Kanton Glarus (VIDAG)

Subject Matter

1 This ordinance regulates in addition to the statutory provisions

a. access to official documents;

b. the processing of personal data by public bodies;

c. the archiving of official documents.

Scope of Application

1. Subject to special provisions, this Ordinance applies to all public bodies defined in Article 4 paragraph 1 of the IDAG.

2. Principle of Public Access

Virtual Document

1 An official document (Art. 3 para. 3 Act on the Interoperability of Data) created through a simple electronic process from recorded information is deemed to be an evaluation that

a. can be generated either directly with the help of or indirectly through a data export from IT resources; and

b. does not require significant effort for creation and post-processing.

Treatment of the Access Request

1 The public body to which the request is addressed forwards it for treatment if it concerns official documents that are in the possession of another public body.

1)

GS I A/1/1

SBE 2022 48

1

I F/2

Clarification of the Access Request

1 The public body can request a clarification from the applicant if it is

not possible for it, without disproportionate effort, to determine which

official documents the request refers to.

2 If the clarification is not provided within the set deadline, the access

request becomes moot.

3. Data Protection

3.1. Definitions

Special Categories of Personal Data

1 Special categories of personal data (Art. 5 para. 2 FDPA) include, in particular

a. Data concerning religious, philosophical, political, or trade union views or activities;

b. Data concerning health, the intimate sphere, or membership of a race or ethnic group;

c. Genetic data;

d. Biometric data that uniquely identify a natural person;

e. Data concerning administrative and criminal prosecutions or sanctions;

f. Data concerning measures of social assistance and child and adult protection.

Master Data

¹ Master data (Art. 5 para. 3 FDPA) includes

a.

Name;

b.

First name;

c.

Address;

d.

Date of birth;

e.

Place of origin.

**3.2. Data Security**

Responsibilities

1 The public bodies responsible for data protection compliance (Art. 32 FADP) are also responsible for data security compliance.

2 Based on the protection goals, they assess

a. the need for protection;

b. the risks;

c. the technical and organizational measures to be taken and their appropriateness.

3 The public bodies ensure that the IT resources they use to perform their legal tasks are adequately protected against misuse and disruption.

Protection Objectives

1 The public bodies shall ensure that factual and personal data, in accordance with their need for protection

a. are only accessible to authorized persons (confidentiality);

b. are available when needed (availability);

c. are not unlawfully or unintentionally altered, destroyed or deleted (integrity);

d. are processed in a traceable manner (traceability).

1. Need for Protection

1 The need for protection is determined in particular by

a. the type of factual and personal data processed;

b. the risk of a violation of personality rights or fundamental rights for

the data subjects;

c. the type of data processing, especially when using risky or new technologies, mechanisms, or procedures;

d. the number of data subjects affected by the data processing;

e. the scope of factual and personal data processed.

2 For the use of IT resources, the responsible IT service may define security levels and minimum requirements for data security, depending on the need for protection.

Risk Assessment

1 Public bodies, in conjunction with their responsible IT service, shall examine their IT resources and other collections of factual and personal data with regard to the probability of occurrence and the possible consequences of a data security breach.

2 Based on the results of the risk assessment, they shall take appropriate technical and organizational measures.

3

I F/2

1. Zur Gewährleistung der Datensicherheit und zur Wahrung des Datenschutzes können insbesondere die folgenden technischen und organisatorischen Massnahmen ergriffen werden

| | | | | | --- | --- | --- | --- | | a. | Zugangsbeschränkungen: unbefugten Personen ist der Zugang zu Einrichtungen, in denen Sach- und Personendaten bearbeitet werden, zu verwehren; | | |

| | | | | | --- | --- | --- | --- | | b. | Benutzerkontrollen: unbefugten Personen ist die Benutzung von Informatikmitteln, mit denen Sach- und Personendaten bearbeitet werden, zu verwehren; | | |

| | | | | | --- | --- | --- | --- | | c. | Datenträgerkontrollen: unbefugten Personen ist das Lesen, Kopieren, Verändern oder Entfernen von Datenträgern zu verunmöglichen; | | |

| | | | | | --- | --- | --- | --- | | d. | Zugriffsbeschränkungen: der Zugriff ist auf diejenigen Sach- und Personendaten zu beschränken, welche die berechtigten Personen für die Erfüllung ihrer Aufgabe benötigen; | | |

| | | | | | --- | --- | --- | --- | | e. | Bearbeitungsbeschränkungen: das unbefugte Bearbeiten von Sach- und Personendaten wird verhindert; | | |

| | | | | | --- | --- | --- | --- | | f. | Eingabekontrollen: bei der Verwendung von Informatikmitteln muss nachträglich überprüft werden können, welche Sach- und Personendaten zu welcher Zeit und von welcher Person eingegeben wurden; | | |

| | | | | | --- | --- | --- | --- | | g. | Transportsicherung: bei der Bekanntgabe von Sach- und Personendaten sowie beim Transport von Datenträgern ist zu verhindern, dass die Daten unbefugt gelesen, kopiert, verändert oder gelöscht werden können; | | |

| | | | | | --- | --- | --- | --- | | h. | Empfängeridentifikation: Datenempfänger, denen Sach- und Personendaten bekannt gegeben werden, müssen identifiziert werden können; | | |

| | | | | | --- | --- | --- | --- | | i. | Kontinuitätssicherung: Vorkehrungen werden getroffen, damit bei einem Ausfall von Informatikmitteln wichtige Funktionen möglichst rasch weiter erfüllt werden können; | | |

| | | | | | --- | --- | --- | --- | | j. | Generationenfolgesicherung: Vorkehrungen werden getroffen, dass Sach- und Personendaten infolge technologischen Wandels beim Einsatz von Informatikmitteln dauerhaft erhalten werden können. | | |

2. Die zu ergreifenden Massnahmen sind angemessen, wenn sie sich eignen, dem Risiko einer Verletzung der Datensicherheit und des Datenschutzes effektiv zu begegnen.

3. Die öffentlichen Organe prüfen periodisch die Angemessenheit der in ihrer Organisation ergriffenen Sicherheitsmassnahmen und passen diese bei Bedarf an.

4. Dabei tragen die öffentlichen Organe den Grundsätzen der Zweckmässigkeit, der Wirtschaftlichkeit, dem Stand der jeweiligen Technik und der Benutzerfreundlichkeit Rechnung.

Logging

1 Public bodies shall log the processing of factual and personal data using

information technology means if technical and organisational measures (Art. 12)

are insufficient to ensure data security and safeguard data protection.

2 Logging must take place in particular if it would otherwise be impossible to sub-

sequently determine whether the factual and personal data were processed for

the purposes for which they were collected or disclosed.

3.3. Duty to inform

Modalities of the Duty to Inform

1 The public body shall provide the data subject with information regarding the

procurement of personal data (Art. 21 para. 1 IDAG) in a precise, comprehensible,

and easily accessible form.

2 If the data subject is not obliged to provide information, the public body shall

inform them of the voluntary nature of providing personal data at the time of its

procurement.

Exceptions to the Duty to Inform

1 In addition to Article 21, paragraph 3 FDPA, the duty to inform is also waived if

a. personal data are processed for the purpose of ensuring data security;

b. personal data are processed for archival purposes.

**3.4. Disclosure of Data**

Interests Worthy of Protection

1 If the applicant requests the disclosure of personal data based on Article 23 paragraph 1 letter d IDAG or the lifting of a data block based on Article 40 paragraph 2 letter c IDAG, they must specifically demonstrate for what purpose the requested information is to serve.

2 A general interest, arising from the circumstance that a legal, economic, or personal relationship exists between the persons, is not sufficient for proof.

5

I F/2

3 Applicants who request the disclosure of personal data based on Article 23 paragraph 1 letter f IDAG can provide proof of public utility by means of the quality seal of the certification body for non-profit organizations (Zewo Quality Seal) or the corresponding recognition by the competent tax authorities.

Adequate Data Protection

1 Adequate data protection for the disclosure of personal data abroad

(Art. 24 para. 1 FDPA) exists when

a. the Confederation has determined that the legislation of the recipient

country or the international body ensures adequate protection

(country list);

b. in cases where a country is not listed on the Confederation's country list,

adequate data protection is ensured by other means.

2 The Data Protection Authority determines which other means are suitable

to ensure adequate data protection.

3 The disclosure of personal data to a recipient country or an international

body without adequate data protection in individual cases (Art. 24 para. 2 FDPA)

remains reserved.

3.5. Processing of Personal Data for Special Purposes

Data Processing by Order

1 The contracting public body shall carefully select its data processor by

order, paying particular attention to compliance with data security and data

protection.

2 The following must be contractually stipulated in particular

a. subject and duration of the order;

b. scope, nature, and purpose of the intended data processing, the

nature of the data, and the circle of data subjects;

c. the technical and organizational measures to be taken to ensure

data security, their control, and documentation;

d. enforcement of claims of data subjects;

e. obligation to maintain confidentiality and the imposition of this

duty on all data processors;

f. any authorization to award subcontracts and associated obligations;

g. control rights of the contracting public body and its supervisory

authorities, as well as corresponding obligations of the data

processor by order to tolerate and cooperate;

6

I F/2

h. notification obligation of the data processor by order in the event of

data security breaches;

i. instruction powers of the contracting public body;

j. the return of provided data and data carriers, as well as the

destruction or deletion of data stored with the data processor by

order;

k. applicable law and jurisdiction.

3 The obligation to comply with data security and data protection may be

secured by agreeing on a contractual penalty.

Monitoring with Opto-Electronic Systems

1 Monitoring with opto-electronic systems must be limited factually, spatially, and temporally to what is necessary to achieve the specific purpose.

2 The Data Protection Office maintains a publicly accessible register of video surveillance systems.

3 The register provides information particularly on

a. the monitored location;

b. the purpose of surveillance;

c. the type of surveillance;

d. the surveillance perimeter;

e. the number of cameras used;

f. the public body responsible for the surveillance.

Data Processing for Testing Purposes

1 The public body shall submit an evaluation report to the Data Protection

Authority no later than two years after the start of the testing phase.

2 It shall propose therein the continuation, cessation, or conversion of the

pilot operation into regular operation.

**3.6. Retention and Destruction**

Retention Periods

1 Retention periods determine the duration for which factual and personal data must be available to public bodies for the performance of their tasks, as well as for evidentiary and security purposes, before they must be offered to the competent archive for archival purposes.

2 Public bodies shall, in consultation with the competent archive, determine the minimum retention periods for their factual and personal data.

3 After the expiry of the minimum retention period, factual and personal data may only be destroyed or deleted with the consent of the competent archive.

7

I F/2

4 Factual and personal data not acquired by the competent archive, which are no longer required for the performance of tasks by the public body or for evidentiary and security purposes, must be destroyed or deleted at the latest 30 years after the expiry of the minimum retention period.

5 Specific statutory provisions remain reserved.

**3.7. Enforcement of Data Protection**

Data Protection Compliance Record

1 The requirements for the record of compliance with data protection

(Art. 32 para. 3 IDAG) are based on the specifications of the Data Protection

Authority. It can also be provided through certification. This is governed

by federal regulations.

2 Public bodies shall provide the record no later than five years

after the entry into force of this Ordinance. They may provide it individually or

jointly with other public bodies.

3 Public bodies must renew the data protection compliance record regularly,

but at the latest every five years.

Duty to conduct a data protection impact assessment

¹ The duty of public bodies to conduct a data protection impact assessment

(Art. 33 FADP) is limited to the introduction and expansion of IT tools used

for processing personal data.

2 A high risk to the personality and fundamental rights of the data subjects

under Article 33 paragraph 1 FADP is likely to exist when

a. the IT tools used enable profiling;

b. particularly sensitive personal data are processed;

c. personal data of a large number of data subjects are processed;

d. personal data processing is carried out by data processors;

e. two or more public bodies jointly process personal data.

3 In addition to Article 33 paragraph 3 FADP, public bodies may waive the

data protection impact assessment if and to the extent that the data pro-

cessing is already expressly regulated in the legal basis.

8

Public bodies shall communicate the documented result of the data pro-

tection impact assessment to the Data Protection Authority, irrespective of

whether the introduction or expansion of IT tools requires prior consultation

or not.

1. Die Datenschutz-Folgenabschätzung benennt mindestens

| | | | | | --- | --- | --- | --- | | a. | das verantwortliche öffentliche Organ, die rechtliche Grundlage, den Zweck und eine systematische Beschreibung der geplanten Datenbearbeitungen, insbesondere in Bezug auf die zu bearbeitenden Personendaten; | | |

| | | | | | --- | --- | --- | --- | | b. | eine Bewertung der Notwendigkeit und Verhältnismässigkeit der Datenbearbeitungen in Bezug auf den Zweck, wobei potenziell mildere Mittel zu erörtern sind; | | |

| | | | | | --- | --- | --- | --- | | c. | eine Bewertung der Risiken für die Persönlichkeit und die Grundrechte der betroffenen Personen; | | |

| | | | | | --- | --- | --- | --- | | d. | die technischen und organisatorischen Massnahmen, die zur Bewältigung der Risiken geplant sind, insbesondere in Bezug auf Datenbearbeitungen im Auftrag. | | |

1. Zusammen mit dem Gesuch um Vorab-Konsultation reicht das öffentliche Organ das dokumentierte Ergebnis der Datenschutz-Folgenabschätzung ein.

2. Die Konsultation ist abgeschlossen, wenn die Fachstelle Datenschutz die Anwendung für unbedenklich erklärt oder eine Empfehlung (Art. 58 Abs. 3 IDAG) abgegeben hat.

3. Das öffentliche Organ führt die geplanten Datenbearbeitungen erst nach Abschluss der Konsultation durch.

Public Announcement of Data Security Breaches

1 If individual information about data security breaches appears disproportionate due to the large number of affected persons (Art. 35 para. 5 lit. b FADP), the information may be provided by public announcement in an appropriate form.

3.8. Rights of Data Subjects

Confirmation and Lifting of Data Blocking

1 The data blocking must be confirmed to the data subject in an appropriate

form.

9

I F/2

2 The request for the lifting of data blocking must be submitted in writing or

electronically.

3.9. Supervisory and Control Body

Agency / Representation

1. The Government Council designates, after consultation with the management of the Data Protection Office, their deputy for cases of recusal and longer absences.

2. Any different regulation concerning representation for an inter-cantonal supervisory authority remains reserved (Art. 59 IDAG).

Right to Comment

1 Public bodies spontaneously submit legislative projects and intended measures that are significant for data protection (Art. 57 para. 1 lit. c IDAG) to the Data Protection Authority for comment.

Advertisement [or Notification/Report]

1 The Data Protection Authority becomes supervisory active upon a report, if facts emerge from it that require intervention in the public interest.

2 If, however, facts are present whose treatment is not in the public interest, the Data Protection Authority refers the reporting person to the path of individual legal protection.

3 The possibility of mediation (Art. 57 para. 1 lit. e IDAG) remains reserved.

### Setting Deadlines

1 If the Data Protection Office determines that data protection regulations are being violated and issues a recommendation, it sets a reasonable deadline for the public body to declare whether or not it will follow the recommendation.

### 4. Archival Affairs

#### 4.1. File Management and File Retention

Record Keeping

1 Public bodies shall maintain official documents completely, systemati-

cally, and comprehensibly.

10

I F/2

Record keeping shall be conducted according to a filing system and, as a rule, in digital form.

The filing system shall form the basis for subsequent archiving. Changes to the filing system may only be made in cooperation with the competent archive. The archive must be involved early in the planning of the use of new IT tools in which official documents are stored and may require a revision of the filing system.

Each public body shall designate a person responsible for the filing system and the further organization of document storage.

The digitization of physical official documents shall comply with the specifications of the competent archive.

File Retention

Public bodies shall store their official documents properly and securely.

They shall protect them against misuse, damage, and loss. In doing so,

they shall ensure the use of age-resistant information carriers and aids

that guarantee a sufficient service life.

They shall be responsible for their official documents until the expiry of

the retention periods pursuant to Article 21 Paragraph 2, or until their

destruction or deletion.

Joint Data Inventory

If several public bodies jointly process official documents, they shall regulate the responsibility for record-keeping and record retention.

**4.2. Archiving**

Duty to Offer

Public bodies shall regularly offer their official documents to the competent archive for takeover, at the latest however after the expiry of the retention periods pursuant to Article 21 paragraph 2.

In the event of the dissolution of a public body or its transfer into private law, its official documents shall be offered to the competent archive in consultation with the legal successor.

1. Das zuständige Archiv bewertet die ihm angebotenen amtlichen Dokumente hinsichtlich ihrer Archivwürdigkeit. Dabei hört es das anbietende öffentliche Organ an.

2. Archivwürdig sind amtliche Dokumente insbesondere dann, wenn sie von dauerndem Wert sind für

| | | | | | --- | --- | --- | --- | | a. | die Dokumentierung der Organisation und der Tätigkeit des öffentlichen Organs; | | |

| | | | | | --- | --- | --- | --- | | b. | die Sicherung berechtigter Interessen betroffener Personen oder Dritter; | | |

| | | | | | --- | --- | --- | --- | | c. | das Verständnis der Gegenwart und der Geschichte; | | |

| | | | | | --- | --- | --- | --- | | d. | die Gesetzgebung; | | |

| | | | | | --- | --- | --- | --- | | e. | die Verwaltungstätigkeit oder die Rechtsprechung; | | |

| | | | | | --- | --- | --- | --- | | f. | die Wissenschaft und die Forschung. | | |

3. Das zuständige Archiv entscheidet aufgrund seiner Bewertung abschliessend über die Übernahme von amtlichen Dokumenten ins Archivgut.

4. Mit der Übernahme der amtlichen Dokumente ins Archivgut geht die Verantwortlichkeit an das zuständige Archiv über.

Delivery

1 Public bodies shall deliver official documents designated for acquisition to the competent archive in an organized and prepared state, and accompanied by a delivery list.

2 The competent archive shall determine the requirements for the delivery list and for the organization and preparation, in particular regarding

a. packaging, labeling, and transport;

b. standards for delivery packages and data transfer.

3 For this purpose, it may conclude delivery agreements with the delivering public bodies.

Securing Archival Material

1 The official documents acquired by the competent archives and deemed to be archivally valuable constitute the archival material.

2 The competent archive ensures the permanent preservation and usability of the archival material and protects it from unauthorized access, destruction, or deletion.

4.3. Access to Archival Material

Loan

1 The competent archives may loan archival material to the transferring public body or for exhibition purposes.

2 If the protection of the archival material requires it, the competent archives may provide copies of the official documents instead of originals.

12

I F/2

### Overriding Private Interest

1 An overriding private interest under Article 46 paragraph 2 letter c IDAG generally exists when a person

a. requests access to information about themselves;

b. requests access to information about a public figure, provided that this information relates to the activities of that person in public.

Access via the Internet

1 The competent archive may make index data accessible via the Internet already during the protection period, provided they do not contain sensitive factual and personal data.

2 After the expiry of the protection period, it may make electronic versions of official documents accessible via the Internet.

4.4. Holdings and Use of the State Archive

Archival Material

1 The State Archives is the central archive of the canton and its legal

predecessors.

2 It securely and permanently preserves the records of archival value from the following public

bodies

a. the Landsgemeinde (cantonal assembly);

b. the Cantonal Council;

c. the Cantonal Government;

d. the judicial authorities;

e. the cantonal commissions;

f. the cantonal administration;

g. the cantonal public law institutions and foundations;

h. the intercantonal organizations, establishments, and institutions

in which the canton participates, insofar as Glarus law is applicable to them;

i. other persons, organizations, and institutions under public and private law that

perform public tasks for the canton, with the exception of the Glarner Kantonalbank (Glarus Cantonal Bank).

3 It may take over archival material from third parties that do not perform public tasks for the

canton.

Accession and Use

1 The State Archives ensures appropriate accession of archival materials.

13

I F/2

2 It issues regulations concerning the use of its archival materials, rooms, and facilities.

3 It may refuse access to the State Archives and expel individuals who have seriously violated the use regulations.

4.5. Further Duties and Powers of the State Archives

1. Das Landesarchiv

| | | | | | --- | --- | --- | --- | | a. | berät die kantonalen öffentlichen Organe bei der Organisation ihrer Aktenführung und Aktenaufbewahrung sowie in Bezug auf die Aufbereitung und Ablieferung von amtlichen Dokumenten; | | |

| | | | | | --- | --- | --- | --- | | b. | begleitet Projekte der elektronischen Aktenführung und Aktenaufbewahrung der kantonalen öffentlichen Organe; | | |

| | | | | | --- | --- | --- | --- | | c. | berät die Gemeinden in Archivfragen. | | |

1. Das Landesarchiv kann sich an der Erforschung und Veröffentlichung seines Archivgutes beteiligen.

2. Wer ein Werk veröffentlicht, das in wesentlichen Teilen auf der Nutzung von Archivgut des Landesarchivs beruht, hat diesem ein unentgeltliches Belegexemplar abzuliefern.

Information on Costs

1 The public body shall inform the applicant without undue delay about a possible fee obligation if copies are made or if the handling of rights and claims asserted under the IDAG causes a complex procedure.

Lengthy Procedure

1 A lengthy procedure (Art. 54 para. 2 lit. a IDAG) exists when the processing of rights and claims asserted under the IDAG takes more than three hours.

14

Abusive Renewal of an Application

1 A reasonable fee may also be charged if the applicant repeatedly, without a legitimate interest or in an abusive manner, submits the same requests to public bodies.