Act on the Protection of Personal Data (Cantonal Data Protection Act) (Kantonales Datenschutzgesetz) - Purpose

1. This law serves to protect the fundamental rights of individuals about whom public bodies process data.

1. The following terms mean

a) Personal data (Data): any information relating to an identified or identifiable person

b) Data subjects: natural or legal persons whose data is processed

c) Public authorities: authorities and departments of the canton and municipalities, public-law corporations and institutions, and individuals entrusted with public tasks

d) * Sensitive personal data

1. Data concerning religious, ideological, political, or trade union views or activities

2. Data concerning health, intimate sphere, or ethnic origin

3. Data regarding social welfare measures

4. Data about administrative or criminal prosecutions and sanctions

5. Genetic data

6. Biometric data

e) * Profiling: the automated evaluation of data to analyze significant personal characteristics or to predict personal developments

f) * Processing: any operation with data, particularly the procurement, storage, maintenance, use, modification, disclosure, archiving, deletion, or destruction of data

g) Disclosure: making personal data accessible, such as granting access, forwarding, or publishing

h) * ...

i) Formal law: cantonal law or equivalent municipal decree subject to referendum

1. This law applies to the processing of personal data by public authorities, regardless of the means and methods used.

2. During ongoing civil, criminal, and administrative legal proceedings, the rights and claims of the affected individuals as well as the access rights of third parties are governed by the applicable procedural law.

3. For the private legal actions of public authorities, the federal legal provisions for the processing of personal data by private individuals apply.

4. Judicial authorities are not subject to the supervisory body according to Art. 23 et seq.

1. Personal data may be processed if

a) there is a legal basis for it, or

b) it is suitable and necessary for the fulfillment of tasks described by law, or

c) the concerned person expressly consents, or their consent can be unequivocally inferred from the circumstances.

2. The processing of personal data must be carried out in good faith and be proportionate.

3. Personal data must be accurate and, insofar as the purpose of processing requires, complete.

4. The processed data must be suitable and necessary for achieving the purpose for which they are processed and must not be processed for longer than is necessary to achieve that purpose.

5. Personal data may only be processed for the purpose specified at the time of collection, which is evident from the circumstances, or is provided by law.

1. Special categories of personal data may only be processed or profiling may only be conducted if

a) a formal statute expressly provides for it or it is indispensable for a task clearly defined in a formal statute, or

b) the data subject has expressly consented or their consent may be unambiguously presumed under the circumstances.

1. The public authority is obligated to inform the affected person about the collection of personal data; this duty to inform also applies when the data is collected from third parties.

2. The affected person must be informed of at least

a) the responsible public authority including contact details

b) the legal basis and purpose of the processing

c) the categories of data recipients, if data disclosure is intended

d) the data processed or categories of processed data

e) the rights of the affected person

3. The transmission of the information may be restricted under the same conditions as the right to information about one's own data (Art. 19).

4. The duty to inform is waived if

a) the processing of data is expressly provided for by law, or

b) providing the information is impossible or only possible with disproportionate effort, or

c) the affected person already possesses the information according to Para. 2.

1. The public authority responsible for data protection is the one that - alone or together with others - decides on the purpose and means of processing data.

2. If several public authorities process personal data from a joint information repository, one public authority must be designated to bear the primary responsibility for data protection.

1. Personal data shall ordinarily be collected from the data subject themselves.

2. ...

1. Personal data may be disclosed by public authorities if

a) there are legal grounds for doing so,

b) the recipient requires the data to fulfill their legal duties,

c) the individual concerned has expressly consented or their consent can be assumed under the circumstances, or

d) the individual has made their data publicly accessible.

2. The government council regulates the disclosure of personal data for directories and similar reference works of general interest.

3. The disclosure of particularly sensitive personal data and profiling results is governed by Art. 5.

1. The entity responsible for maintaining the population register may disclose to a private individual or organization, upon request in any individual case and without restriction, the name, first name, address, dates of arrival and departure, as well as the occupation of a person.

2. The place of arrival and place of departure, date of birth, gender, marital status, and place of origin of a person may be disclosed if a legitimate interest is credibly demonstrated.

3. If this data, excluding the place of arrival and place of departure, is used exclusively for protected non-material purposes and not disclosed to third parties, it may be disclosed in a manner organized according to certain criteria.

4. Additional personal data may be disclosed if a particularly worthy interest is proven.

1. The public authority refuses the disclosure of personal data, restricts it, or attaches conditions if

a) significant public interests or clearly legitimate interests of the affected person require it, or

b) statutory confidentiality obligations or special data protection regulations demand it.

1. The affected person may request the public authority to block the disclosure of their data to private persons and organizations.

2. Disclosure is permissible despite the block if

a) the public authority is legally obligated to do so, or

b) the applicant credibly demonstrates that the block hinders them in pursuing their own rights against the affected person.

1. For the disclosure of personal data to foreign entities of the European Union, as well as to Contracting States of the Agreement on the European Economic Area and the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (ETS No. 108), the provisions of Art. 8 et seq. shall apply accordingly, in addition to the superior law and treaty law.

1. Personal data may only be disclosed to third countries subject to Articles 8 et seq. if they guarantee an adequate level of data protection in accordance with the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (ETS No. 108).

2. The adequacy of the level of data protection is assessed in accordance with the guidelines of the federal authority and taking into account all circumstances relevant to the data transfer.

3. If a third country does not ensure an adequate level of data protection, personal data may be disclosed to it on a case-by-case basis if

a) The data subject has given their explicit consent beyond any doubt; if the data involves particularly sensitive personal data or personality profiles, the consent must be explicit;

b) The disclosure is necessary to protect the life or physical integrity of the data subject; or

c) The disclosure is essential for safeguarding overriding public interests or for the establishment, exercise, or defense of legal claims in court.

4. The transfer shall not be made if there is reason to believe that it would contravene the Swiss legal order or contradict public policy.

5. Personal data may be disclosed if, in individual cases, sufficient contractual guarantees ensure adequate protection of the data subject.

1. Personal data may be processed for non-personal purposes, such as statistics, planning, science, or research, provided that

a) the data is anonymized as soon as the purpose of the processing allows, and

b) the results are published in such a way that the individuals concerned cannot be identified,

c) * the consent of the data protection officer is obtained.

2. The responsible body may disclose personal data to private individuals or organizations, provided that it is additionally ensured that the personal data is not passed on to third parties and that data security is ensured.

3. In the event of data disclosure to third parties, an agreement must be concluded. A penalty clause may be provided for in the event that data protection regulations are not complied with.

4. In these cases, Art. 4 para. 4 as well as Art. 5 and 8 do not apply.

1. The responsible public authority may assign another public authority or third parties to process personal data if

a) there is no legal provision or contractual agreement opposing the transfer, and

b) it is ensured that the data is processed only in the manner the responsible public authority would be allowed to process it.

2. Data protection must be ensured through agreements, conditions, or other means. The government council will regulate the details through ordinance.

3. The assigned party may not transfer the data processing to any other entity without the prior written consent of the commissioning public authority.

4. The commissioning public authority remains responsible for the handling of the data under this law.

1. Personal data must be protected against loss, theft, and unauthorized processing through appropriate technical and organizational measures.

2. The public authority must be able to demonstrate that it complies with data protection regulations. The government council shall regulate the details by ordinance.

1. The public authority shall report a data protection breach to the supervisory body without undue delay if it leads to a high risk to the fundamental rights of the data subject.

2. If data is processed by a third party on behalf of the public authority, such third party must inform the public authority immediately about any data protection breaches.

3. The public authority shall also inform the data subject when it is necessary for their protection or if required by the supervisory body.

4. The information provided to the data subject may be restricted or withheld upon notification to the supervisory body if overriding public or private confidentiality interests necessitate this.

5. A data protection breach occurs when processed personal data is lost, inadvertently or unlawfully destroyed, altered, or disclosed, or when unauthorized parties have gained access to such data.

1. If the public authority intends to process personal data that is likely to pose an increased risk to the fundamental rights of the data subject, it shall conduct a data protection impact assessment.

2. The data protection impact assessment shall describe the intended processing, the risks to the fundamental rights of the data subject, and the measures envisaged to mitigate the risk of infringement of the data subject's fundamental rights.

1. If the data protection impact assessment indicates that the planned processing presents a high risk to the fundamental rights of the data subject, the public authority shall obtain the opinion of the supervisory authority beforehand.

2. The supervisory authority shall communicate any objections to the planned processing to the public authority within a reasonable period. It may take measures according to Article 26.

1. Personal data that is no longer needed must be destroyed. The provisions regarding archiving are reserved.

2. The Government Council shall issue regulations concerning the cantonal public archives. These apply mutatis mutandis to other public entities, unless they enact their own provisions. The Government Council may regulate the processing of particularly sensitive personal data differently from Article 5.

3. The destruction of personal data that is no longer needed must be postponed as long as there is a legitimate reason to believe that deletion would compromise the legitimate interests of the affected person.

1. The public authority shall inform the recipients of personal data about any rectification, deletion, or destruction of personal data, as well as about annotations pursuant to Article 20 paragraph 3, provided it is assumed that the data is still being processed by the recipients.

2. Notification may be omitted insofar as it is possible only with disproportionate effort.

1. The police, the public prosecutor's office, and the correctional authority maintain public registers regarding data processing activities within their respective jurisdictions.

2. The registers contain information on the legal basis, purpose, and means of processing as well as the type, origin, and regular recipients of personal data.

1. The police, the public prosecutor's office, and the correctional facility designate a person responsible for data protection within their organization.

2. This person has the following tasks

a) they advise and support employees in processing personal data concerning compliance with data protection regulations and data security

b) they conduct data protection impact assessments in accordance with Article 14b

c) they serve as the contact person for the supervisory authority pursuant to Article 23 et seq.

1. ...

2. Upon request, every individual shall be provided with information in generally comprehensible form as to whether and, if so, what data about them is being processed by a public authority. The information is usually provided in writing. It shall include at least the details pursuant to Art. 5a para. 2, as well as information regarding the retention period and the origin of the data. Upon request, documents are provided as printouts, copies, or in electronic form as part of the right to information.

2bis. Exempt from the duty to provide information are data that serve exclusively as personal work tools, notably personal notes.

3. The provision of information is generally free of charge. A reasonable fee may be charged, with prior notice of the amount, if

a) administratively burdensome measures need to be taken to protect the legitimate interests of third parties;

b) the request is abusive, notably in cases of excessive requests concerning the same matter.

1. Disclosure may be deferred, restricted, or refused if required by a legal provision, overriding public interests, or legitimate interests of third parties.

1. Incorrect personal data shall be corrected free of charge upon request within a reasonable period.

2. If the responsible authority disputes the inaccuracy, the burden of proof for the accuracy of the personal data lies with them, provided that the burden of proof is not reasonably expected of the applicant.

3. If neither the accuracy nor the inaccuracy of the data can be proven, the responsible authority shall attach an appropriate annotation to the data.

1. Anyone demonstrating a legitimate interest may request from the responsible entity that it

a) refrains from unlawfully processing personal data

b) destroys personal data that has been unlawfully collected, stored, or used, or otherwise eliminates the consequences of unlawful processing

c) determines the unlawfulness of the processing

1. If an authority does not comply with a request under this law, it shall issue a reasoned decision.

2. An appeal against these decisions can be lodged within 20 days in accordance with Art. 16 et seq. of the Act on Legal Protection in Administrative Matters. The organizational regulations of the publicly recognized ecclesiastical corporations and their institutions shall apply.

**1. The Government Council appoints an independent supervisory authority as a cantonal Data Protection Officer with the appropriate professional qualifications for a term of office of four years.**

**1bis. The cantonal Data Protection Officer may not hold any other public office or function that could lead to conflicts of interest.**

**2. Dismissal is only permissible in the event of:**

**a) intentional or grossly negligent violation of official duties in a serious manner, or**

**b) permanent loss of ability to perform the office**

**3. The supervisory authority carries out its duties with complete independence; it has its own budget.**

**3bis. The appointing authority may, if necessary, approve cooperation with supervisory authorities of other cantons or the employment of specialist personnel.**

**4. Subject to the following provisions, further details are determined by a regulation.**

1. The government council may authorize municipalities and public institutions to establish their own supervisory authority. If no such body exists, the cantonal supervisory authority is responsible.

1. The Supervisory Authority

a) monitors compliance with data protection regulations

b) provides affected individuals with information about their rights

c) mediates between responsible bodies and affected individuals

d) * handles submissions from affected individuals and gives recommendations according to Art. 26 para. 2

e) * advises responsible bodies on matters of data protection and data security, comments on regulations that are significant for data protection, and at its discretion, is entitled to publish these comments

f) * collaborates with the supervisory authorities of other cantons, the federal government, and abroad to fulfill its supervisory role

g) * serves as the cantonal supervisory authority in fulfilling federal responsibilities in accordance with federal data protection legislation [3]

h) * raises awareness among public bodies about their data protection obligations and educates the public on data protection concerns

i) * monitors developments relevant to the protection of personal data

2. It provides a report on its activities to the appointing body annually or as needed. These reports are published unchanged.

1. The supervisory authority is empowered, notwithstanding any confidentiality obligations, to conduct investigations regarding compliance with data protection regulations, obtain all information necessary for fulfilling the oversight mandate concerning data processing, inspect all documents, conduct visits, and request demonstrations of data processing activities.

2. If the supervisory authority determines a violation of data protection regulations, it may issue a recommendation to the responsible body. The person who reported the issue shall be informed of the investigation's outcome and the content of the recommendation.

3. The responsible body shall respond to the recommendation within 30 days. This response is not bound to any specific form. If it rejects the recommendation in part or in full, the supervisory authority may issue a recommendation in the form of a reasoned ruling.

4. Furthermore, the supervisory authority may

a) order a provisional ban on data processing

b) order the blocking, deletion, or destruction of data

c) report to the government council or the cantonal council on data protection deficiencies or violations of data protection regulations

1. An appeal against orders pursuant to Art. 26 para. 3 and para. 4 let. a and b can be lodged by the responsible body to the Government Council.

2. Against appeal decisions of the Government Council, the supervisory authority can file an administrative court complaint with the Higher Court.

3. Unless this law provides otherwise, the procedure and legal protection are governed by the provisions of the Administrative Procedure Act.

1. If the supervisory authority identifies serious violations of data protection regulations by a public body, it shall file a supervisory complaint in accordance with Art. 30 et seq. of the Administrative Procedure Act.

2. If there are indications of a criminal act, the supervisory authority shall report this to the law enforcement authorities.

1. Individuals working at the supervisory authority are bound to the same confidentiality regarding personal data that they become aware of in the course of their duties, as is the processing body.

2. Furthermore, they are obligated to confidentiality when the nature of the matter or specific confidentiality regulations require it.

3. The obligation of confidentiality also applies after the termination of the office or employment relationship.

1. Any person who, as an appointed individual responsible for the processing of personal data pursuant to Art. 13, uses personal data for themselves or others or discloses it to others without an explicit contrary authorization from the commissioning authority, shall be punished with a fine.

1. Article 169 of the Law on Municipalities for the Canton of Schaffhausen (Municipal Law) of July 9, 1892, is hereby repealed.

1. Within one year after the entry into force of this law, the responsible authorities for existing data collections must

a) carry out the registration

b) determine the timing for the destruction of the data

c) take measures for data security

2. Upon a substantiated request, the government council may extend this transitional period by a maximum of one year.

1. This law shall enter into force at a time to be determined by the Government Council following acceptance by the public.

2. It is to be published in the Official Gazette and included in the Cantonal Register of Laws.