievably destroyed or lost, unintentionally or unlawfully altered or disclosed, or unauthorized persons gain access to such personal data.

4. There is no obligation to report if the data protection breach is not expected to result in a risk to the fundamental rights of the affected person.

5. The public body shall inform the affected individuals if circumstances require it or if the data protection officer demands it.

6. The notification of the affected individuals may be wholly or partially omitted or postponed if a restriction pursuant to § 29 is permissible.

1. The departments of the cantonal administration, the courts, and the residents' and citizens' communities shall appoint a data protection advisor.

2. The Executive Council shall additionally designate the sectors, divisions, and staff units of the cantonal administration, as well as public law institutions governed by cantonal law, which must appoint their own data protection advisor. In doing so, it shall consider the nature and volume of personal data processed by them.

3. This person has the following responsibilities

a) advising and assisting in the processing of personal data;

b) assisting in conducting data protection impact assessments in accordance with § 12a para. 1;

c) cooperating with the data protection officer.

**1. In public, generally or not generally accessible places, video surveillance that allows for the identification of individuals may only be used to protect persons and property from criminal acts or to prosecute such criminal acts.**

2. Video surveillance must be limited in scope and duration to what is necessary to achieve the specific purpose.

3. The use of video surveillance must be made recognizable by suitable measures indicating the responsible entity.

4. Any recordings, copies, and printouts must generally be destroyed within one week. Exceptionally, the regulations may set a longer period if this is necessary to achieve the specific purpose and the risk of invasion of privacy is minimized through technical and organizational measures.

5. The use of recordings for criminal or civil proceedings remains reserved; in such cases, the recordings must be submitted to the competent authorities together with the complaint or claim.

1. A regulation must be enacted for each video surveillance system prior to its commissioning, which specifically governs the purpose of the system, accountability, and the deletion period.

2. The competent authorities for enacting the regulations are

a) the Departments for systems under the responsibility of cantonal public bodies;

b) the Municipal Council for systems under the responsibility of municipal public bodies;

c) * the Judicial Council for systems under the responsibility of courts;

d) * the highest governing body of autonomous establishments and public law corporations for systems within their responsibility.

3. The regulation shall be limited to a maximum duration of four years. Before any possible extension, the effectiveness of the video surveillance must be evaluated.

4. Prior to the enactment and extension of a regulation, the project must be submitted to the Data Protection Officer for prior consultation.

4bis The regulations must be made easily accessible to the public.

4ter Insofar as the disclosure of camera locations or other operational details defeats the purpose, their publication may be waived.

5. The Government Council regulates further details for the cantonal administration. For the courts, municipalities, other corporations, and autonomous establishments, the canton’s regulation applies mutatis mutandis, unless they enact their own.

1. The public authority may have its procedures, organization, and technical facilities audited and evaluated by an independent and recognized body to ensure the quality of information processing.

1. The public body informs the public about matters of general interest within its area of activity.

2. Of general interest are pieces of information that concern matters of public interest and are significant for the formation of opinion and the preservation of the democratic rights of the population.

3. The public body provides information about its structure, its competencies, and contact persons.

4. The government council regulates the information activities for the cantonal administration. For the courts, municipalities, other bodies, and autonomous institutions, the regulations of the canton apply correspondingly, unless they enact their own regulations.

1. The public authority discloses personal data if

a) a statutory provision obliges or authorizes it to do so, or

b) it is necessary for the fulfillment of a legal task, or

c) in an individual case, the affected person has explicitly consented, or, if they are unable to do so, the disclosure is in their interest and their consent can be assumed in good faith.

2. The public authority discloses special personal data or results of profiling if

a) a law expressly obliges or authorizes it to do so, or

b) it is essential for the fulfillment of a task clearly defined by law, or

c) in an individual case, the affected person has explicitly consented, or, if they are unable to do so, the disclosure is in their interest and their consent can be assumed in good faith.

1. The public authority may disclose personal data to other public authorities within the canton, in other cantons, or at the federal level for processing purposes that are not related to individuals, such as for statistics, planning, or research, provided that this is not prohibited by a specific confidentiality provision.

2. The recipient must commit to

a) anonymizing or pseudonymizing the personal data as soon as the purpose of processing allows, and

b) disclosing the analyses only in such a way that conclusions about the affected individuals are not possible.

3. ...

4. The public authority may disclose personal data to private parties for processing for research purposes, provided that this is not prohibited by a specific confidentiality provision and the recipient additionally commits to the requirements of paragraph 2

a) not to process the personal data for other purposes, and

b) not to pass the personal data on to third parties, and

c) to ensure information security.

5. Under the same conditions, the judicial authority may disclose judgments containing personal data to lawyers registered in a cantonal lawyers' register under the Federal Act on the Free Movement of Lawyers (Lawyers Act, BGFA) of June 23, 2000, for the purpose of practicing their profession, provided the judgments are not already available in anonymized form.

1. Public bodies may disclose personal data to other bodies or private individuals who are not subject to the jurisdiction of a state or an organization that has acceded to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, only if

a) the legislation of the recipient state ensures adequate protection, or

b) adequate protection is guaranteed through contractual agreements, or

c) it is essential in individual cases either for the safeguarding of an overriding public interest or for the establishment, exercise, or enforcement of legal claims in court, or

d) in individual cases, the concerned person has given explicit consent, or if they are unable to do so, the disclosure is in their interest and their consent can in good faith be presumed.

1. The public authority shall maintain a complete register of its procedures involving the processing of personal data.

2. The registers shall be made easily accessible to the public, particularly through public data networks.

3. The government council shall regulate the content of the register and the exceptions to the publication requirement in the ordinance.

1. Every person has the right to access the information available at a public body within the meaning of § 3 para. 1 lit. a and b of this law, except for records that are not finalized.

2. In pending administrative and administrative appeal proceedings, the right to access information is governed by the applicable procedural law.

1. Every individual has the right to know whether public authorities hold personal data concerning them and, if applicable, to access these personal data.

2. Access includes

a) all personal data concerning the requesting individual;

b) all available information regarding the source of the personal data, if they were not collected from the person concerned; and

c) the additional information as per § 15(2).

1. Any affected person may request from the public body, free of charge, that it

a) correct inaccurate personal data or, if correction is not possible, destroy it;

b) refrain from unlawfully processing personal data;

c) * eliminate the consequences of unlawful processing of personal data, particularly by deleting personal data concerning them or blocking its disclosure to third parties;

d) formally establish in writing the illegality of the processing of personal data.

1bis

The legitimate interest of the affected person is presumed.

1ter

The correction, destruction, or deletion of personal data and the blocking of disclosure to third parties must also be communicated to those individuals or entities to whom the data was previously disclosed, insofar as this is not impossible or does not involve disproportionate effort.

2. The government council shall regulate the details.

1. The affected person may request in writing that the public authority restrict the disclosure of their personal data to private individuals.

2. The public authority shall provide appropriate notice of the right to restrict disclosure.

3. Disclosure is permissible despite the restriction if

a) the public authority is legally obligated to disclose, or

b) the disclosure is imperative to fulfill a legal duty, or

c) the person requesting the disclosure credibly demonstrates that the personal data is necessary to enforce their legal claims.

4. If an application under subsection 3(c) is not to be rejected outright, the public authority shall give the affected person the opportunity to comment within a reasonable period. The decision shall be issued in the form of an appealable order if requested by the affected person or the applicant.

1. Every person has the right to address a supervisory complaint to the Data Protection Officer if they believe that a public authority, a processor, or a processing agent is violating data protection regulations in the processing of their personal data.

2. The person filing the complaint does not have party status in this procedure.

3. The Data Protection Officer shall inform them within three months about the status or the outcome of the investigations and the resolution.

1. The public authority shall refuse or defer the disclosure of or access to information in whole or in part in individual cases if there is a particular statutory duty of confidentiality or a prevailing public or private interest opposing it.

2. A public interest is notably present when the disclosure of or access to the information

a) endangers the security of the state or public safety, or

b) impairs relations with another canton, the federal government, or foreign countries, or

c) adversely affects the free process of opinion and will formation of the public authorities, or

d) undermines the position in negotiations, or

e) impedes the proper execution of specific governmental, particularly police, measures.

3. A private interest is notably present when

a) the disclosure of or access to information would impair the protection of privacy, or

b) the disclosure of or access to information would reveal professional, manufacturing, or business secrets, or infringe intellectual property rights, or

c) the disclosure of or access to information is requested that has been voluntarily provided to the public authority by third parties and whose confidentiality has been assured by it.

4. Should access to one's own personal data in the medical or psychiatric field be deemed by the public authority to be too burdensome for the person concerned, it may be granted to a person of their trust. Provided the person concerned expressly wishes it, direct and comprehensive access to their personal data shall be granted to them.

1. If access to personal data held by a public authority is not already to be denied in whole or in part pursuant to § 29, such personal data must be anonymized before granting access.

2. If anonymization is not possible or not fully feasible, the public authority may grant access to non-anonymized personal data if

a) there is an overriding public interest in accessing this personal data, or

b) the conditions for the disclosure of personal data under this law (§§ 20 et seq.) are met.

1. Anyone who wishes to obtain access to information pursuant to §§ 25 and 26 must submit a request in writing or orally, specifying the desired information with sufficient precision.

2. The person submitting a request for access to their own personal data must prove their identity, unless their identity is already clear to the requested public authority beyond any doubt.

1. If a request pertains exclusively to information that is already publicly available and accessible in an appropriate manner, the public authority will not process the request, referring to the source.

2. If the interests of third parties or other public authorities, as defined in § 29, are affected, the public authority shall give these parties or authorities the opportunity to comment within a reasonable period, unless it is clear even without their comments that access must be wholly or partially denied.

1. If there is no objection to granting access to information, the public authority shall grant the requesting person access.

2. If the public authority considers, based on its examination or the obtained opinions, to fully or partially reject the request, it shall inform the requesting person.

3. If it considers granting the access request contrary to the obtained opinions, it shall inform the affected third parties or other public authorities.

4. Within 30 days of receiving notice according to paragraphs 2 and 3, the requesting person and the third party may request the issuance of an appealable decision from the public authority.

1. The public authority grants access to the information by

a) providing the information in writing, in the form of copies or on data carriers, or

b) with the consent of the requesting person, communicating the information orally or allowing the person to inspect the information on-site.

2. Upon an orally submitted access request, the public authority may communicate the information orally to the requesting person.

1. The public authority shall, within 30 days of receipt of the request

a) grant the applicant access to the information,

b) send a notification in accordance with Section 33 paragraph 2, or

c) if the deadline cannot be met, inform the applicant of the reasons and indicate by when the decision will be made.

1. No fees are generally charged for the procedure to access information.

2. A reasonable fee based on effort may be charged, but in no case for access to one's personal data

a) in complex procedures, such as complicated circumstances or extensive anonymization of information;

b) for the creation of copies or other data carriers for the requesting person.

3. The public authority shall inform the requesting person if the request is associated with substantial costs; in such cases, it may demand an advance payment before further processing the request.

4. If the information is suitable for commercial use, a fee may be charged based on market conditions.

5. The government council shall issue a fee schedule.

1. The canton operates an independent supervisory authority under the name "The Data Protection Officer."

2. It may operate the supervisory authority jointly with other cantons based on an international treaty.

1. The Data Protection Officer performs their duties independently of instructions.

2. The supervisory authority is organizationally affiliated with the office of the Grand Council.

3. The following are not subject to control by the Data Protection Officer

a) the members of the Grand Council and the Grand Council as an authority;

b) * the Executive Council as an authority;

c) * data processing in pending civil and criminal justice proceedings;

d) * data processing in pending constitutional and administrative jurisdiction proceedings.

1. The supervisory authority is headed by a person (the Commissioner) who is an expert in data protection matters. Remuneration is similar to that of the presidents of civil courts in the canton of Basel-Stadt.

2. The Grand Council elects the Commissioner upon the proposal of its Nomination Committee for a fixed term of six years. The nomination proposal is to be submitted to the Executive Council for comment. Re-election is possible.

3. The office of the Commissioner can be divided between two individuals with a maximum of 100 percent total employment.

4. The Commissioner can be removed from office by the Grand Council with a two-thirds majority before the expiration of the term if there is a serious breach of duty or professional inadequacy.

1. The appointee may not hold any other public office, serve on any board of directors, hold a leading position in a political party, or engage in any other gainful employment. The Grand Council may grant exceptions.

2. If the appointee holds a part-time position at the supervisory authority, they may engage in or take up another gainful activity with the consent of the nominations committee. The nominations committee will not grant consent if there are important reasons against it.

1. The personnel law of the canton applies to the appointee and the other employees, insofar as this law does not provide otherwise.

2. The appointee is responsible for the personnel matters of the other employees of the supervisory office within the framework of the budget approved by the Grand Council and for personnel law measures. The legal remedy procedure is governed by §§ 40ff. Personnel Act.

3. The office of the Grand Council decides on the classification of the personnel after consulting the Central Personnel Service. The classification is carried out according to the principles of job evaluation provided in the Wage Act of January 18, 1995.

4. Decisions concerning classifications, as well as the refusal to conduct a procedure concerning classification, can be contested by the position holder by filing an objection with the office of the Grand Council within 30 days. This office decides after consulting the Evaluation Commission.

1. The supervisory authority independently prepares its budget.

1. Local municipalities may establish their own supervisory authority for the municipal area.

2. If they refrain from doing so, or if the municipal supervisory authority does not meet the requirements for independence, the cantonal data protection officer shall be responsible.

3. The municipal officer and any additional staff may not hold any other official functions within the municipality.

4. Sections 44 to 50 apply to the municipal supervisory authority within its jurisdiction.

1. The Data Protection Officer

a) monitors the application of provisions regarding the handling of information according to a self-established audit program;

b) provides opinions on legislative and other proposals that are to be submitted for preliminary consultation according to § 13;

c) advises public authorities on matters related to the handling of information;

d) advises affected individuals about their rights;

e) mediates between affected individuals and public authorities;

f) handles supervisory notifications according to § 28a;

g) raises awareness among public authorities about their data protection obligations and educates the public about data protection and transparency concerns;

h) follows developments relevant to the protection of personal data and the principle of transparency.

1. The Data Protection Officer may, with regard to public bodies, data processors, as well as third parties that have received personal data from a public body, request information on data processing either in writing or orally, regardless of any confidentiality obligations. The Data Protection Officer may review all documentation, conduct inspections, and be shown the data processing operations.

2. The public bodies, data processors, and third parties that have received personal data from a public body are obligated to support the supervisory authority in fulfilling its duties. They shall, in particular, cooperate in establishing the facts of the case.

3. The reports that the Data Protection Officer creates within the framework of control activities, and the materials on which they are based, are not publicly accessible within the meaning of § 25 paragraph 1.

1. The Data Protection Officer may provide recommendations on the handling of information.

2. The public authority to which the recommendation is addressed must declare to the Data Protection Officer whether it intends to follow the recommendation.

1. If a public body declares its intention not to follow the recommendation of the Data Protection Officer or actually does not follow the recommendation, the Data Protection Officer may issue the recommendation or parts thereof as an order in the form of a directive if

a) the recommendation concerns the processing of personal data and

b) the interest in enforcement is significant.

2. No directive can be issued against the Court of Appeals.

3. The Data Protection Officer may issue a directive directly if it is foreseeable that the public body will reject a recommendation or will not comply with it.

4. If legitimate interests are clearly endangered or violated, the Data Protection Officer may order the public body to restrict or suspend processing until the Court of Appeals has completed its review.

5. The public body to which the directive is addressed can contest it by filing an appeal according to the general regulations with the Court of Appeals.

**1. The Data Protection Officer collaborates with the authorities of other cantons, the federal government, and foreign countries that perform similar duties in order to fulfill their responsibilities.**

1. The appointee and the employees are subject to the same duty of confidentiality regarding the information they become aware of in the course of their duties as the processing public authority.

2. The duty of confidentiality applies beyond the termination of their function.

1. The Data Protection Officer periodically reports to the election authority and the public on the scope and focus of activities, significant findings and assessments, as well as the impact of the law.

2. ...

1. Shall be punished with a fine, whoever

a) * as a processor pursuant to § 7, intentionally or negligently uses or discloses personal data for themselves or others without the express authorization of the commissioning public authority, or

b) * as a processor pursuant to § 7, transfers the data processing to another processor without prior written consent from the commissioning public authority.

2. Whoever intends or negligently processes or discloses to third parties personal data received from a public authority for non-personal purposes, contrary to the obligation pursuant to § 22 para. 4, shall be punished with a fine.

1. Residence Act

The Act on Residence Matters (Residence Act) of 16 September 1998 is amended as follows

2. Organization Act

The Act concerning the Organization of the Government Council and the Administration of the Canton of Basel-Stadt (Organization Act) of 22 April 1976 is amended as follows

3. Archive Act

The Act on Archives (Archive Act) of 11 September 1996 is amended as follows

4. Personnel Act

The Personnel Act of 17 November 1999 is amended as follows

5. Tax Act

The Act on Direct Taxes (Tax Act) of 12 April 2000 is amended as follows

6. Introductory Act to the Federal Act on Disability Insurance for a Disability Insurance Office Basel-Stadt

The Introductory Act to the Federal Act on Disability Insurance for a Disability Insurance Office Basel-Stadt of 19 January 1994 is amended as follows

1. Upon the entry into force of this law, the Law on the Protection of Personal Data (Data Protection Law) of 18 March 1992 shall be repealed.

1. Within two years after this law comes into effect, the registers of information holdings with personal data according to § 24 are to be published.

2. The government council may extend the deadline by one year upon a well-founded request.

1. This law is to be published. The government council determines the date of entry into force after the law becomes legally binding.