Ordinance on Information and Data Protection - Mandate (IDV)

1. The mandate for processing personal data by organizational units or individuals not subject to the Law on Information and Data Protection must be issued in writing.

1. A data pool within the meaning of this regulation exists when a collection of information containing personal data

a) is created for the purpose of fulfilling tasks by at least two public bodies or at least one public body and a third party, and

b) contains information from at least two public bodies or at least one public body and at least one third party, and

c) the information contained therein is jointly used by multiple public bodies and/or third parties, whereby the public bodies and/or third parties providing and receiving the information do not have to be identical.

1. Access to the information inventory of a data pool requires the existence of legal foundations in accordance with the provisions of §§ 9 and 21 IDG.

2. For the establishment, operation, and organization of a data pool, legal foundations must be created at least at the regulatory level.

3. They particularly regulate

a) * the purpose of the data pool;

b) * the content of the data pool;

c) * the public body that bears overall responsibility, and its tasks (§ 6 para. 2 IDG);

d) * the rights and obligations of the public bodies or third parties providing information;

e) * the rights and obligations of the public bodies or third parties receiving information;

f) * the handling of information that is no longer needed;

g) * the guidelines for transferring processing to third parties (§ 7 IDG);

h) the dissolution of the data pool in compliance with § 1c of this regulation.

1. If a data pool is dissolved, the information contained therein shall be returned to the respective public bodies and/or third parties that supplied the information.

2. If a return is not possible, the information shall be destroyed in accordance with the provisions of § 16 IDG.

1. The documentation demonstrating compliance with data protection regulations (§ 6 para. 3 IDG) is provided through a record and includes

a) a description of the processing of personal data;

b) an account of the legal situation;

c) a description of the risks and remedial measures;

d) a description of the processes and responsibilities.

2. The documentation may be carried out in a structured data protection or information security management system.

1. A high risk to the fundamental rights of the affected individuals within the meaning of § 12a para. 1 and § 13 para. 1 lit. b IDG particularly exists if a project for processing personal data

a) * provides for a retrieval procedure;

b) * concerns special personal data or personal data subject to professional or official secrecy;

c) * includes profiling;

d) * affects a large number of individuals;

e) * involves contract data processing by third parties abroad in a state without adequate data protection; or

f) * intends the establishment of a data pool in the sense of § 1a.

2. ...

**1. Initial Contact with the Data Protection Officer**

The initial contact with the Data Protection Officer shall occur at a point in time that allows for the consideration of their recommendations from the prior consultation in the legislative project or undertaking.

**2. Prior Consultation Steps**

The prior consultation shall take place in one or several stages of assessment, depending on the size of the legislative project or undertaking.

**3. Evaluation by the Data Protection Officer**

The Data Protection Officer shall conduct each stage of assessment within a reasonable timeframe and communicate the corresponding evaluation results to the public authority.

1. If the preliminary consultation involves a project for the processing of personal data, the public body shall submit documentation to the Data Protection Officer containing all documents relevant for the assessment, in particular

a) * a description of the project;

b) an explanation of the legal situation; and

c) an overview of the measures to prevent violations of personal rights.

1. The obligation to provide information during procurement as per § 15 section 1 IDG can particularly be fulfilled through data collection forms and by providing an information sheet.

1. In the case of the disclosure of personal data for non-personal purposes, particularly for statistics, research, and planning, it is permissible to omit informing the affected individuals.

1. The following sectors, departments, and staff offices appoint a data protection officer

a) the Population Services and Migration sector;

b) the Cantonal Police;

c) the Public Prosecutor's Office;

d) the Office for Economy and Labor;

e) social assistance.

2. The following public-law institutions appoint a data protection officer

a) the Industrial Works Basel;

b) the public hospitals;

c) the University of Basel.

**1. The Regulation for the Video Surveillance System specifically stipulates:**

a) the legal basis for the use of video surveillance,

b) which public body is responsible for the video surveillance system,

c) the purpose pursued by employing the video surveillance system,

d) the area covered by the video surveillance,

e) the individuals monitored by the video surveillance,

f) when the video surveillance system is operational (operating times or conditions for activation),

g) the number of cameras used with or without zoom capability,

h) whether and by whom a real-time evaluation of the recordings is conducted,

i) whether and under what conditions a recording (storage) of the footage occurs,

j) under what conditions and by whom a subsequent evaluation of the recordings may be conducted,

k) after what duration the recordings are deleted,

l) what technical and organizational measures are taken to protect the data from unauthorized processing, and

m) what measures are implemented to evaluate the effectiveness of the video surveillance.

**2. The Annex to the Regulation includes specifically:**

a) a site plan showing the camera locations and recording areas, and

b) a representation of the means by which the use of the video surveillance system is indicated, particularly pictograms including the indication of the responsible authority.

**3. For the courts, the municipalities, and the autonomous institutions and corporations, the regulation applies mutatis mutandis (§ 18 para. 5 IDG).**

1. At all entrances to the monitored zone, the use of video surveillance must be indicated with clearly visible pictograms and by specifying the responsible entity.

1. The public body submits the video surveillance project to the Data Protection Officer for prior consultation in accordance with § 13 IDG as well as §§ 2 ff. of this regulation.

2. The public body provides the necessary documents to the Data Protection Officer, in particular

a) Explanations regarding which other measures have not succeeded in achieving the purpose until now,

b) Possibly explanations as to why the standard retention period of one week is insufficient to achieve the specific purpose and which technical and organizational measures are taken to minimize the risk of a personal rights violation, and

c) * the draft of the regulations, provided it is already available at the time of submission for prior consultation.

1. If a video surveillance regulation is to be extended, the public authority shall submit the extension proposal to the data protection officer for prior consultation no later than three months before the expiration of the regulation's term.

2. The proposal shall include all relevant information necessary for evaluating effectiveness, particularly regarding the following questions

a) to what extent the intended purpose could be achieved with the video surveillance and/or due to other factors, and

b) to what extent changes compared to the previous configuration are possible or necessary.

1. Disclosure of Data in Retrieval Procedures Includes

a) the disclosure of data via a user interface (online access),

b) the provision of data via a web service, and

c) the periodic and automated provision of lists.

1. Disclosure of personal data by means of a retrieval procedure requires authorization from the data owner, i.e., the responsible public body as defined in § 6 IDG.

2. The authorization must be submitted to the Data Protection Officer for prior consultation.

3. If the responsible body has itself obtained the personal data to which the request pertains, in whole or in part, by means of a retrieval procedure, it is not authorized to further disclose this data by means of a retrieval procedure without the consent of the public body from which it obtained the requested personal data.

1. For the application or authorization pursuant to § 9b paragraphs 1 and 2, the cantonal templates must be used.

2. In justified cases, a deviation from this regulation is permissible.

1. If personal data is to be disclosed for a non-personal purpose, a written declaration of commitment from the recipient must be obtained prior to disclosure in accordance with § 22 paragraphs 2 and 4 IDG.

2. The declaration of commitment shall particularly contain

a) detailed information about the recipient,

b) a specific description of the intended purpose for processing the data,

c) the planned procedure and method of data processing,

d) information on the measures intended to protect the information,

e) the obligation to anonymize or pseudonymize the personal data as soon as the processing purpose permits, and

f) the obligation to disclose evaluations only in such a manner that no conclusions about the affected individuals can be drawn.

3. If personal data is disclosed to private parties, the declaration shall additionally include a reference to the criminal penalty of § 51 paragraph 2 IDG and the commitments

a) not to process the personal data for other purposes,

b) not to pass the personal data on to third parties, and

c) to ensure that the personal data does not particularly become known to unauthorized persons.

4. The recipient is required to oblige all individuals entrusted with the processing of the data and who have access to the non-anonymized information to sign a declaration of commitment that is at least as extensive, and to present this to the public authority upon request.

1. The public authority may refer to the list of countries, territories, specific sectors in a country, and international organizations in Annex 1 of the Swiss Federal Ordinance on Data Protection (Data Protection Ordinance, DSV) dated August 31, 2022, to determine whether the legislation of a recipient state ensures adequate protection within the meaning of Section 23(a) of the IDG.

2. If data is to be disclosed to a recipient in a state whose legislation does not ensure adequate protection, and protection is to be guaranteed through contractual agreements as per Section 23(b) of the IDG, the public authority must inform the data protection officer in advance about the agreed security measures.

1. Every affected individual may request that the public authority correct inaccurate personal data or, if correction is not possible, destroy it.

2. If the public authority disputes the inaccuracy, it bears the burden of proving the accuracy of the personal data, provided that the corresponding information did not originate from the affected individual.

3. If the nature of the data is such that neither the accuracy nor the inaccuracy of personal data can be proven, particularly for those that involve an assessment of human behavior or that the public authority has received from another public authority or a third party, the affected individual may request the inclusion of a counterstatement.

4. If a public authority rejects the request to correct inaccurate personal data, it shall inform the requesting individual, upon request, in the form of an appealable order.

1. If a public authority rejects a request for the cessation of unlawful data processing, the rectification of the consequences of unlawful data processing, particularly through data deletion, or for the determination of the unlawfulness of the processing of personal data, it shall inform the applicant of this decision, upon request in the form of an appealable order.

1. The public authority that has executed the blocking ensures that other public authorities, to which it has provided the personal data affected by the blocking, are informed about the blocking.

2. If the affected person requests the lifting of the blocking, they must notify the public authority in writing.

3. The public authority draws attention to the right of blocking

a) through a written notice on forms used for data collection,

b) through a notice on its website for online data collection, and

c) through notices in publications that provide information about data collection.

1. The government council regulates the informational activities related to its decisions in its rules of procedure.

2. The courts, municipalities, and other bodies as well as the independent institutions regulate their informational activities themselves.

1. The Register of Procedures for Processing Personal Data contains at least the following information for each procedure

a) the designation of the procedure,

b) the legal basis for data processing,

c) the responsible public body, and

d) the purpose of data processing.

1. A record is considered incomplete, in particular, if

a) it has not yet been signed by the creator,

b) it has not yet been delivered by the creator to the recipient,

c) it is in draft form,

d) the handwritten or electronically captured text includes deletions or annotations, or

e) it serves as an informal work note.

1. If a public body prepares reports containing information that deserves protection for the attention of the government council, it shall classify them according to the degree of their protectiveness into one of the following classification levels

a) secret;

b) confidential.

1bis. Other information deserving protection may also be classified.

2. If information carriers are physically compiled into a collection, it must be verified whether and to what extent this collection must be classified or assigned to a higher classification level.

1. Classified as confidential are namely

a) Information whose disclosure can seriously compromise public security or the safety of individuals or cause serious harm in another way,

b) Information whose disclosure can endanger the ability of public bodies to act, particularly the Grand Council and the Executive Council, and

c) Information carriers containing stock market-relevant information about companies in which the Canton or the municipalities hold an interest.

2. Information is also classified as confidential if

a) this classification is necessary due to statutory or contractual confidentiality obligations, or

b) they relate to documents that have been assigned a comparable classification level by foreign, federal, cantonal, or municipal authorities.

3. Information carriers containing information classified as confidential must be numbered.

1. The following information is classified as confidential

a) information whose disclosure could impair public security or the security of individuals or cause damage in any other way,

b) information whose disclosure could impair the free formation of opinion and decision-making of public bodies, particularly of the Grand Council and the Government Council, or

c) information whose disclosure could interfere with the implementation of specific government measures,

d) information that contains sensitive personal data under § 3 para. 4 IDG or information about the family or financial circumstances of individuals,

e) information concerning financial contributions to private individuals, for which there is no legal entitlement,

f) information containing business, professional, or trade secrets, or

g) information related to appeals procedures and supervisory notifications.

2. Information is also classified as confidential if

a) this classification is required due to legal or contractual confidentiality obligations, or

b) it relies on documents that have been assigned a comparable classification level by foreign, federal, cantonal, or municipal authorities.

3. Holders of information classified as confidential may be numbered.

1. The classification is to be limited in time if it is foreseeable when the need for protection will cease.

1. Classified information may only be disclosed or made accessible to persons who have a need to know.

**1. Special Category Personal Data and Profiling Results**

For special category personal data and profiling results, it is presumed that the private interest of the affected person outweighs the interest of a third party in accessing such data.

1. There is no right of access to the draft resolutions and reports that the departments and the state chancellery prepare for decision-making by the government council.

2. Subject to differing regulations in the municipal ordinances, this restriction on the right of access also applies to draft resolutions and reports prepared for decision-making by the municipal council.

1. The public authority granting access shall keep a copy of the identity document on file if, pursuant to § 31 paragraph 2 IDG, it must request such a document because the identity of the applicant is not unequivocally established.

1. Another public authority is typically granted a period of seven days to respond to a request for access to information.

2. A third party is typically granted a period of fourteen days to respond to a request for access to information; if no response is received within this period, an additional period of up to fourteen days is granted.

3. If no response is received, the public authority decides based on the available records.

1. When access requests are made by media professionals, consideration should be given, as far as possible, to the urgency of the reporting.

1. The labor for up to one hour is free of charge.

2. For labor from the second hour onwards, a rate of CHF 100 per hour will be charged.

1. The following fees are charged for reproduction

a) for the production of photocopies or electronic copies, per page: CHF 1,

from the 40th page, per page: CHF 0.50,

b) for electronic copies on machine-readable media, in addition to any page price according to letter a, per data carrier: CHF 20,

c) per audio cassette, recorded by the public authority: CHF 20,

d) for reproductions that must be made by external service providers: as per quote.

1. The State Chancellery is responsible for the implementation of the principle of public access regarding the affairs of the Council of Government and, in this context, processes applications for access to information.

2. Additionally, the State Chancellery has the following tasks

a) it coordinates the implementation of the principle of public access for interdepartmental affairs,

b) it forwards applications received, which do not concern the affairs of the entire Council of Government, to the competent authority, and

c) it also develops foundational work for the information activities of the entire cantonal administration and supports public authorities in implementing the principle of public access.

3. Departments, courts, municipalities, and other corporations as well as autonomous institutions organize the implementation of the principle of public access independently.

4. The departments of the cantonal administration designate an office responsible for the implementation of the principle of public access at the departmental level and serve as a contact point for the State Chancellery.

1. The departments of the cantonal administration shall annually inform the State Chancellery for the purposes of the administrative report of

a) the number of requests for access to information submitted in writing during the reporting year,

b) the number of accepted and fully or partially rejected written requests, and

c) any special incidents related to the granting of access to information.

2. The State Chancellery shall provide the data protection officer with the information necessary for reporting in accordance with Section 50 IDG.

1. Municipalities shall inform the Data Protection Officer when they establish or abolish a municipal supervisory authority.

1. Regulation on the Data Market

The Regulation on the Data Market of 12 July 2005 is amended as follows

2. Regulation on Informatics Security (ISR)

The Regulation on Informatics Security (ISR) of 9 April 2002 is amended as follows

3. Regulation on Records Management and Archiving (Records Management and Archiving Regulation)

The Regulation on Records Management and Archiving (Records Management and Archiving Regulation) of 13 October 1998 is amended as follows

4. Regulation on the Admission of Children in Homes and Foster Families

The Regulation on the Admission of Children in Homes and Foster Families of 9 September 1997 is amended as follows

5. Regulation on the Land Register (RoLR)

The Regulation on the Land Register (RoLR) of 16 December 2003 is amended as follows

6. Regulation on the Medical Service in Civil Protection

The Regulation on the Medical Service in Civil Protection of 15 September 1992 is amended as follows

7. Regulation to the Act Concerning Child Daycare (Daycare Regulation, DR)

The Regulation to the Act Concerning Child Daycare (Daycare Regulation, DR) of 25 November 2008 is amended as follows

8. Regulation on the Recognition of Institutions for the Promotion of the Integration of Disabled Adults (Recognition Regulation)

The Regulation on the Recognition of Institutions for the Promotion of the Integration of Disabled Adults (Recognition Regulation) of 16 October 2007 is amended as follows

9. Regulation on the Harmonization and Coordination of Needs-Based Social Benefits (HCSB)

The Regulation on the Harmonization and Coordination of Needs-Based Social Benefits (HCSB) of 25 November 2008 is amended as follows

1. Upon the effectiveness of this Regulation, the Regulation on Video Surveillance (Video Surveillance Regulation) dated January 4, 2005, shall be repealed.

1. Projects for the expansion of data processing that are already underway at the time of the IDG coming into effect only need to be submitted to the Data Protection Officer for prior checking if the expansion newly fulfills one of the conditions under § 2 Paragraph 1 of this regulation.

1. For existing data processing systems, proof of compliance with data protection regulations according to § 6 para. 3 IDG and § 1d of this ordinance must be provided by no later than December 31, 2029.

1. This ordinance shall be published; it shall enter into force simultaneously with the Law on Information and Data Protection (Information and Data Protection Law) of June 9, 2010.