Ordinance on the Monitoring of Internet Use by State Personnel - Subject Matter

1. This regulation governs the monitoring of internet use by state personnel, regardless of the hardware used and whether it belongs to the employer or to the employee.

2. For the purposes of this regulation, internet use includes the use of the internet and intranet, including email and social media.

1. Internet refers to the network of networks that unites all users who employ the same transmission protocol.

2. Intranet refers to the system that uses Internet transmission protocols within a company, either as a local network or a remote network.

3. E-Mail refers to the services of electronic transmission of addressed messages between terminals, whereby these messages can be stored in an "electronic mailbox" of a central computer or on a server.

4. Social Media are internet-based electronic tools that enable users to communicate with each other and to create media content individually or collectively (social networks; websites for exchanging and sharing content such as videos, knowledge, and information; blogs, chats, and forums).

1. This regulation aims to prevent the abusive use of the internet by state employees, and it governs the identification of any potential abuses.

2. It applies to all state employees, including those of judicial authorities and members of the teaching staff.

1. Internet usage is reserved for professional purposes.

2. Occasional internet usage, including the use of email and social media for private purposes, is tolerated within the limits arising from the duty to devote the entire working time to official activities (Art. 58 Para. 1 StPG).

3. Not allowed for private purposes are

a) ...

b) Financial transactions (namely "telebanking") or the use of chargeable sites;

c) The visiting of websites with erotic, violent, or racist content.

4. The employer may block access to websites that excessively strain the information systems.

1. For downloading software, prior authorization is necessary, which is granted either generally or on a case-by-case basis by the Office of Information Technology and Telecommunications (the Office) or the competent IT department.

1. Employees shall conduct themselves in accordance with the trust and reputation associated with their role. In particular, they are required to comply with the agreements and regulations concerning the protection of personal data and data security, as well as those pertaining to copyright protection.

1. Anonymous Monitoring of Internet Use - The anonymous monitoring of internet usage involves the creation of anonymous statistics (a procedure in which users cannot be identified) concerning the most visited sites, the number of accesses, as well as the total time spent visiting websites and the volume of email traffic.

2. The Office conducts anonymous checks at regular intervals in compliance with the provisions of data protection legislation. In sectors not subject to monitoring by the Office, the anonymous checks are carried out by the respective IT departments, which may involve the Office if necessary.

3. The results of the anonymous checks are forwarded quarterly to the management and the head of the administrative unit.

1. If anonymous checks or other findings provide indications of abusive Internet usage, personalized checks may be conducted.

2. Indications of abusive Internet usage include an abnormally long duration of time spent online in relation to the work to be completed, frequent visits to websites that have no discernible connection to the performed function, or visits to prohibited websites.

3. When using email, the monitoring is limited to the number of sent and received emails, the address elements, as well as the type and size of attached files. The content of the emails is not monitored.

1. Personal checks are ordered by the director or by the head of the administrative unit.

2. The checks are conducted by the office or by the responsible IT department.

1. If it is determined that a service obligation was violated during internet use, the head of the administrative unit, or if necessary, the directorate, shall take appropriate measures in accordance with the legislation on state personnel after hearing the employee.

1. The office or the competent IT department, as well as the directorate and the head of the administrative unit, can retain the data from personal checks for six months. Thereafter, this data shall be destroyed.

2. The retention of this data in the dossier of an administrative or disciplinary proceeding is reserved.

1. The processing of data within the framework of personal checks is subject to data protection legislation.

1. The financial directorate is entrusted with the execution of this ordinance, which shall come into force on October 1, 2002.