Act on a Central Electronic Portal for Public Authorities (Behördenportalgesetz) - Subject Matter

1. This law governs the organization, operation, and use of the central electronic government portal of the cantonal administration and ensures compliance with data protection principles.

2. The municipal communities of Bettingen and Riehen may participate in the cantonal electronic government portal.

1. The government portal includes a diverse range of electronic services. It enables individuals and businesses to conduct transactions with the administration via the Internet and allows for seamless electronic processing of administrative procedures.

2. The government portal ensures that users are authenticated in accordance with the requirements of the transactions to be conducted.

1. The authority portal includes, in particular, the following components

a) eAccount;

b) Authentication service;

c) Authorization service;

d) Notification service;

e) Technical security infrastructure, including encrypted communication.

1. The use of the authorities' portal requires the opening of an eAccount. This eAccount serves to identify the users.

1. The eAccount requires the following mandatory or optionally provided data for opening concerning the users

a) Identifying personal data: Last name, first name, date of birth (mandatory);

b) Address data (mandatory);

c) Email address (mandatory);

d) Additional personal data (optional).

2. For legal entities or partnerships, the company or name and proof of authorization to represent are also mandatory.

3. For a higher authentication level, further identifying data is mandatorily required.

4. When the eAccount is opened, a unique and immutable eAccount number is automatically generated and communicated to the user via email to the provided address.

5. The eAccount stores all data listed in paragraphs 1 to 4 as well as descriptive data concerning the transactions processed through the authority portal.

1. The specialized data for the transactions processed through the official portal are temporarily stored in the eAccount.

1. The opening of each eAccount requires the provision of data in accordance with § 5 paragraphs 1 and 2, as well as agreement to the terms of use.

2. Legal entities and partnerships that require multiple eAccounts for their employees shall receive a corporate access.

1. Users of the government portal must identify themselves personally and electronically before processing a transaction.

2. In accordance with the varying levels of required protection for potential transactions, different levels of authentication must be provided for, in particular

a) No authentication (public data);

b) Single-step authentication (basic protection requirement);

c) Two-step authentication (increased protection requirement);

d) Two-step authentication with a qualified certificate (very high protection requirement).

3. The government council determines the procedure and requirements for the technical implementation and the authentication authorities. In doing so, it adheres to the current state of technology.

1. Users may terminate their eAccount. The data stored therein will be irretrievably deleted.

1. Further rights and obligations are governed by the terms of use.

1. Authorized personnel of the administration have access to the eAccount to the extent necessary for the fulfillment of their legal duties.

2. The access authorization is divided into inquiry and processing rights.

3. Every access to the authority portal is logged for traceability purposes.

1. If users have not logged into their account for more than two years, the account will be automatically terminated after prior notice, and the data stored there will be deleted.

2. If users violate the terms of use, the competent authority will decide, after prior notice, on the termination of the eAccount and the deletion of the data stored there.

1. For employees of the administration who have access to the data of the government portal, official secrecy applies.

1. The Executive Council holds overall responsibility for the government portal. This encompasses, in particular, the following tasks

a) Strategic development of the government portal;

b) Definition of the applicable security regulations;

c) Ensuring that the security measures of the government portal correspond at least to the protection requirements of the data to be processed or created in the government portal;

d) Regular review of compliance with security regulations and measures;

e) Definition of the framework conditions for authorities' access to the government portal;

f) Regulation of access and usage conditions for users of the government portal;

g) Supervision of the technical operator of the government portal; and

h) Decision on the dissolution of the eAccount and the deletion of data in accordance with § 12 paragraph 2.

2. It may delegate individual tasks to the competent department.

1. The responsible department is in charge of the technical operation, maintenance, and technical advancement of the authority portal.

2. It regularly creates data backups to protect the data in the authority portal. These backups are deleted after three months.

1. The specialized authorities are responsible for processing their data in accordance with the applicable specific laws.

2. They define the protection requirements for the data that are generated, displayed, or transmitted in the processing procedure within the authority portal.

3. If multiple specialized authorities are involved in the transaction process, a primary responsible specialized authority must be designated.