1 State - People - Authorities - 15 Authorities - 150 General Provisions - CHAPTER ONE General Provisions (GSEK)

The purpose of this law is to establish the conditions for the organization, operation, and use of the single secure counter (hereinafter: SSC) of cantonal and municipal authorities.

1 The present law governs the relationships between cantonal and communal authorities and the partners, the operator, and the users of the GSU.

2. The following are considered cantonal and communal authorities

a) the Grand Council, its office, and the commissions that depend on it;

b) the Council of State, the cantonal administration, and the commissions that depend on it;

c) the judiciary and its administration;

d) the general and communal councils, their administrations, the commissions that depend on them, as well as intercommunal and regional syndicates;

e) the cantonal and communal public law institutions and corporations, their administrations, as well as the commissions that depend on them;

f) legal entities and other private law organizations in which the authorities hold a majority stake;

g) private individuals, when performing a public law task on delegation from an authority;

h) groups of authorities.

3. The Council of State may authorize the opening of the GSU to entities other than those mentioned in paragraph 2.

[1] The following terms are understood as

a) single secure gateway, the secure communication infrastructure between cantonal and communal authorities and users for all services relying on information and communication technologies;

b) service, a transmission of information or personal data between a partner and the users of the SSG;

c) partners, the cantonal and communal authorities that have signed, with the State, a collaboration contract within the framework of the SSG, allowing them to offer services to users within a given technical and administrative framework;

d) operator, a service or a public law entity ensuring the technical management, operation, maintenance, and security of the SSG;

e) users, natural and legal persons who have signed a usage contract of the SSG with the State, as well as persons duly authorized by users who are signatories of a contract;

f) e-government, the adoption by the cantonal and communal authorities of information and communication technologies in their interaction with the public and in their relations with users and clients of the public service;

g) software, computer procedures executing the instructions associated with the service;

h) system administrator, an IT specialist managing the SSG's computer systems;

i) IT system, hardware and software that are part of the secure infrastructure of the SSG;

j) specific role, a grouping of a set of services associated with a status (citizen, tax representative, notary, mechanic, etc.);

k) recognized digital identity (hereinafter: RDI), a digital identity established by the operator or by an external identity provider recognized by the State Council because it presents the necessary security level to ensure access security.

[2] 1 The Council of State exercises supreme oversight over the GSU.

2. It enacts the necessary provisions for the implementation of this law and designates the competent department.

3. It appoints the operator of the GSU.

4. It appoints the commission of the GSU.

5. It signs collaboration contracts with GSU partners.

6. It establishes the list of INR.

1 The State Chancellery

a) administratively organizes the GSU and manages relations with users;

b) enters into usage contracts with the users of the GSU;

c) maintains the register of GSU users;

d) maintains and monitors the register of GSU powers of attorney;

e) coordinates relations between the Confederation, the cantons, and the cantonal and communal authorities in matters of electronic government.

The Competent Department

a) defines the framework conditions for joining the GSU by cantonal and communal authorities;

b) regulates the conditions of access to and use of the GSU by users;

c) establishes the security standards for the GSU;

d) supervises the operator of the GSU.

The Operator of the GSU

a) manages the technical infrastructure of the GSU;

b) proposes to the department the adaptation of the GSU's security standards in accordance with technological developments;

c) ensures the monitoring of the GSU;

d) implements, in close collaboration with partners, the services of the GSU.

1 The GSU Commission is the body representing the partners and the operator.

2. It is composed of eleven members

– the State Councillor, head of the competent department, who acts as president;

– five representatives of the State;

– five representatives of the municipalities.

3. It makes decisions on all important issues relating to the GSU, namely

a) proposes strategic choices of the GSU to the State Council;

b) decides on the services of the GSU before any commencement of operations;

c) decides on investments and their impact on operating costs;

d) promotes the development of the GSU among partners, the operator, and users.

[3] The GSU Commission constitutes, in an advisory capacity, a user group consisting of a maximum of fifteen members, chaired by the chancellor, and composed of representatives from civil society, the IT service of the Neuchâtel entity, the Electronic Management Center, the Association of Neuchâtel Municipalities, and the organization office to contribute to

a) defining the needs and expectations of the One-Stop Shop users;

b) evaluating the services provided on the One-Stop Shop and their adequacy with these needs;

c) developing and assessing satisfaction surveys.

The architecture of the GSU consists of

f) an Internet connection.

[4] 1 Each user is entitled to personal and confidential access rights.

2. To identify the user, the operator is authorized to use the existing data from cantonal databases concerning individuals and companies.

3. Access rights to the GSU are established based on strong authentication, consisting of at least two out of the following three types of information

c) biometric information.

4. The transmission of access rights to users of the GSU must be conducted securely. The State Council determines the security requirements.

1. Access rights are continuously monitored by the secure infrastructure of the GSU.

2. This monitoring shall specifically allow

a) verification of the user's access rights to the GSU;

b) enforcing the user to create a new personal password upon their first login attempt to the GSU;

c) requiring the user to periodically change their password;

d) automatically blocking the user’s access rights after repeated attempts using invalid codes;

e) providing the user the ability to invalidate and block their access rights at any time.

1. The secured infrastructure must incorporate a system containing the temporary history of users' transactions.

2. The transmitted data is not retained in the temporary history of transactions.

3. The Council of State shall regulate the procedure for the destruction of temporary transaction histories.

4. No temporary transaction history shall be established when using the GSU for electronic voting.

1. The concept of GSU security determines the rules concerning the secure infrastructure, authorized personnel, intervention, and environment.

2. It is regularly subject to an audit, the terms of which are defined by the Council of State.

1. The secure infrastructure integrates all the computer systems concerned with the GSU.

2. It must notably

a) be monitored by ad hoc systems;

b) have a strong authentication system for access to the GSU servers by authorized persons;

c) be regularly upgraded.

1. The Council of State designates the authorized individuals who may intervene in the GSU environment as system administrators or validate interventions in the secured infrastructure of the GSU.

2. The authorized individuals must

a) have the exercise of civil rights;

b) not have been subject to a criminal conviction for acts incompatible with the exercise of the function, the registration of which has not been expunged from the criminal record;

c) not be in bankruptcy or under a composition moratorium, and not be subject to a provisional or definitive certificate of insufficiency of assets;

d) disclose their conflicts of interest.

3. The authorized individuals are sworn in by the Council of State.

1. The Council of State determines the extremely sensitive servers requiring specific intervention rules.

2. The Council of State sets the conditions for intervention on these servers.

1. The secured infrastructure is located in an appropriate environment.

2. The Council of State determines the modalities.

[5] 1 Users of the GSU enter into a usage contract with the State of Neuchâtel.

1a The conclusion of the contract and the acceptance of the general terms and conditions can be done in paper form or digitally via the GSU website using an INR.

2. The usage contract specifies the specific roles to which each user may be entitled.

3. The rights of each user are determined by their status and the powers of representation they hold.

[6] 1 The signatures of paper format contracts must be legalized or signed by users in the presence of

b) the authorized municipal administrations for this purpose.

2. For contracts concluded online, the use of the INR is equivalent to a signature.

3. Upon request from the State Chancellery, the information to be kept on hand is transmitted to the user by the operator.

4. The State Council regulates the procedures for issuing contracts.

[7] 1 Services of the GSU that contribute to the development of e-government are those that, in particular, allow for

a) offering users simplified access to the services of cantonal and communal authorities;

b) facilitating, for users, the management of administrative procedures;

c) improving the transparency and quality of the data managed by cantonal and communal authorities.

2. The services are grouped by theme.

3. The Council of State sets the terms of service deployment.

1. Legal representatives have automatic access to the data and information pertaining to the individuals they represent.

2. They must provide proof of their legal authority to represent to the State Chancellery.

1. Any person may be represented by an agent, except for the exercise of political rights.

2. A GSU partner can require the agent to prove their authority of representation by producing a written power of attorney.

3. Any person who intends to grant an agent a power of attorney allowing unrestricted access to all or part of the services offered by the GSU must provide the state chancery with a power of attorney whose signature is legalized.

4. The revocation of a power of attorney allowing unrestricted access to all or part of the services offered by the GSU is effected by a written request to the state chancery.

5. The register of powers of attorney can be consulted at any time by the GSU partners.

6. Furthermore, the Council of State regulates the modalities for the use of powers of attorney.

1. The processing of personal data, particularly its communication, within the framework of the GSU must comply with cantonal legislation on data protection, including the principles of legality, proportionality and good faith, accuracy, and security.

2. The data controller of personal data processed within the framework of the GSU remains responsible for data protection; they must be identifiable to the users of the GSU.

1. Individuals whose personal data are processed within the framework of the GSU have the rights guaranteed by cantonal data protection legislation, including the right to access, rectify, and delete.

2. When personal data is requested from the user, the purpose of the processing as well as whether responding is mandatory or optional must be indicated to them.

1. Except for the temporary transaction history of users provided for in Article 12 of this law, the operator shall not retain data transmitted by users within the scope of the GSU services, nor collect any data on users except for the creation of anonymous site traffic statistics.

2. Without the user's consent, the recording of permanent data (e.g., cookies) on the user's computer system is prohibited.

1. The State shall not be liable for any direct or indirect damages resulting from accessing elements of the site or their use, or from the inability to access or use them.

2. Information is provided based on partners' records, without warranty, and any potential inaccuracies do not entail any liability on the part of the State.

The partners are solely responsible for the data provided on the GSU and for any damages they may cause to users.

For the remainder, the Act on the Liability of Public Authorities and their Agents (Liability Act), of June 16, 1989, is applicable.

1. The user is solely responsible for their computer system.

2. They also bear all risks resulting from a third party's use of their access rights.

[8] 1. Decisions made by the State Chancellery may be appealed to the Cantonal Court.

2. Decisions made by the operator may be appealed to the department, and those made by the department may be appealed to the Cantonal Court.

3. The appeal procedure is governed by the Administrative Procedure Law (APL) of March 18, 2025 [9].

The Council of State sets the fees and the schedule of charges that the State Chancellery and the operator may collect for the tasks assigned to them.

This law is subject to an optional referendum.

1. The Council of State sets the date for the entry into force of the present law.

2. It provides, if necessary, for its promulgation and execution.

Law approved by the Federal Chancellery on December 3, 2004.

Law promulgated by the Council of State on December 22, 2004.

The entry into force is set to take effect on January 1, 2005.