Ordinance on the Data Market (Datenmarktverordnung, DMV) - Subject Matter (DMV)

1. The regulation governs the organization, operation, and further development of the data market of the cantonal administration.

1. In the Data Market, personal and factual data that are required by more than one public authority to fulfill their legal duties, pursuant to § 3 para. 1 IDG, are made available on a daily basis on a central platform to public authorities.

2. Religious communities recognized by the canton according to § 133 of the Constitution of the Canton of Basel-Stadt dated March 23, 2005, which have been granted the right to access data, are granted the same access rights to the data of their members.

1. The Conference for Organization and Informatics (COI) acts as the representative of the data-submitting bodies and holds the responsibility for the cantonal data market.

2. The COI coordinates the use of the entire system and issues guidelines for its usage.

3. The COI has the following specific duties

a) Determining the requirements that the entire system must meet and ensuring compliance with these requirements;

b) Establishing quality standards;

c) Ensuring the procedure for the destruction of data;

d) Establishing the necessary protection for the entire system;

e) Risk management;

f) Ensuring the safeguarding of the rights of the affected individuals;

g) Ensuring the consideration of restriction codes;

h) Ensuring that all data is assigned to a data owner;

i) Ensuring a demand-oriented retrieval procedure;

j) Ensuring the compliance with the rights and obligations of the data owner.

1. Public bodies pursuant to § 3 paragraph 1 of the IDG are obligated to make data, which they generate in a specialized application due to a statutory mandate and which are also required by another public body or multiple other public bodies to fulfill their statutory tasks, available to the data market free of charge.

2. The public bodies submitting data have the following tasks in particular

a) Determining the need for protection of the submitted data;

b) Ensuring the correctness of the content and the required quality of the data;

c) Decision on authorization requests pursuant to § 5 paragraph 2.

1. Data Delivery is executed

a) in retrieval procedure

1. as data disclosure via an interface (online access),

2. by providing data via web service, or

3. through periodic and automated provision of lists;

b) by an individual delivery commissioned by the data-supplying entity.

2. Data deliveries as defined in Section 1 item a require authorization by the data owner.

3. Authorizations must be submitted to the Data Protection Officer for preliminary review.

4. Users must authenticate themselves using a method appropriate to the protection requirements to access data stored in the data market or obtained from the data market.

5. They may use the data solely for the purpose specified in the authorization by the data owner.

1. IT BS, as a service provider of the data market, is specifically responsible for

a) the technical operation and technical security of the central platform;

b) the development and further enhancement of the central platform;

c) quality assurance, especially the elimination of duplicates;

d) the activation of data based on an approved request for access.

2. To fulfill the tasks pursuant to paragraph 1, a service agreement shall be concluded between IT BS and the KOI.

3. The functions of development, system administration, and quality assurance must not be performed by the persons responsible for access management and the authorization procedure.

1. The service provider assigns a personal ID to all individuals recorded in the cantonal data market.

2. The public bodies according to § 3 paragraph 1 lit. a and b IDG are obliged to maintain the personal ID in their specialized systems and to transmit it when delivering data to and from the data market.

3. The personal ID may not be communicated or used outside of the cantonal administration.

4. For exchanges with public bodies according to § 3 paragraph 1 lit. c IDG, an identifier other than the personal ID must be used.

1. Data that is no longer needed must be destroyed.

1. If the data market is dissolved, the information assets contained within it must be destroyed.