Law on Data Processing for Administrative and Financial Management Purposes within the State, of December 5, 2017 - Purpose

1. This law governs the processing and online access to personal and sensitive data, as well as data subject to tax secrecy, necessary for the fulfillment of administrative and financial management tasks within the State.

2. Data processed for statistical and analytical purposes are handled in accordance with the Cantonal Statistics Law (LStat) of January 25, 2011 [3].

1. A database intended to allow data processing in accordance with this law is established (hereinafter: "central file").

2. The Council of State exercises supreme oversight over this file.

3. It designates the entity or entities responsible for, within the framework of maintaining the central file

a) administratively organizing management;

b) maintaining the register of access beneficiaries;

c) setting the conditions of access and use;

d) monitoring the operator;

e) ensuring that security standards are sufficient;

f) establishing the procedure for the destruction of records.

For the purposes of this law, the following definitions apply

Recipients: the administrative, judicial, and legislative entities of the State, as well as the functions and offices attached thereto, which must rely on data held by other State entities in order to fulfill their tasks;

Disseminators: the administrative, judicial, and legislative entities of the State, and the functions and offices attached thereto, as well as communal authorities, that hold data necessary for the fulfillment of the tasks of the recipients.

1. The recipients are responsible for complying with the provisions relating to the protection and maintenance of the confidentiality of the processed data.

2. The disseminators inform the recipients of the existence of specific requirements applicable to the processed data.

1 Except for personal data, only sensitive data falling within the following categories may be processed by the recipients, to the extent necessary for the performance of their duties

a) data on political and trade union activities;

b) health data, limited to the causes of an employee's absences and their duration, or their special needs;

c) data on religious affiliation;

d) data on social aid or assistance measures;

e) data on criminal or administrative prosecutions or sanctions.

2. Excluded under the present law is the transmission of data on religious, philosophical, political and trade union opinions as well as data on religious and philosophical activities.

3. Tax authorities may transmit data subject to tax secrecy necessary for the performance of the recipients' tasks.

4. The Council of State specifies which personal and sensitive data and which data subject to tax secrecy may be transmitted in accordance with this law.

1. The department in charge of finance may process the data mentioned in Article 5, paragraphs 1 and 3, necessary for the fulfillment of its tasks of collection, payment, and accounting.

2. The Council of State specifies the tasks requiring the processing of sensitive data and data subject to tax secrecy.

1. The department responsible for logistics and acquisitions may process the data mentioned in Article 5, paragraph 1, necessary for performing its tasks of billing, accounting, managing orders for services or goods with third parties or by third parties, as well as their monitoring.

2. The Council of State specifies the tasks requiring the processing of sensitive data.

1. The human resources department may collect and process the data mentioned in Article 5, paragraph 1, to the extent necessary to fulfill its duties as derived from the Public Service Statute Law (PSSL), dated June 28, 1995 [4], and its implementing regulations [5].

2. The human resources department may transmit data concerning state personnel to the following authorities and functions, solely to enable them to carry out their duties as derived from the PSSL and its implementing regulations

– Council of State;

– department heads;

– general secretaries;

– heads of service or office;

– heads of administrative units;

– executives designated by the Council of State.

3. The data processed is provided by the employees themselves or their hierarchy, subject to data processing provided for by other cantonal or federal laws.

4. The human resources department processes data concerning personnel of independent cantonal institutions to the extent necessary to fulfill personnel management tasks as entrusted to it by an organizational law or a service contract.

5. The Council of State specifies the tasks requiring the processing of sensitive data.

1. The broadcaster's data, including those subject to tax secrecy, may be consulted or collected online by the recipient.

2. Each user of the central file receives personal and confidential access rights.

3. The Council of State defines access to personal and sensitive data, as well as data subject to tax secrecy, and their terms.

The broadcaster may communicate the data, including data subject to tax secrecy, by entering it into the recipient's file or into the central file.

1 The processed data shall be retained as long as necessary for the performance of the tasks of the cantonal financial control, in addition to those of the relevant services.

1. The IT department of the Neuchâtel entity shall implement a logging system to monitor access to processed data.

2. It shall also implement a logging system for data modification.

1. The IT department of the Neuchâtel entity is responsible for

a) conducting data extraction for statistical purposes when required;

b) conducting data extraction at the request of the file manager or with their consent;

c) granting access rights in accordance with this law and its implementing regulations;

d) ensuring that data is protected against misuse by taking appropriate organizational and technical measures;

e) ensuring the integrity, availability, and confidentiality of data;

f) establishing a transaction history;

g) managing the technical infrastructure of the central file;

h) proposing to the entities designated by the Council of State, in accordance with Article 2, paragraph 3, the adaptation of security standards based on technological advancements.

2. An annual review of access rights is conducted.

3. Access to personal and sensitive data processed is permitted to the extent necessary to fulfill the tasks described in paragraph 1.

The Council of State establishes the implementing provisions.

The rules on data protection apply for the remainder.

The amendment of the current law is included in annex 1.

This law is subject to an optional referendum.

1 The Council of State shall provide, if necessary, for the promulgation and execution of the present law.

2. It shall determine the date of its entry into force.

Law promulgated by the Council of State on January 22, 2018.

The entry into force is set to take effect as of January 1, 2018.

MODIFICATION OF THE CURRENT LAW

The Cantonal Finance Control Act (CFCA), of October 3, 2006 [7], is amended as follows