Kanton Glarus (IDAG)

Subject Matter

1 This Act governs

a. the official information of the public;

b. access to official documents;

c. the handling of personal data by public bodies;

d. archiving.

1. Dieses Gesetz gilt für sämtliche öffentlichen Organe.

2. Es gilt nicht, soweit öffentliche Organe am wirtschaftlichen Wettbewerb teilnehmen, dabei privatrechtlich und nicht in Erfüllung einer öffentlichen Aufgabe handeln. Soweit dabei Personendaten bearbeitet werden, ist das Bundesgesetz über den Datenschutz[[2]](#paragraphtext_content_fn_626105_2_2_c) anwendbar. Die Aufsicht richtet sich nach diesem Gesetz.

3. Die Bestimmungen über den informationsrechtlichen Zugang zu amtlichen Dokumenten gelten nicht für Leistungserbringer des Gesundheits- und Sozialwesens, insbesondere für das Kantonsspital Glarus und für die Sozialversicherungen Glarus.

4. Die Rechte und Ansprüche von betroffenen Personen während hängigen Verfahren der Zivil-, Straf- und Verwaltungsrechtspflege richten sich nach dem anwendbaren Verfahrensrecht.

5. Von der Aufsicht durch die Fachstelle Datenschutz ausgenommen sind

| | | | | | --- | --- | --- | --- | | a. | der Landrat; | | |

| | | | | | --- | --- | --- | --- | | b. | der Regierungsrat; | | |

| | | | | | --- | --- | --- | --- | | c. | die kantonalen Gerichte; | | |

| | | | | | --- | --- | --- | --- | | d. | die kantonalen Rekurskommissionen; | | |

| | | | | | --- | --- | --- | --- | | e. | die kantonale Schlichtungsbehörde; | | |

| | | | | | --- | --- | --- | --- | | f. | die Landeskirchen und ihre Kirchgemeinden; | | |

| | | | | | --- | --- | --- | --- | | g. | die Glarner Kantonalbank; | | |

| | | | | | --- | --- | --- | --- | | h. | die Anwaltskommission und die von ihr beaufsichtigten Urkundspersonen. | | |

Official Document

1 An official document is any information that

a. is recorded on any information carrier;

b. is under the control of a public body, from which it originates or to which it has been communicated;

c. concerns the performance of a public task.

2 Information is not considered an official document if it

a. is commercially exploited;

b. is not yet finalized;

c. is intended for personal use, such as work tools, personal documents, or emails;

d. is entered in an appointment calendar, agenda, or weekly schedule.

3 Information that can be created through a simple electronic process from recorded information meeting the requirements of paragraph 1 is also considered an official document.

Public Body

1 The following are considered public bodies

a. the authorities, administrations, and commissions of the canton and the municipalities;

b. the authorities, administrations, and commissions of cantonal and communal public-law corporations, institutions, and foundations;

c. natural or legal persons or other organizations under public or private law, insofar as they fulfill a public task.

Personal Data

1 Personal data are information relating to an identified or identifiable natural person.

2 Particularly sensitive personal data are those for which processing poses an increased risk of a personality violation.

2

I F/1

3 Master data are personal data for which processing poses a low risk of a personality violation.

Data Subject

1 A data subject is a natural person whose personal data are processed.

Processing, Profiling

1 Processing means any handling of personal data, irrespective of the means and procedures used, in particular the collection, storage, retention, use, alteration, disclosure, archiving, deletion or destruction of, and the performance of logical or arithmetical operations with, personal data.

2 Profiling means any automated evaluation of personal data to analyze personal characteristics or to predict developments, particularly regarding work performance, economic situation, health, intimate sphere, or mobility.

3 Results from profiling are considered particularly sensitive personal data.

Violation of Data Security

1 Data security is violated if personal data, regardless of intent

a. is lost, destroyed, deleted, or altered;

b. is disclosed or made accessible to unauthorized persons.

Anonymisation, Pseudonymisation

1 Anonymisation involves altering personal data in such a way that the information concerning personal or material circumstances can no longer be attributed to a specific or identifiable natural person, or can only be attributed with a disproportionately high effort.

2 Pseudonymisation involves altering personal data in such a way that, without the use of additional information, the personal data can no longer be attributed to a specific or identifiable natural person.

3

I F/1

2. Principle of Public Access

2.1. Informing the Public

Information of the Public

1 Public bodies shall inform the public ex officio about matters of general interest.

2 Information may be provided about pending proceedings

a. if this is necessary to avoid or correct false reports;

b. in cases of particular general interest.

3 Information is inadmissible if

a. it is prohibited by law;

b. overriding public or private interests oppose it.

4 The information must be prompt, comprehensive, factual, and clear.

**2.2. Access to Official Documents**

Right of Access

1 Every person has the right of access to official documents.

2 If an official document is published in a publication organ or on the public

body's website, the right of access is deemed to be fulfilled.

3 Special statutory provisions that stipulate deviating conditions for access

to certain information remain reserved.

Exclusion

1 Access is excluded to

a. Documents and minutes of non-public sessions;

b. Official documents concerning pending matters and proceedings or

regarding positions in ongoing contract negotiations;

c. Official documents that are designated as secret or confidential by

special legislation.

2 Sessions of public bodies are considered non-public, unless they are declared

public.

Restrictions

1 Access to official documents shall be restricted, deferred,

or denied, to the extent that overriding public or private interests

preclude it.

4

I F/1

2 Overriding public interests exist in particular if, by granting access

a. the free formation of opinion and will of the public body

could be impaired;

b. the position of a public body in ongoing or foreseeable

negotiations could be jeopardized;

c. the goal-oriented implementation of specific measures of public

bodies could be impaired;

d. information could be disclosed that has been voluntarily communicated

to the public body by third parties under assurance of confidentiality;

e. public order or security could be jeopardized;

f. relations with other communities could be impaired.

3 Overriding private interests exist in particular if, by granting access

a. the privacy of third parties could be impaired;

b. professional, business, or manufacturing secrets could be disclosed;

c. copyright could be infringed.

4 If the official document contains personal data of third parties, these shall, if

possible, be anonymized or pseudonymized before access is granted (Art. 31).

3. Data Protection

3.1. Prerequisites for the Processing of Personal Data

Lawfulness

1 Public bodies may only process personal data if and to the extent that

a. a legal basis exists for it;

b. it is necessary for the performance of a public task based on a legal basis;

c. the data subject has consented;

d. the data subject has made the information generally accessible;

e. the consent of the data subject cannot be obtained or can only be obtained with disproportionate effort, but can be presumed based on the circumstances; or

f. the data subject claims public services.

5

I F/1

2 The processing of particularly sensitive personal data and profiling are only permissible if and to the extent that

a. a basis in law exists for it;

b. it is necessary for the performance of a task clearly defined in law;

c. the data subject has consented;

d. the data subject has made the information generally accessible;

e. the consent of the data subject cannot be obtained or can only be obtained with disproportionate effort, and the data processing is exclusively in the interest of the data subject; or

f. the data subject claims public services.

3 Consent is legally sufficient if it has been given after adequate information, voluntarily, and unambiguously, or, for the processing of particularly sensitive data and profiling, explicitly. It is limited to the individual case and can be revoked at any time.

Proportionality

1 Public bodies may process only those personal data that are suitable and necessary for the fulfillment of their public task in terms of personal, factual, and temporal aspects.

3.2. Principles for the Processing of Personal Data

Accuracy

1 Personal data must be accurate and, to the extent required by the purpose

of processing, complete and up-to-date.

2 The burden of proof for accuracy lies with the public body. The data subject

shall cooperate in the clarification process.

Data Security

1 Personal data must be secured by appropriate organizational and technical

measures, so that a data security breach can be avoided.

2 The measures and their appropriateness depend in particular on

a. the risk of a violation of personality rights or fundamental rights;

b. the purpose and scope of processing;

c. the current state of the art.

6

I F/1

1. Personendaten dürfen nur für Zwecke bearbeitet werden, die

| | | | | | --- | --- | --- | --- | | a. | bei der Beschaffung angegeben wurden; | | |

| | | | | | --- | --- | --- | --- | | b. | aus den Umständen ersichtlich sind; | | |

| | | | | | --- | --- | --- | --- | | c. | gesetzlich vorgesehen sind. | | |

specified during acquisition;

are evident from the circumstances;

are legally provided for.

Data Avoidance and Data Minimisation

1 The public body designs its handling of information in such a way that

a. no or as little personal data as possible is collected;

b. the processing of personal data is restricted to the minimum necessary for the purpose of use.

2 It makes use of the possibilities of anonymisation and pseudonymisation, insofar as this is possible and the effort is proportionate to the intended protection objective.

3.3. Acquisition of Personal Data

1. Personendaten müssen bei der betroffenen Person selbst beschafft werden.

2. Personendaten dürfen bei anderen öffentlichen Organen oder bei Dritten beschafft werden, wenn und soweit

| | | | | | --- | --- | --- | --- | | a. | eine gesetzliche Bestimmung es erlaubt; | | |

| | | | | | --- | --- | --- | --- | | b. | eine direkte Erhebung bei der betroffenen Person nicht möglich oder unverhältnismässig ist; | | |

| | | | | | --- | --- | --- | --- | | c. | die Natur der öffentlichen Aufgabe es erfordert. | | |

eine gesetzliche Bestimmung es erlaubt;

eine direkte Erhebung bei der betroffenen Person nicht möglich

oder unverhältnismässig ist;

die Natur der öffentlichen Aufgabe es erfordert.

Informationspflichten

1 Das öffentliche Organ informiert die betroffene Person bei der Beschaffung

angemessen über

a. die Identität und die Kontaktdaten des verantwortlichen öffentli-

chen Organs;

b. die bearbeiteten Personendaten und deren Kategorie;

c. die Rechtsgrundlage und den Zweck der Bearbeitung;

d. die Empfängerinnen und Empfänger oder die Kategorie der Emp-

fängerinnen und Empfänger, falls die Daten weitergegeben wer-

den.

2 Die Informationspflicht gilt auch dann, wenn Personendaten bei anderen

öffentlichen Organen oder Dritten beschafft werden.

3 Die Informationspflicht entfällt, wenn und soweit

a. die betroffene Person bereits über die Angaben nach Absatz 1

verfügt;

b. die Bearbeitung der Personendaten gesetzlich ausdrücklich vor-

gesehen ist;

c. die Information nicht oder nur mit unverhältnismässigem Aufwand

möglich ist.

4 Die Mitteilung der Information kann unter denselben Voraussetzungen ein-

geschränkt, aufgeschoben oder unterlassen werden wie das Recht auf Zu-

gang zu den eigenen Personendaten nach Artikel 37.

3.4. Bekanntgabe von Personendaten

---

a statutory provision permits it;

direct collection from the data subject is not possible

or is disproportionate;

the nature of the public task requires it.

Information Obligations

1 When collecting personal data, the public body shall adequately inform the data subject about

a. the identity and contact details of the responsible public

body;

b. the personal data processed and their category;

c. the legal basis and the purpose of processing;

d. the recipients or the category of recipients, if the data are disclosed.

2 The duty to inform also applies when personal data are collected from other public bodies or third parties.

3 The duty to inform does not apply if and to the extent that

a. the data subject already possesses the information specified in paragraph 1;

b. the processing of personal data is expressly provided for by law;

c. providing the information is not possible or would involve disproportionate effort.

4 The communication of the information may be restricted, postponed, or withheld under the same conditions as the right to access one's own personal data under Article 37.

3.4. Disclosure of Personal Data

Disclosure to Public Bodies

1 Personal data may be disclosed to other cantonal and inter-cantonal public bodies if and to the extent that

a. the conditions for processing personal data (Art. 14 and 15) are met;

b. the superior public bodies require the personal data in the context of their supervisory activities.

2 Master data may also be disclosed if the conditions of paragraph 1 are not met.

Disclosure to Private Individuals

1 Public bodies shall only disclose personal data to private individuals if and to the extent that

a. there is a legal basis for doing so;

b. the disclosure is necessary to fulfill a legal task;

c. the data subject has consented in accordance with Article 14 paragraph 3;

d. the requesting person credibly demonstrates that the data subject refuses consent or blocks disclosure in order to thwart the enforcement of legal claims or the protection of other legitimate interests;

e. the personal data are generally accessible or contained in public registers and official publications;

f. the requesting person provides an assurance that the personal data will be used exclusively for non-profit or legitimate ideal purposes and will not be further disclosed.

2 Master data may also be disclosed if the conditions of paragraph 1 are not met.

3 Disclosure for commercial purposes is only permissible if a legal basis for it is provided by law.

8

Bekanntgabe ins Ausland I F/1

**Disclosure Abroad I F/1**

1 Personal data may be disclosed abroad if an adequate level of data protection is ensured in the recipient country.

2 If an adequate level of data protection is not ensured, personal data may be disclosed abroad in individual cases if and to the extent that

a. there is an international legal obligation to disclose;

b. the data subject has consented in accordance with Article 14 paragraph 3;

c. the personal data are publicly accessible or are contained in public registers and official publications;

d. they are indispensable for the protection of legitimate interests or the establishment, exercise or enforcement of legal claims before a court;

e. the processing is directly related to the conclusion or performance of a contract and involves only personal data of the contracting parties.

3 If personal data is made generally accessible to the public for information purposes on the website of a public body, this shall not be considered a disclosure abroad, even if it can be accessed from abroad.

Restrictions

1 The disclosure of personal data may be restricted, postponed, or denied if overriding public or private interests so require.

2 Specific statutory secrecy or special data protection provisions remain reserved.

3.5. Processing of Personal Data for Special Purposes

Data Processing for Non-Personal Purposes

1 Public bodies may process personal data for non-personal purposes,

such as specifically for science, research, planning, and statistics, and

disclose it to third parties, if and to the extent that

a. this is not excluded by a specific confidentiality provision;

b. the personal data is anonymized or pseudonymized as soon as

the purpose of processing allows;

c. the third party only transfers the personal data with the consent of

the public body;

d. data security is ensured;

e. the results are published in such a way that the data subjects are

not identifiable.

9

I F/1

2 Personal data once obtained for specific, non-personal purposes may not

subsequently be processed for other purposes.

Data Processing by Order

1 Public bodies may commission other public bodies or private entities with the

processing of personal data if and to the extent that

a.

no statutory or contractual provision precludes the commission;

b.

a written agreement exists for this purpose;

c.

the commission is clearly defined;

d.

suitable measures ensure that the personal data is processed by the

contractor only in the manner permitted to the public body itself.

2 Subcontracting by the contractor requires the written consent of the commissioning

public body.

3 The public body shall consider data protection concerns already when selecting

the contractor and remains responsible for compliance with data protection.

Surveillance with Optical-Electronic Systems

1 For the protection of proprietary rights, especially for the protection of persons and property from attacks, as well as for the investigation and prosecution of such acts, public, generally accessible places may be monitored with image recording and image transmission devices.

2 Surveillance must be ordered by the public body that holds the right of use or sovereignty over the place to be monitored.

3 This body must inform the Data Protection Office in advance about the surveillance and ensure that appropriate notice of the surveillance and the responsible public body is given at the monitored location.

4 Recordings must be destroyed immediately after their evaluation, but no later than one week after recording, unless they are required for evidential or security purposes.

Data Processing for Testing Purposes

1 Public bodies may process personal data even without a legal basis, if and insofar as practical implementation absolutely necessitates a testing phase because the fulfillment of the task

a. requires technical innovations whose effects must first be evaluated;

b. requires significant organizational or technical measures whose effectiveness must first be tested;

c. involves collaboration between public bodies that must first be trialled;

d. the legal basis has already been created but has not yet entered into force.

2 Data processing for testing purposes without a legal basis shall be limited to a maximum of five years and shall be evaluated. The provisions on prior consultation (Art. 34) apply by analogy.

**3.6. Destruction and Anonymization**

Destruction, Deletion

1 If personal data are no longer required for the fulfilment of public tasks, or for

security and evidentiary purposes, they must be destroyed or deleted by the

responsible public body.

2 Destruction or deletion may be omitted if and to the extent that

a.

b.

the integrity of other data sets networked with the affected personal

data would be endangered;

this is technically impossible or only possible with disproportionate

effort.

3 The obligation to offer the data to the National Archives or the municipal

archives (Art. 42) remains reserved.

Anonymization, Pseudonymization

¹ Personal data should be anonymized or pseudonymized where and to the extent possible

a.

b.

c.

the public body considers granting access to official documents containing personal data of third parties;

for data processing for non-personal purposes (Art. 26);

instead of destruction or deletion (Art. 30).

² The principle of anonymization is not violated if persons familiar with the details of the case can, despite obfuscation, recognize who is concerned.

3.7. Responsibilities for the Enforcement of Data Protection

Responsible Public Body

1 For every processing of personal data, a public body must be designated that is responsible for compliance with data protection.

11

I F/1

2 If several public bodies process a common data set, they shall regulate the responsibility.

3 The responsible public body is obliged to provide evidence that data protection is complied with.

Data Protection Impact Assessment

¹ If a planned processing of personal data is likely to result in a high risk to the personality and fundamental rights of the data subject, the responsible public body must carry out a data protection impact assessment beforehand.

² The data protection impact assessment describes and evaluates, in particular, the planned processing, the risks to the personality and fundamental rights of the data subject, and the measures intended to mitigate the risk of a breach.

³ A data protection impact assessment can be waived if sufficient evidence of compliance with data protection is already available.

Advance Consultation

¹ If the data protection impact assessment (Art. 33) reveals that the planned processing, particularly due to the use of new technologies, mechanisms, or procedures, would pose a high risk to the personality or fundamental rights of the data subject, the responsible public body shall inform the Data Protection Authority.

² The Data Protection Authority shall issue a recommendation pursuant to Article 58 within three months if the planned processing would violate data protection provisions. In doing so, it may, in particular, also recommend experimental implementation (Art. 29).

³ The deadline under paragraph 2 may be extended by one month in the case of complex processing of personal data.

Reporting Data Security Breaches

1 The contractor shall report data security breaches to the contracting public body without delay, as soon as they become aware of such breaches.

2 The responsible public body shall report data security breaches to the Data Protection Authority without delay, as soon as they become aware of such breaches.

3 The report pursuant to paragraph 2 may be omitted if the data security breach is not likely to result in a risk to the personality and fundamental rights of the data subject.

12

The public body shall also inform the data subject if it is necessary for their protection or if the Data Protection Authority requests it.

The information to the data subject may be omitted, restricted, or postponed if and to the extent that

a. overriding public or private interests require it;

b. the information is impossible or disproportionate.

**3.8. Rights of Data Subjects**

### Right to Access One's Own Personal Data

Every person may request information from the responsible public body as to whether and which personal data concerning them are being processed.

In addition to the information under Article 21, the right of access includes information regarding the origin and retention period of the personal data.

No one can waive the right of access in advance.

Excluded from the right of access are personal data processed by public bodies exclusively for personal use.

Special legal provisions that stipulate differing conditions for access to personal data or exclude access entirely or partially remain reserved.

Restriction of the Right of Access

The right of access to one's own personal data may be restricted, deferred, or denied to the extent required by law or by overriding public or private interests.

If knowledge of personal data would lead to a severe burden on the data subject, the information may be provided to a trusted person. However, if the data subject expressly wishes it, they must still be provided with comprehensive information.

1. Jede betroffene Person kann vom verantwortlichen öffentlichen Organ verlangen, dass es

| | | | | | --- | --- | --- | --- | | a. | widerrechtliches Bearbeiten von Personendaten unterlässt; | | |

| | | | | | --- | --- | --- | --- | | b. | Personendaten, die widerrechtlich bearbeitet worden sind, vernichtet oder löscht; | | |

| | | | | | --- | --- | --- | --- | | c. | die Folgen eines widerrechtlichen Bearbeitens beseitigt; | | |

| | | | | | --- | --- | --- | --- | | d. | die Widerrechtlichkeit des Bearbeitens feststellt; | | |

| | | | | | --- | --- | --- | --- | | e. | den Entscheid Dritten mitteilt oder veröffentlicht, wenn sie ein schutzwürdiges Interesse hat. | | |

Right to Rectification

1. Any data subject may request the responsible public body to rectify inaccurate personal data.

2. Rectification is carried out by

a. complete or partial destruction or deletion;

b. amendment of existing data or addition of supplementary or newly collected data.

3. If neither the accuracy nor the inaccuracy can be established, the data subject may request the inclusion of a dispute note or a brief counter-statement, as well as a corresponding restriction on processing.

4. Furthermore, the data subject may request that the responsible public body notify or publish the decision to third parties if they have a legitimate interest worthy of protection.

5. The rectification of personal data cannot be requested in relation to holdings of publicly accessible memory institutions such as libraries, educational institutions, museums, or archives. However, the data subject may request that a dispute note or a brief counter-statement be appended.

6. After the death of the data subject, these rights also accrue to persons who were related in a direct line to the deceased person, were married to them until their death, lived in a registered partnership or de facto cohabitation, or are their executor, provided they can demonstrate a legitimate interest worthy of protection.

Right to Data Blocking

1. Every data subject may request the responsible public body to block the disclosure of specific personal data to private parties.

2. The responsible public body shall refuse the blocking, lift it, or disclose personal data nonetheless, if and to the extent that

a. a legal duty to disclose exists;

b. the disclosure is necessary for the fulfillment of a public task based on a legal foundation;

c. the person requesting disclosure credibly demonstrates that the blocking significantly hinders them in the enforcement of their own legitimate legal claims against the data subject.

3. Articles 49–51 apply mutatis mutandis to the procedure under paragraph 2.

14

I F/1

Access to Data of Deceased Persons

1 The responsible public body shall grant third parties access to data of

deceased persons if and to the extent that

a.

the third party demonstrates a legitimate interest in the information, was

a direct-line relative of the deceased person, was married to them until

their death, lived with them in a registered partnership or de facto

cohabitation, or is their executor;

b.

the access is not precluded by an express declaration or a particular

need for protection of the deceased person;

c.

the access is not precluded by any other overriding public or private

interests.

2 The requirement for release from official or professional secrecy remains

reserved.

4. Archival System

File Management and Retention Obligation, Offer Obligation

1 Public bodies are obliged to maintain, secure, and retain official documents in a complete and orderly manner, insofar as they are relevant for the fulfilment of public tasks, for evidential and safeguarding purposes, for the public interest, for the traceability of state action, or for the transmission of cultural heritage.

2 They are obliged to regularly offer their official documents to the archive responsible for them. The Glarner Kantonalbank is exempt from the offer obligation.

3 The responsible archive decides on the archival value and the necessity of taking over the official documents offered to it.

4 Official documents not taken over by the responsible archives must be destroyed or deleted if and insofar as they are no longer required for the fulfilment of a statutory task or for safeguarding and evidential purposes, or if they must continue to be retained by law.

5 Archival holdings are inalienable.

State Archives

1 The Canton maintains a central archive for the permanent documentation

of state actions and for the preservation of the cultural heritage.

2 It ensures the preservation, cataloguing, and access to archival material.

3 It is authorized, within the scope of fulfilling its duties, to issue guidelines and

directives, and to inspect data records of cantonal public bodies.

4 The Government Council regulates further tasks and powers.

15

I F/1

Municipal Archives

1 Municipalities shall maintain archives in accordance with this Act. They shall

enact the necessary regulations.

2 Municipalities may transfer certain tasks to the Canton against payment.

Protection Periods

1 Official documents preserved in the cantonal archive or municipal archives are subject to a protection period of 30 years from their creation.

2 If the official documents contain personal data, a protection period of ten years from the death of the person concerned applies. If the date of death is unknown, the protection period ends 100 years after the birth of the person concerned. If this date is also unknown, it ends 80 years after the creation of the official documents.

3 Official documents that have already been made accessible to the public before archiving are not subject to any protection period.

Access to Archived Documents

1 After the expiry of the protection period, every person has a right of access to archived official documents.

2 During the protection periods, access shall be granted

a. to the depositing public body for its official documents;

b. for research and statistical purposes, subject to Article 26;

c. to third parties, if they demonstrate overriding public or private interests, whereby the public body that deposited the official documents must be heard beforehand.

3 The archival material must not be altered in the process.

Restrictions on the Right of Access

1 The right of access to archived official documents may be restricted, postponed or denied, if and to the extent that

a. statutory provisions exclude access;

b. information could be conveyed that was voluntarily provided to the public body by third parties under an assurance of confidentiality;

c. overriding public or private interests preclude access;

d. the condition or protection of the archival material so requires.

2 There is no right to have archived official documents prepared for the purpose of granting access.

16

I F/1

5. Common Provisions

Relationship of Access Rights

1. The access rights under this Act are governed by the following order of

priority

a. archival access right according to Article 46;

b. data protection access right according to Article 36;

c. information access right according to Article 11.

2. In administrative proceedings at first instance, the right to inspect files

according to Article 67 of the Administrative Justice Act (VRPG)³) takes

precedence over the access rights under this Act.

### Assertion of Claims

1 The request for access to official documents must be addressed to the public body that created the document or received it as the primary addressee from third parties not subject to this law.

2 Requests for access to personal data and for the assertion of further data protection rights must be addressed to the responsible public body.

3 The request for access to archived official documents must be addressed to the State Archives or the competent municipal archive.

4 Claims may be asserted orally or in writing. The subject matter must be sufficiently described.

Notification and Hearing

1 If the competent public body considers a partial or complete rejection of

the application, it must notify the applicant in advance.

2 If the legitimate interests of third parties are affected, they must be heard in advance.

3 If the competent public body considers granting the application despite

the opinions obtained from the affected third parties, it must notify them in advance.

Decision

1 The requesting person or the person concerned may demand from the public body, within 30 days after notification in accordance with Article 50 paragraphs 1 and 3, the issuance of an appealable decision.

3) GS III G/1 17

I F/1

Form of Access Provision

1 The right of access is granted by

a. providing information;

b. allowing inspection;

c. handing over and delivering.

2 Inspection also includes the right to make copies or take photos and to make notes.

3 There is no claim to a specific form of access provision.

Proceedings and Legal Protection

1. Unless otherwise provided by this Act, the proceedings and legal protection shall be governed by the Administrative Procedure Act (VRG).

2. Decisions of a public body for which the provisions of the VRG do not provide a legal remedy may be appealed directly to the Administrative Court. First-instance decisions of the Administrative Court may be appealed to the High Court.

3. The appeal bodies also have access to official documents that are subject to secrecy.

Costs and Fees

1 No costs shall be levied for the assertion of rights and claims under this Act.

2 A reasonable fee may be levied in cases of

a. complex procedures, particularly involving complicated circumstances or extensive anonymisation or pseudonymisation of official documents;

b. the creation of copies for applicants.

3 The amount of the fee and its assessment shall be determined by the Costs Ordinance.

4 The levying of costs in appeal proceedings shall be governed by the Administrative Court Act (VRG).

6. Supervisory and Control Body

Data Protection Office

1 The Data Protection Office supervises the application of data protection

regulations.

2 It is professionally independent, autonomous, and not bound by any instructions in the fulfillment of its duties. It annually establishes an autonomous audit program.

4) GS III G/2

18

I F/1

3 The Data Protection Office has a secretariat and its own budget. It is administratively assigned to the State Chancellery and may engage third parties for the performance of its tasks.

4 It treats inquiries, reports, and complaints confidentially. Its investigations and the related documents are not publicly accessible within the meaning of Article 11.

1. Die Fachstelle Datenschutz wird von einer in Datenschutzfragen ausgewiesenen Fachperson geleitet.

2. Die Ernennung, die Amtsdauer, die Auflösung des Arbeitsverhältnisses während der Amtsdauer, die Wiederwahl und Nichtwiederwahl sowie die Massnahmen bei Pflichtverletzungen der Leiterin oder des Leiters richten sich nach dem Personalgesetz[[5]](#paragraphtext_content_fn_626256_2_5_c).

3. Die Leiterin oder der Leiter darf kein anderes öffentliches Amt, keine leitende Funktion in einer politischen Partei und keine andere Erwerbstätigkeit ausüben. Der Regierungsrat kann Ausnahmen bewilligen. Versieht die Leiterin oder der Leiter ein Teilpensum, darf die Bewilligung einer anderen Erwerbstätigkeit nur verweigert werden, wenn dadurch die Ausübung der Funktion sowie die Unabhängigkeit und das Ansehen beeinträchtigt werden.

4. Im Übrigen gelten die allgemeinen personalrechtlichen Bestimmungen.

Tasks

1 The Data Protection Office

a. monitors developments that are relevant to data protection;

b. advises public bodies on the application of data protection provisions and provides individuals with information about their rights;

c. comments on legislative projects and measures that are significant for data protection;

d. raises awareness among public bodies and the public regarding data protection;

e. mediates between public bodies and individuals;

f. processes complaints from data subjects and informs them of the result of the investigation or the status of the enquiries within a maximum of three months.

2 To fulfil its tasks, the Data Protection Office cooperates with the data protection supervisory authorities of other cantons, the Confederation, and foreign countries and ensures the exchange of relevant information.

3 As part of the Government's activity report, it annually renders account to the Grand Council concerning its activities and reports on important findings as well as the assessment and effect of data protection provisions.

Powers

1 The Data Protection Office shall act *ex officio* or upon notification. The public body shall be informed of a notification and given the opportunity to comment.

2 The Data Protection Office shall clarify the facts *ex officio*. It has the right at any time to obtain information from public bodies, contractors (Art. 27), and recipients of personal data, regardless of any potential confidentiality obligation, to demand the production of files and documents, and to have data processing operations demonstrated to it.

3 If the Data Protection Office determines that data protection regulations are being violated, it may issue a recommendation to the public body. The public body must declare whether or not it will follow the recommendation.

4 If the public body rejects compliance with the recommendation or does not comply with it, the Data Protection Office may issue the recommendation, in whole or in part, as a decision.

5 If the personality or fundamental rights of data subjects are obviously endangered or violated, the Data Protection Office may provisionally restrict or prohibit the processing of personal data. An appeal against provisional measures shall not have suspensive effect.

6 The public body to which the decision is addressed may challenge it by administrative appeal to the Government Council. The Data Protection Office is entitled to appeal against the decision of the Government Council to the Administrative Court.

Transfer of Responsibilities

1 The Cantonal Administrator may transfer the responsibilities of the Data

Protection Office, in whole or in part, to an extra-cantonal body.

2 Within the scope and extent of the transfer, the extra-cantonal body fulfills

the responsibilities under this Act and possesses the corresponding powers.

3 The Head of the extra-cantonal body must be confirmed by the Cantonal

Administrator. Furthermore, the Cantonal Administrator decides on the

applicable employment law for the Head and other employees. Article 56,

paragraph 3 remains reserved.

20

I F/1

7. Criminal and Pecuniary Liability

Penal Provisions

1. Any private individual contractor who processes personal data without the express authorization of the contracting public body, and uses or discloses such personal data for themselves or others, shall be punished with a fine.

2. Any person who unlawfully discloses information from archival records that are subject to a protection period or are otherwise expressly withdrawn from publication, shall be punished with a fine.

3. Negligent contravention is not punishable.

Damages and Satisfaction

1 A person who suffers damage because the provisions of this Act have been violated may assert claims for damages and satisfaction in accordance with the Government Liability Act6).

2 If the request is granted, they may demand that the decision be published in whole or in part or communicated to third parties.

8. Final Provisions

### Transitional Provision concerning the Principle of Public Access

**1** The provisions regarding the principle of public access are applicable to official documents that were created or received by a public body after the entry into force of this Act.

### Transitional Provision concerning Data Processing Operations

1 Data processing operations that have been completed at the time of the entry into force of this Act shall be governed by the previous law, with the exception of the rights of the data subject (Articles 36-41).

2 Data processing operations that were commenced under the previous law and are ongoing must comply with the requirements of this Act no later than three years after its entry into force.

3 Articles 33 (Data Protection Impact Assessment) and 34 (Prior Consultation) are not applicable to data processing operations that were commenced before the entry into force of this Act, provided that the purpose of the processing remains unchanged and no new data is procured.

4 For all other matters, the new law shall apply to data processing operations from the time of its entry into force.

6) GS II F/2

21

I F/1

Transitional Provisions Concerning Ongoing Proceedings

1 This Act does not apply to conciliation proceedings pending before the supervisory body at the time of its entry into force.

2 It is also not applicable to pending appeal proceedings against first-instance decisions that were rendered before its entry into force.

3 These cases are subject to the previous law.

Transitional Provision concerning Data of Legal Persons

1 For public bodies, provisions in cantonal and communal enactments which refer to personal data shall continue to apply to data of legal persons for five years after the entry into force of this Act.

22