Ordinance on the Digital Government Act (VDVG) - Outsourcing 1. Responsibility (VDVG)

1. The administrative authority that outsources the processing of data or the management of IT solutions remains responsible for compliance with data protection and data security requirements.

2. If the outsourcing concerns multiple authorities, a main responsible authority must be designated.

1. By means of an agreement, stipulation, or in another suitable manner, at least the following points must be regulated

a) Content of the service;

b) Maintenance of official secrecy as well as specific confidentiality obligations;

c) Responsibilities;

d) Technical and organizational measures to ensure data protection and data security;

e) Location of data processing;

f) * Monitoring of contract fulfillment;

g) Engagement of third parties;

h) * Contract duration and conditions for contract termination as well as their consequences, particularly the return and deletion of data;

i) * Sanctions provided for in the event of breach of duty.

1. The following are considered basic services

a) a portal for public services and interaction with authorities (E-Government Portal);

b) an e-account and the centralized management of users' identities (Identity and Access Management);

c) a service for the electronic signing of documents that require a signature (Signature Service);

d) services for the exchange of communications and documents with authorities via the E-Government Portal (Delivery Platform);

e) a service for the centralized and standardized creation and management of web forms for the purpose of providing services via the E-Government Portal or a website (Form Service).

1. Existing services available over the internet may continue to be operated in their current form. Additionally, they must be offered through the e-Government portal, insofar as this is reasonable and technically feasible.

1. The Digital Administration Staff Unit is the administrative unit responsible for the operational management of the e-Government portal and the associated basic services.

1. The Office for Information Technology is the administrative unit responsible for information technology.

1. The opening of an e-account is carried out through an electronic form.

2. To open the e-account, at least the account data pursuant to Article 17 paragraph 1 letter a to letter e of the Digital Administration Act must be provided.

3. Each user can only have one e-account.

1. Upon opening the account, a duplicate check is performed by comparing the entered data with existing accounts.

2. If an existing E-account is found during the comparison, it may be continued or reactivated. This does not apply if the account has been blocked by the competent authority pursuant to Article 16, paragraph 2, letter a of the Digital Administration Act.

1. Users must be informed of their rights and obligations in a timely and appropriate manner when opening the e-account and whenever there is a change in those rights and obligations.

2. Users must consent to the rights and obligations when opening the e-account and upon any changes to those rights and obligations. The use of the e-account may be restricted until consent to the amended provisions is given.

3. The consent must be recorded in an appropriate manner by the administrative unit responsible for information technology.

1. The scope of the authority to represent must be clearly defined, particularly with regard to the services concerned.

2. The agency relationship may be revoked by either party at any time.

1. For the procurement of services by legal entities, these must be registered once in the system, and the authorized users must be designated.

2. During registration, at least one user must be designated as the company representative.

3. The competent authority may require additional proof of representation authorization. These requirements must be communicated to the users by the competent authority in an appropriate manner.

1. Legal entities with a company identification number (UID number) in accordance with the Federal Act on the Company Identification Number (UID units) apply for registration via the e-account of a user, providing the company name and UID number.

2. After the application is submitted, an activation code is sent to the management at the registered office address of the UID unit as listed in the federal UID register.

3. By entering the activation code via the e-account of the designated user, the UID unit is activated and the corresponding person is authorized to represent the company.

4. For legal entities without a UID number, the activation code is sent to the address entered by the user. Services of certain trust levels may be exempt from use by legal entities without a UID number.

1. The corporate representation may authorize additional users to access services.

2. The corporate representation is responsible for updating the authorized users. The system will regularly prompt it to review the granted authorizations.

3. The e-account of users authorized to access services must possess the trust level required for the service.

1. The user can request the deactivation of their own e-account at any time without stating any reasons, through their e-account.

1. An authority may initiate deactivation or restriction if the conditions of Article 16, Paragraph 2 of the Digital Administration Act are met.

2. Misuse of the e-account by a user's account occurs particularly when he or she violates rights and obligations, or if there are indications that the e-account has been compromised by third parties.

3. The deactivation or restriction must be communicated to the user via the email address stored in the system.

4. The user may apply to the authority for reactivation of the account or the lifting of the restriction. The authority may reject the application if a person has repeatedly or seriously violated rights and obligations, or if the risk of compromise has not yet been eliminated.

5. The affected person may request the issuance of a written decision regarding the refusal from the competent administrative unit in accordance with Article 5.

1. Deactivation or restriction results in the loss of access to the data stored in the portal and linked to the E-account. The user is solely responsible for the prior backup of their own data.

2. If the user is involved in an ongoing procedure at the time of deactivation or restriction, which is conducted via the e-government portal as a transmission system according to the provisions of the Administrative Procedure Act, further procedural actions must be carried out in paper form.

1. To authenticate for a service in a specialized application, the user must

a) have the trust level defined by the specialized authority; and

b) have been linked to the specialized application once.

2. Various trust levels are provided for access to the specialized application according to the protection requirement of the data being processed

a) Trust Level 0: public data;

b) Trust Level 1: basic protection requirement;

c) Trust Level 2: increased protection requirement;

d) Trust Level 3: very high protection requirement.

1. A higher trust level can be obtained by the user

a) undergoing an official identification process; or

b) presenting an electronic identification unit that meets the requirements of the respective trust level.

2. The requirements for obtaining a trust level are based on the quality model for the authentication of subjects (Standard eCH-0170).

1. The official identification procedure is conducted through

a) in-person appearance at an identification office; or

b) a secure online identification process in accordance with the current state of technology.

2. The responsible administrative unit defines the identification processes and identification offices and is required to publish the guidelines for each level of trust.

3. Proof of completion of the identification process can be stored in the e-account.

1. The linkage of an e-account with a specialized application is established, provided that the account data matches the corresponding data in the specialized application. Depending on the level of trust, the entry of additional data known to the user may be required.

2. If account data is not stored in a specialized application, it can be made available to the specialized application with the consent of the user.

3. Personal data from the specialized applications is temporarily stored in the e-account during the linkage.

4. Upon successful linkage, the user identification number from the specialized application is stored permanently in the e-account.

1. Recognized electronic identification units are

a) SwissID;

b) Electronic identification units recognized according to federal legal requirements.

2. The data from the recognized electronic identification unit will be stored in the e-account with the consent of the user.

3. The administrative unit responsible for information technology defines, in compliance with federal legal requirements, which levels of trust the electronic identification units must meet.

1. The storage includes the accessing user, the time of access, and the type of actions performed.

2. The logs can be accessed and monitored by a limited group of individuals.

3. The stored data will be deleted after twelve months. This is subject to different retention periods under applicable special legislation.

1. The competent administrative unit may engage third parties to process data in connection with the e-account, namely to conduct the identification process and to ensure user support.

1. Existing agreements, conditions, or arrangements for outsourcing made in any other suitable manner remain valid until their expiration. Upon any potential renewal, they must be adapted to the provisions of this regulation.