Ordinance of 16 August 2017 on Information Systems and Data Storage Systems of the Federal Intelligence Service (OSIS-FIS) - Object (VIS-NDB)

This ordinance regulates the operation, content, and use of the following information systems of the Federal Intelligence Service (FIS): a. the Comprehensive Analysis System (IASA FIS) according to Art. 49 of the Intelligence Service Act (LRens); b. the Comprehensive Analysis System for Violent Extremism (IASA-EXTR FIS) according to Art. 50 LRens; c. the Data Indexing System INDEX FIS according to Art. 51 LRens; d. the Case Management System of the FIS (GEVER FIS) according to Art. 52 LRens; e. the Electronic Situation Presentation System (PES) according to Art. 53 LRens; f. the Access Portal for Open Source Intelligence (ROSO portal) according to Art. 54 LRens; g. Quattro P according to Art. 55 LRens; h. the Communication Information System (SICO) according to Art. 56 LRens; i. the Residual Data Storage System according to Art. 57 LRens.

It also regulates the operation, content, and use of data storage systems originating from intelligence gathering abroad (Art. 36, para. 5, LRens) and data obtained through authorized intelligence gathering measures (Art. 58, para. 1, LRens).

In this ordinance, the following terms are defined as: a. data: information recorded in written, visual, or audio form in the information systems and data storage systems of the FIS; b. object: the grouping of data relating to a natural or legal person, a thing, or an event in the FIS information system; c. block of personal data: all data relating to a specific natural or legal person entered in connection with an object; d. original document: the document available in electronic form in read-only mode; e. source document: the result of the structured entry of original documents in the IASA FIS and IASA-EXTR FIS systems; f. relation: the link between objects or between an object and a source document; g. classification: the assignment and storage of original documents in an information or storage system; h. entry: the integration of the content of an original document into an information system through the creation and modification of objects, relations, and source documents.

FIS staff members who assign original documents to an information system within the meaning of Art. 1, para. 1, shall examine before filing: a. whether there is sufficient evidence indicating that they are related to the tasks defined in Art. 6 of the Intelligence Service Act (LRens); b. whether the data processing restrictions outlined in Art. 5, para. 5, LRens, are adhered to; and c. whether the information contained in the original documents is accurate and relevant based on the quality of the sources and the manner of transmission.

In case of doubt, they shall verify the content of the original document in question.

If the verification result is negative, staff members shall destroy the original document or return it to the sender if it is found to have originated from a cantonal enforcement authority.

Original documents containing information on multiple individuals are assessed in their entirety.

If it is evident, based on the annual definition of the priority themes addressed by the FIS, that an original document must be filed within the IASA FIS, the staff member assigns it directly to this information system.

When data must be entered into the INDEX FIS system in the areas referred to in Art. 29, let. b and c, the verification as described in para. 1 is the responsibility of the cantonal enforcement authority's staff member tasked with this job.

The FIS may enable data searches in information and data storage systems through Optical Character Recognition (OCR).

It shall destroy data carriers that are digitized and filed as original documents.

Prior to entering personal data, SRC employees responsible for data entry must verify the connection with the tasks referred to in Art. 6 LRens as well as the relevance and accuracy of this personal data, taking into account the data processing restrictions stated in Art. 5, para. 5, LRens.

If the result of the verification is negative, the employees must destroy the data or return it to the sender if it originates from a cantonal enforcement authority.

When personal data must be entered into the SRC INDEX system in the areas covered by Art. 29, let. b and c, the verification as described in para. 1 is the responsibility of the employee of the cantonal enforcement authority in charge of this task.

SRC employees responsible for data entry shall incorporate all reports from cantonal enforcement authorities into the IASA SRC or IASA-EXTR SRC systems and carry out the verification as described in para. 1.

Access rights to an information system or to a data storage system of the FIS are granted only upon request and on a personal basis. Access rights to the PES system are granted in relation to the functions performed.

The relationship with a purpose registered in the Intelligence Act, the personal details, and the function of the requesting person must be included in the request.

The FIS conducts a formal examination of the request and grants the access rights.

It may revoke access rights that have not been used for more than 6 months.

It is responsible for executing the granting and revocation of access rights to the information and data storage systems it operates itself.

Users of the FIS information systems may simultaneously access all FIS information systems within the limits of their access rights. They have at their disposal the "Integrated Search and Distribution System" (ISDS) function.

Users can establish a relationship between source documents contained in the IASA FIS and IASA-EXTR FIS systems and an object through relationships across multiple systems.

For the purposes of guiding information research or operational analysis, copies of data from FIS information and storage systems may be separately evaluated on the highly secure internal network (SiLAN) within the context of thematically limited projects. This evaluation must be authorized by the FIS.

Upon completion of the evaluation, the responsible parties shall deposit the results into one of the information systems referred to in Art. 1, para. 1, and destroy the copies of the data.

The SRC processes particularly sensitive data outside its information systems when the protection of sources, as outlined in Art. 35 LRens, requires it.

These data must be stored in containers or premises with special protection. They can only be accessed and are not available for particular evaluations.

Only SRC staff responsible for conducting an operation or a source and their deputies have access to this data, as well as the head of information research or their deputy.

The SRC enters intelligence information resulting from an operation or the management of a source pursuant to Art. 4, para. 1, into the IASA SRC or IASA-EXTR SRC systems for evaluation purposes.

At the end of an operation or the management of a source, all personal data stored outside information systems is deleted, except data concerning the source.

The head of information research or their deputy examines at least once a year for each operation and each source management whether the data is processed according to the conditions set out in paras 4 and 5, and if it is still necessary for the fulfillment of the tasks referred to in Art. 6 LRens in view of the current situation. They ensure that all unnecessary data is erased.

The retention period for data relating to operations is a maximum of 45 years.

The FIS ensures that, at the time of deletion, all data that must be archived has been transferred to an archiving module.

It deletes the data in the information and storage systems within a period of 3 months from the expiration of the retention period set forth in Art. 7, para. 7, 21, para. 2, 28, 34, para. 2, 40, 45, 50, 55, 60, 65, and 70.

It deletes an object in IASA FIS or IASA-EXTR FIS when the last related source document has been deleted.

It deletes an original document in IASA-EXTR FIS when the last related source document has been deleted.

It deletes the original documents in IASA FIS no later than the expiration of the retention period (Art. 21, para. 2).

The archiving of data from the information systems of the FIS is based on Art. 68 of the Intelligence Service Act (LRens).

The FIS proposes to the Swiss Federal Archives the data it has transferred to the archiving modules.

It proposes data from preliminary investigations and data related to the management of mandates of cantonal execution authorities within the framework of the ordinary archiving of data from the information systems IASA FIS, IASA-EXTR FIS, and GEVER FIS.

It destroys the data that the Swiss Federal Archives deem to be of no archival value.

The right to be informed of individuals concerned by information processing is based on Art. 63 of the Intelligence Service Act.

If the applicant is registered in the INDEX FIS system in the areas referred to in Art. 29, let. b or c, the FIS addresses the competent cantonal enforcement authority for the communication procedure.

The periodic verification of personal data blocks in the information systems IASA SRC, IASA-EXTR SRC, and Quattro P is based on Articles 20, 27, and 54. The periodic verification of reports from cantonal enforcement authorities is based on Article 33.

The internal quality control service of the SRC conducts a sample check at least once a year on the legality, appropriateness, effectiveness, and accuracy of data processing in all SRC information systems. It establishes a control plan for this purpose.

The internal quality control service of the SRC verifies personal data blocks and deletes all related data pursuant to Article 5, paragraph 6, of the Intelligence Service Act (LRens), in connection with: a. organizations and groups removed from the observation list under Article 72 LRens; b. individuals, organizations, and groups for which the SRC has ordered a review procedure according to Article 37 of the Ordinance of August 16, 2017, on Intelligence (ORens), when that procedure has been completed without the concerned organizations and groups being recorded in the observation list;

It verifies at least once a year, within personal data blocks, the data that has been exceptionally collected and entered based on Article 5, paragraph 6, LRens, without connection to the observation list as defined in Article 72 LRens nor a review procedure according to Article 36 ORens, and deletes these data as soon as the activities mentioned in Article 5, paragraph 6, LRens, can be excluded or when no evidence has confirmed these activities within one year after entry.

It ensures compliance with the provisions of this ordinance through internal training and regular checks. It requests the director of the SRC or his deputy to take measures when irregularities are detected during its controls.

The director of the SRC or his deputy may assign other checks to the internal quality control service of the SRC in the information and data storage systems pursuant to Articles 36, paragraph 5, 47, and 58, paragraph 1, LRens.

The FIS defines the responsibility and competence related to its information and data storage systems in the relevant processing regulations.

To ensure data security, the following apply: a. Articles 1 to 4 and 6 of the Ordinance of August 31, 2022, on Data Protection; b. the Ordinance of November 8, 2023, on Information Security; c. ... d. ...

The FIS sets out in the processing regulations the technical and organizational measures designed to prevent data processing by unauthorized persons.

SiLAN is the ICT environment operated by the FIS with a highly secure computer network.

All classified data can be processed within the SiLAN network, regardless of their classification level.

Only FIS employees, cantonal enforcement authorities, the supervisory authority as defined in Art. 75 of the Intelligence Service Act, the military intelligence service, and the FIS's ICT provider who have been granted the necessary rights pursuant to Art. 5 have access to the SiLAN network. Contractors who have been granted access by the aforementioned services are subject to the same terms of use.

The Confederation finances the integration of cantonal enforcement authorities into the SiLAN network.

The transmission of data outside the SiLAN network is governed by the Ordinance of 8 November 2023 on Information Security.

FIS ISDS comprises: a. a classification system for the entry and consultation of data; b. an analysis and situation monitoring system for the entry, processing, and analysis of data across multiple systems.

IASA FIS contains data related to natural and legal persons, objects, and events concerning the tasks listed in Art. 6, para. 1, of the Intelligence Service Act, with the exception of data on violent extremism.

Objects and source documents, as well as their interrelations, can be visually represented, and these representations may be recorded.

IASA FIS can contain personal data, whether sensitive or not, including personal data that allows for the assessment of the threat a person represents.

The catalog of personal data is listed in Annex 1.

The FIS personnel responsible for data entry assess the relevance and accuracy of the personal data they are required to input.

They mark source documents that: a. are evaluated as misinformation or incorrect information and are necessary for the assessment of the situation or a source, or that b. have been collected pursuant to Art. 5, para. 6, of the Intelligence Service Act (ISA).

They mark items related to natural or legal persons that have been collected based on the observation list pursuant to Art. 72 ISA or an examination procedure according to Art. 37 of the Ordinance on the Federal Intelligence Service (OFIS).

Access rights are based on Art. 49, para. 3, of the Intelligence Service Act.

Annex 2 regulates individual access rights.

The FIS employees responsible for data entry periodically review the blocks of personal data.

In doing so, they undertake the following tasks: a. they verify, considering the current situation, whether the data block is still necessary for the achievement of the FIS's tasks as per Art. 6 of the Intelligence Service Act (LRens), and whether the data processing restrictions set out in Art. 5, paragraphs 5 and 6, LRens, are respected; b. they delete data that the FIS no longer needs; c. they correct, mark, or delete data that has been found to be inaccurate; d. they document the execution and the result of the review when they have made a correction, marking, or deletion.

The periodic review occurs at the latest when the deadlines stated below have elapsed since the entry of the object or the last periodic review: a. international terrorism: 10 years; b. prohibited intelligence activities, dissemination of nuclear, biological, or chemical weapons, including their vectors, and all goods and technologies for civilian or military purposes necessary for the manufacture of these weapons (NBC proliferation) or illegal trade of radioactive substances, military equipment, and other armaments: 15 years; c. other important information relevant to security policy: 20 years.

When a personal data block contains source documents from multiple domains, the shortest deadline applies.

The following retention periods apply to the source documents recorded in the IASA FIS system: a. for data relating to international terrorism: up to 30 years; b. for data referred to in Art. 20, para. 3, let. b: up to 45 years; c. for data on entry bans: up to 10 years after the expiry of the entry ban, up to 35 years in total; d. for data concerning relevant information in security policy matters: up to 45 years.

The retention period for original documents that are not related to a source document is up to 15 years.

IASA-EXTR FIS includes: a. a filing system for the entry and consultation of data; b. an analysis and situational monitoring system for the entry, processing, and analysis of data across multiple systems.

IASA-EXTR FIS contains data relating to: a. natural and legal persons, objects, and events having a direct or indirect relationship with groups determined by the Federal Council pursuant to Art. 70, para. 1, letter c, of the Intelligence Service Act; b. natural and legal persons who reject democracy, human rights, and the rule of law and who, to achieve their goals, commit acts of violence, advocate for or support such acts.

Objects and source documents, as well as the relationships between them, may be visually represented, and these representations may be recorded.

IASA-EXTR FIS may contain personal data, whether sensitive or not, including personal data that allows for the assessment of the threat posed by a person.

The catalog of personal data is listed in Annex 1.

Prior to entering new information, the employees of the FIS responsible for data entry assess whether this information confirms or contradicts the relevance of the concerned natural or legal person for fulfilling intelligence tasks in the field of violent extremism.

They tag the source documents based on data that: a. are considered uncertain due to their origin, type of transmission, content, and available findings; b. are assessed as misinformation or erroneous information that are necessary for assessing the situation or a source; c. have been collected pursuant to Art. 5, para. 6, Intelligence Act.

They tag items related to natural and legal persons: a. that have been collected based on the observation list under Art. 72 of the Intelligence Act or an examination procedure according to Art. 37 of the Intelligence Ordinance; b. that do not belong to any group determined by the Federal Council pursuant to Art. 70, para. 1, let. c, of the Intelligence Act, or that c. have an identifiable relationship with an item but no inherent relevance in connection with the activities of violent extremism (third parties).

An original document may be entered in IASA-GEX NDB only if a connection is established between said document and a source document as well as an item.

The responsible employees enter these data provisionally and tag them accordingly.

The FIS may use data relating to natural and legal persons contained in original documents for the development of an intelligence product only if there is an item related to the person in question.

The internal quality control service of the FIS verifies that the data has been entered legally. It particularly assesses the relevance and accuracy of the markings.

It confirms the final entry of this data by marking it accordingly.

It deletes the data that it has not confirmed and communicates its reasons to the service that entered said data.

Access rights are based on Art. 50, para. 3, of the Intelligence Service Act (LRens).

Annex 2 regulates individual access rights.

The internal quality control department of the FIS verifies blocks of personal data no later than 5 years after their entry. Subsequently, it conducts at least every 3 years a periodic verification of the blocks of personal data.

For this purpose, it performs the following tasks: a. it verifies, in light of the current situation, whether the blocks of personal data are still useful for accomplishing the tasks outlined in Art. 6 of the Intelligence Service Act; b. it deletes data that is no longer needed by the FIS; c. it corrects, marks, or deletes data that proves to be inaccurate; d. it records the execution and the result of the verification when the block of personal data is not erased.

Data that has been marked as uncertain for more than 5 years after entry may continue to be used until the next periodic verification only if: a. they are necessary for fulfilling the tasks assigned to the FIS by law, and b. the director of the FIS or their deputy has authorized the continued use.

The internal quality control department of the FIS deletes during the first periodic verification the items designated as personal data of third parties.

The retention period for source documents in the IASA-EXTR FIS system is a maximum of 15 years.

The retention period in the IASA-EXTR FIS system for source documents containing data on entry bans is a maximum of 10 years after the expiration of the entry ban, with a total maximum of 35 years.

The FIS INDEX includes: a. a directory for determining whether the FIS processes data relating to a natural or legal person, an object, or an event in the IASA FIS or IASA-EXTR FIS systems (IASA INDEX); b. a system for classifying, capturing, processing, consulting, and evaluating data from preliminary investigations by cantonal enforcement authorities (FIS Cantonal INDEX); and c. a system for managing mandates and for preparing, transmitting, and classifying reports from cantonal enforcement authorities as well as for classifying products received by the FIS.

The content of the INDEX FIS system is based on Art. 51, para. 3, of the Intelligence Service Act (LRens).

If reasons related to the protection of sources as provided in Art. 35 of the Intelligence Service Act (LRens) require, the data processed in the IASA FIS or IASA-EXTR FIS systems concerning natural and legal persons are, exceptionally, not transferred to the IASA INDEX system.

The INDEX FIS can contain personal data, whether sensitive or not, including personal data that allows the assessment of the threat posed by an individual.

Data concerning third parties processed in IASA-EXTR FIS do not appear in IASA INDEX.

The catalog of personal data is listed in Annex 1.

Cantonal executive authorities process the data necessary for the execution of the Intelligence Service Act (LRens) exclusively within the domains provided for this purpose in the INDEX FIS system. In doing so, they comply with the data processing restrictions outlined in Art. 5, para. 5, of the LRens.

Access rights are based on Art. 51, para. 4, of the Intelligence Service Act.

Annex 3 governs individual access rights.

The internal quality control service of the FIS verifies the reports from the cantonal executive authorities that appear in the INDEX FIS system no later than 5 years after their entry into the IASA FIS and IASA-EXTR FIS systems. It then conducts a periodic verification of the reports at least every 5 years.

For this purpose, it undertakes the following tasks: a. it checks, in light of the current situation, whether the report is still useful for carrying out the tasks referred to in Art. 6 of the Intelligence Act; b. it deletes reports that have become unnecessary as well as source documents, relationships, and objects based solely on these reports; c. it rectifies, marks, or erases data that proves to be inaccurate; d. it records the execution and result of the verification when the report is not deleted.

The internal quality control service of the FIS conducts an annual random check in accordance with Art. 11, para. 2, following a plan established in the areas referred to in Art. 29, letters b and c.

Deletions in the IASA FIS and IASA-EXTR FIS information systems automatically result in the removal of the corresponding data in the FIS INDEX.

The retention period for data in the areas referred to in Art. 29, let. b and c, is a maximum of 5 years.

At the request of the cantonal enforcement authorities or after 5 years, the FIS internal quality control service deletes the data in accordance with para. 2. The cantonal enforcement authorities may independently destroy erroneous entries within a period of 10 days.

GEVER FIS consists of: a. a data classification and processing system used for the management and control of case processing as well as the efficiency of work processes; b. a system in which ongoing and completed mandates can be consulted and processed, and c. a search engine allowing for full-text search within the GEVER FIS system.

The content of the GEVER FIS system is based on Art. 52, para. 2, of the Intelligence Act.

Notwithstanding Art. 11 of the GEVER Ordinance of April 3, 2019, data classified as "confidential" and "secret" are entered into the GEVER FIS system without encryption.

The catalog of personal data is listed in Annex 1.

The rights of access are based on Art. 52, para. 3, of the Intelligence Service Act.

Annex 4 governs the individual rights of access.

The FIS staff responsible for files stored in GEVER verify annually, taking into account the current situation, whether the data in the files are still necessary for the processing and oversight of matters as well as for the efficiency of the FIS's work processes.

They delete data that have become unnecessary.

They correct, mark, or delete data found to be inaccurate.

The FIS's internal quality control service conducts an annual random check in the sense of Art. 11, para. 2.

Reports from services, situation reports, and the communication of data to third parties must not be based on data from the GEVER FIS system. The internal quality control department of the FIS conducts random checks to ensure compliance with the embargo on utilization.

The retention period for data in the FIS GEVER system is a maximum of 20 years.

The PES system comprises domains sorted by events and themes for the purpose of classifying, processing, consulting, and evaluating the following data: a. data correlated with intelligence networks relating to events; b. periodic situation reports, situation follow-ups, and documentation; c. data on the logbook management of the FIS duty service.

The content of the PES system is based on Art. 53, para. 2, of the Intelligence Service Act (LRens).

The catalog of personal data is listed in Annex 5.

Personal data is processed in the PES system only if it is essential for the presentation and assessment of the situation or for police defense actions.

Access rights are based on Art. 53, paragraphs 3 and 4, of the Intelligence Service Act (ISA).

The authorities and offices mentioned in Annex 3 of the Ordinance on the Intelligence Service (OISA) have access to the PES system for the purposes indicated in the said annex and under the conditions set therein.

In the event of an incident involving an increased security threat, the FIS may grant temporary access to certain contents of the PES system to private services and foreign security and police authorities, provided that the services and authorities concerned: a. are directly or indirectly affected by an event; b. can contribute to a better understanding and assessment of the situation through the information and knowledge they possess, or c. participate in the steering or implementation of security measures.

It may require the authorities and services mentioned in paragraph 2 to report on the use of such data.

Annex 6 regulates individual access rights.

The FIS employees responsible for the classification and processing of data in the PES system annually verify, taking into account the current situation, whether the data in the PES system is still necessary for the performance of the tasks referred to in Art. 6 FISA. The data referred to in para. 4 is excluded from this verification.

The involved employees delete the data that has become unnecessary.

They correct, mark, or delete data that prove to be inaccurate.

The employees of the Federal Office of Police responsible for the classification of data in the PES system annually verify the data submitted by the Federal Office of Police. They check that the data is still necessary for the guidance and implementation of police security measures or police defense actions.

The FIS's internal quality control service conducts an annual sampling verification as per Art. 11, para. 2.

The retention period for data contained in the PES system is a maximum of 3 years.

The retention period for data entered by the Federal Office of Police is a maximum of 2 years.

The ROSO portal includes a data storage system classified by sources and themes. It is used for the research and evaluation of data from public information sources.

The content of the ROSO portal is based on Art. 54, para. 2, of the Intelligence Service Act (LRens).

The FIS transfers personal data into the ROSO portal that are classified within the FIS IASA or FIS IASA-EXTR systems pursuant to Art. 4, para. 1, or within the FIS GEVER system pursuant to Art. 3, para. 1, before such data is used or communicated.

It may automatically store data in the ROSO portal if it ensures through processes and directives that the data is related to the tasks outlined in Art. 6 LRens.

The catalog of personal data is listed in Annex 1.

Access rights are based on Art. 54, para. 3 and 4, Intelligence Service Act (LRens).

Appendix 7 regulates individual access rights.

The internal quality control service of the FIS conducts an annual random sampling inspection pursuant to Art. 11, para. 2.

The retention period for data found in the ROSO portal is a maximum of 2 years.

The retention period for data found in the ROSO portal and collected as part of jihadism monitoring is a maximum of 5 years.

The Quattro P system includes domains for classifying, entering, consulting, and evaluating data transmitted by border control authorities to the FIS.

The content of the Quattro P system is based on Art. 55, para. 2, of the Intelligence Services Act (LRens).

The FIS transfers personal data classified in the IASA FIS or IASA-EXTR FIS systems in accordance with Art. 4, para. 1, or in the GEVER FIS system in accordance with Art. 3, para. 1, into Quattro P before such data is used or communicated.

It can automatically store data in Quattro P if it ensures through processes and directives that they relate to the non-public list referred to in Art. 55, para. 4, of the LRens.

The catalog of personal data is listed in Appendix 8.

The access rights are based on Art. 55, para. 3, of the Intelligence Service Act (LRens).

The FIS employees responsible for data entry in Quattro P may modify or delete data to the extent that these operations are necessary for the fulfillment of the tasks assigned to them by law.

Annex 9 governs the individual access rights.

FIS staff responsible for the Quattro P data entry verify at least once a year if the personal data blocks transmitted to the FIS by border control authorities coincide with the list established by the Federal Council pursuant to Art. 55, para. 4, FIS Act.

They delete data that has become unnecessary.

They correct, mark, or delete data that is found to be inaccurate.

The internal quality control service of the FIS conducts an annual sample check in accordance with Art. 11, para. 2.

The retention period for data contained in the Quattro P system is a maximum of 5 years.

The SICO system includes a data storage system that allows for the management of radio exploration and cable network exploration resources, ensures management control, and provides for the establishment of reports.

The content of the SICO system is based on Art. 56, para. 2, of the Intelligence Service Act (LRens).

Data recorded from radio reconnaissance and cable network exploration may be referenced in the SICO system in order to direct exploration resources, ensure management control, and prepare reports.

The Federal Intelligence Service (FIS) may automatically store data in the SICO system if it ensures through processes and directives that the data is related to the FIS tasks defined in Art. 6 of the LRens.

The catalog of personal data is listed in Annex 10.

The access rights are based on Art. 56, para. 3, of the Federal Intelligence Service Act (LRens).

Annex 11 governs the individual access rights.

The FIS employees responsible for classifying data in the SICO system verify annually, taking into account the current situation, whether the data in the SICO system used to direct reconnaissance resources, ensure management control, and compile reports are still necessary.

They erase data related to completed reconnaissance mandates that have become unnecessary.

They correct, mark, or erase data that proves to be inaccurate.

The internal quality control service of the FIS conducts an annual survey-based check in accordance with Art. 11, para. 2.

The retention period for data contained in the SICO system is a maximum of 5 years following the completion of the relevant exploration mandate.

The residual data storage system is used to store and retrieve data that has not been directly assigned to another information or storage system.

The FIS transfers the data from the residual data storage system that it needs for the performance of its tasks into an information system within the meaning of Art. 1, para. 1, in accordance with Art. 3, para. 1, and destroys in the residual data storage system those that have been transferred. The FIS may use personal data among the transferred data for the creation of an intelligence product only if they have been entered into the IASA FIS system or IASA-EXTR FIS system in accordance with Art. 4, para. 1, or if they have been classified in the GEVER FIS system in accordance with Art. 3, para. 1.

The content of the residual data storage system is based on Art. 57, para. 1, of the Intelligence Service Act (LRens).

The catalog of personal data is listed in Annex 1.

Access rights are based on Art. 57, para. 3, of the Intelligence Services Act.

Annex 12 regulates individual access rights.

The internal quality control department of the FIS conducts an annual random sampling control as per Art. 11, para. 2.

The retention period for data in the residual data storage system is a maximum of 5 years.

The FIS storage systems are used to store, consult, and evaluate on a case-by-case basis the data derived from authorized research measures under Article 26 of the Intelligence Service Act (ISA) and international research pursuant to Article 36, paragraph 5, of the Intelligence Service Act (ISA).

They are operated independently of the FIS information systems.

The storage systems contain data related to natural and legal persons, objects, and events.

They may contain personal data, whether sensitive or not, including personal data that allows for the assessment of the threat posed by a person.

The catalog of personal data is listed in Annex 1.

Access rights are based on Art. 58, para. 5, FISA.

Separate access rights must be established for each operation as defined in Art. 12 FISO. These rights apply to all data resulting from research measures carried out in connection with the operation.

Individual access rights are stipulated in Annex 13. They are subject to the FIS's authorization for each research measure.

The FIS may use or communicate data from authorized intelligence measures and foreign investigations only after transferring them into the IASA FIS system in accordance with the conditions mentioned in Art. 4, para. 1.

The internal quality control service of the FIS conducts random checks to ensure compliance with the restriction of use and the obligation to destroy as per Art. 58, para. 2, of the Intelligence Service Act.

The FIS deletes data from authorized search measures that are not used in a judicial proceeding or in an ongoing operation: a. no later than 6 months after communication to the person concerned pursuant to Art. 33, para. 1, of the Intelligence Service Act (ISA); b. immediately after the decision becomes final regarding the waiver of the obligation to communicate the information to the person concerned pursuant to Art. 33, para. 3, ISA; or c. immediately after the decision becomes final regarding an appeal against the ordered measure.

When the communication is postponed, the data must be deleted no later than 6 months after the communication.

The retention period for data resulting from foreign searches, referred to in Art. 36, para. 5, ISA, is no more than 3 years.

The following acts are repealed: 1. Ordinance of October 8, 2014, on the Information Systems of the Federal Intelligence Service; 2. DDPS Ordinance of July 27, 2015, on the Data Fields and Access Rights to the ISAS and ISIS Information Systems.

The deadlines stipulated in Arts. 20, 27, and 33 for the periodic verification of personal data blocks commence at the time of their initial entry or their last periodic verification within the information systems for external security (ISAS) and for internal security (ISIS) as referred to in Art. 1, letters a and b, of the Ordinance of 8 October 2014 on the Information Systems of the Federal Intelligence Service.

The annual verifications stipulated in Arts. 38, 44, and 59 and the periodic verification as per Art. 54 are conducted for the first time in 2018.

The retention periods of data in the information systems listed in Art. 1 commence at the time of their initial entry into the information systems referred to in Art. 1 of the Ordinance of October 8, 2014, on the Information Systems of the Federal Intelligence Service.

The deadline for migrating data from the former cantonal information systems to the INDEX FIScant system, pursuant to Art. 29, let. b and c, is one year. A right of access for reading is ensured until the end of the migration.

This ordinance enters into force on September 1, 2017.