Act on Data Protection (Data Protection Act, kDSG) (Datenschutzgesetz, kDSG) - Scope

1. This law governs the processing of data of natural persons by public bodies.

2. It applies to cantonal and municipal authorities and offices, as well as other public-law entities and institutions and individuals, insofar as they perform public tasks.

3. The law is not applicable to

a. public bodies acting under private law;

b.-d. * ...

e. administrative internal work tools intended for personal use.

4. Data protection regulations in sectoral legislation, notably concerning the processing of court records, patient data, and resident registration data, remain reserved.

5. In proceedings of civil, criminal, and administrative legal processes, the rights and claims of the affected persons are governed by the applicable procedural law. The provisions of this law apply to first-instance administrative proceedings.

1. Insofar as this Act does not contain any deviating provisions, the provisions of the Federal Act on Data Protection (FADP) apply mutatis mutandis.

2. If public bodies jointly or with third parties process personal data from a data collection, the owner of the data collection bears the responsibility; each public body remains responsible for its own area.

3. The public body must be able to demonstrate that it complies with data protection provisions.

4. The penal and law enforcement authorities in accordance with Art. 3 No. 7 of Directive (EU) 2016/680 shall notify the authority from which the personal data originate, as well as the recipients to whom the personal data were disclosed, of corrective measures taken, insofar as this is possible with reasonable effort.

1. Personal data shall generally be collected from the data subject or from the data records of a public authority.

2. The collection of personal data by other means is exceptionally permissible, insofar as this law does not prohibit it.

3. ...

1. If a data protection impact assessment by criminal justice and penal system authorities pursuant to Art. 3 No. 7 of Directive (EU) 2016/680 reveals that the planned processing of personal data presents high risks to the rights and freedoms of the affected person, despite the measures envisaged, the planning authority shall obtain the opinion of the designated data protection officer in advance.

2. The designated data protection officer shall communicate their objections to the planned processing to the planning authority within two months. This period may be extended by one month if the data processing is complex.

3. The designated data protection officer may specify the data processing operations that must be submitted to them.

1. The penal and correctional authorities pursuant to Art. 3 point 7 of Directive (EU) 2016/680 shall maintain the necessary records of their data processing activities and make these records available to the appointed data protection officer upon request.

2-3

...

1. The criminal and law enforcement authorities pursuant to Art. 3 No. 7 of Directive (EU) 2016/680 shall designate a person responsible for data protection within their organizational unit (data protection officer). This responsibility does not extend to the judicial activities of the courts and other independent criminal authorities.

2. The government council and the higher court may designate a joint person for several organizational units.

3. The data protection officer also conducts the data protection impact assessment.

1. Public authorities according to Article 5 of the Ordinance on the State Archive offer the State Archive all personal data that they no longer need on a permanent basis.

1a. The criminal justice authorities and enforcement agencies according to Article 3 Section 7 of Directive (EU) 2016/680 establish deadlines for the retention or evaluation of all personal data to determine whether the data are still needed for task fulfillment or should be offered to the State Archive.

2. Public authorities shall destroy personal data designated by the State Archive as not worthy of archiving, except when they

a. are anonymized and further used for official or statistical purposes;

b. must be retained for evidentiary or security purposes.

3. The municipal public authorities are subject to paragraphs 1 and 2 analogously.

1. Publicly accessible places may be monitored by technical devices for the protection of persons and property if

a. the monitoring is made clearly identifiable in an appropriate manner;

b. the stored personal data is deleted after a maximum of 100 days or is handed over to the police with a criminal complaint or report within this period; and

c. * the person responsible for data protection has been informed in advance of the introduction of monitoring.

2. The installation of monitoring devices is ordered by the public body that has the right of use or sovereignty over the location to be monitored.

1. Personal data and data of legal entities, including particularly sensitive data, may be processed by public bodies in electronic information, business management, and data storage systems, provided they serve the purpose of

a. handling transactions;

b. organizing workflows;

c. determining whether data about a particular person is being processed;

d. facilitating access to official documents;

e. fulfilling legal duties.

2. Access to personal data and data of legal entities, including particularly sensitive data, may be granted to other public bodies or third parties if the legal basis required for disclosure is present.

1. The Executive Council is responsible at the cantonal level for issuing decrees, orders, and decisions that, according to federal data protection legislation, fall under the jurisdiction of the Federal Council at the federal level.

2. It issues the implementing provisions necessary for execution. It can regulate in detail the following areas in particular

a. * Processing, procurement, disclosure, storage, and special forms of processing within the framework of federal law (Art. 2 para. 1 of this Act);

b. Responsibility in joint data processing by several public bodies (Art. 2 para. 2 of this Act);

c. * Minimum requirements for data security (Art. 8 FADP);

d. * ...

e. * Modalities of the right to information (Art. 25 to 29 FADP);

f. * Right to measures (Art. 41 FADP);

g. * Fee-based official actions;

h. * Proof of data protection (Art. 2 para. 3 of this Act);

i. * Register of data processing activities (Art. 5 of this Act);

j. * Data protection advisor (Art. 5a of this Act);

k. * Information, business management, and data filing systems (Art. 7a of this Act);

l. * Content and scope of data protection impact assessment (Art. 22 FADP).

3. The Supreme Court issues the regulations necessary for execution within its supervisory domain, particularly those applicable to the criminal and penal enforcement authorities according to Art. 3 Para. 7 of Directive (EU) 2016/680.

4. The Executive Council and the Supreme Court can declare the regulations for criminal and penal enforcement authorities according to Art. 3 Para. 7 of Directive (EU) 2016/680 applicable to other public bodies.

1. The Cantonal Council shall appoint a person as Data Protection Officer and a deputy for the constitutionally defined term of office.

2. The appointed Data Protection Officer shall perform their duties independently and autonomously; the provisions of Art. 21 et seq. of the Court Organization Act concerning court administration shall apply mutatis mutandis.

3. They are under the supervision of the Cantonal Council. Administratively, they are assigned to a department or to the State Chancellery.

4. The appointed person, their deputy, and their assistants are subject to the same confidentiality rules as the public body processing the data; this also applies after the termination of their function.

5. The Governing Council may, while respecting the election and supervisory rights of the Cantonal Council, transfer the duties of the Data Protection Officer to a suitable person or entity in another canton by agreement or establish a joint body with other cantons for these tasks.

1. ...

2. The appointed Data Protection Officer

a. monitors the application of data protection regulations;

b. advises public authorities and concerned individuals on data protection issues;

b1. raises awareness among public authorities about their data protection obligations and educates the public on matters of data protection;

c. comments on draft regulations and measures that are of significant importance to data protection;

d. provides an account of their activities.

3. The appointed Data Protection Officer fulfills these tasks by particularly

a. conducting audits at public authorities;

b. giving opinions within the framework of preliminary consultations;

c. handling submissions and notifications related to data protection;

d. ...

e. collaborating with supervisory authorities of other cantons, the federal government, and abroad;

f. preparing a report on activities for the Cantonal Council.

4. The appointed Data Protection Officer may publish important findings and measures in the field of data protection.

1. The appointed Data Protection Officer is authorized, notwithstanding any confidentiality obligations, to

a. obtain all information necessary for fulfilling their supervisory duties regarding data and its processing from public authorities or designated third parties;

b. review all data collections, documents, and files;

c. conduct inspections;

d. observe data processing operations being carried out.

2. The Data Protection Officer may engage experts for specific tasks.

3. Public authorities are obligated to support the appointed Data Protection Officer in the fulfillment of their duties.

1. Exemptions from Supervision by the Appointed Data Protection Officer

a. the Cantonal Council;

b. the Executive Council;

c. the judicial authorities in the scope of their adjudicative functions;

d. the public prosecutor's office in the scope of their activities in criminal proceedings;

e. the other cantonal and municipal public bodies in the scope of their adjudicative functions.

1. The procedure is governed by the State Administration Act.

1. If a request by a person, particularly concerning information, access, or fulfillment of a claim within the meaning of Article 25 of the Federal Act on Data Protection, is not fully granted, the public authority shall issue a contestable decision if the affected person so requests.

2. The decision must also be communicated to the appointed Data Protection Officer, who has the right to file a complaint.

1. The designated Data Protection Officer shall act on their own initiative or upon notification.

2. They shall ascertain the facts ex officio.

3. If the assessment reveals that data protection regulations have been violated, the designated Data Protection Officer shall propose measures to the public authority. The superior authority must be informed.

4. If the proposal is not fully complied with, the designated Data Protection Officer may issue a contestable resolution in cases of significant data protection violations. No resolution may be issued against the highest court and the administrative court.

5. The public authority and the designated Data Protection Officer have the right to appeal. The public authority responsible for filing an appeal is determined in accordance with Article 10, paragraph 1, and the competent appeal bodies according to Article 10, paragraph 3 of the Freedom of Information Act.

1. Access and Insight by the Affected Person are Generally Free of Charge.

1. Anyone who

a. as a third party, processes personal data on behalf of a public authority and uses or discloses the data in a manner contrary to the order;

b. as a third party, receives personal data from a public authority for non-personal purposes and uses or discloses the data in a manner contrary to the purpose,

shall be punished with a fine or imprisonment of up to three years.

2. Furthermore, the provisions of the law on cantonal criminal law apply.

1. The provisions apply to data processing activities conducted after the entry into force of this Act.

2. The processing of existing data collections must be adjusted to the new law within two years following the entry into force of this Act.

1. ...

1. The Government Council determines when this law comes into force. It is subject to an optional referendum.