Ordinance on the Protection of Personal Data (Cantonal Data Protection Ordinance) (Kantonale Datenschutzverordnung) - Address Books and Directories

1. For publications of general interest, the following personal data may be disclosed

a) for address books and similar reference works: name, first name, company, address, profession, and title of natural and legal persons

b) for state calendars, official directories, and similar reference works: name, first name, title, profession, year of birth, address, telephone number, and function of persons who are or have been in public service

c) for vehicle and ship owner directories: name, first name, company, and address of owners

2. A planned disclosure must be communicated to the supervisory authority at such an early stage that it can intervene if necessary.

3. The disclosure of personal data in connection with births, deaths, proclamations, and marriages is governed by the cantonal civil status ordinance.

4. The blocking of personal data pursuant to Article 11 Paragraph 1 of the law and other lawfully permitted exceptions to publication remain reserved.

5. There is no legal entitlement to the disclosure.

1. If an affected person wishes to block the disclosure of their data to private individuals and organizations, they must notify the responsible bodies in writing.

1. In the absence of any other statutory provision, orders for the processing of personal data by third parties shall be issued in writing in accordance with Article 13 of the Act.

2. The order shall specifically regulate

a) the subject and scope of the delegated tasks

b) the handling of personal data (responsibility, purpose limitation, authority)

c) confidentiality obligations

d) the handling of requests for information from the data subject

e) the measures to be taken to protect the data

f) the monitoring of the fulfillment of the order

g) the sanctions in the event of a breach of duty

h) the contract duration and the conditions for contract termination

i) the return or destruction of the data upon contract termination

1. The information security to be ensured by the responsible body pursuant to Art. 14 of the Act specifically includes protection against

a) unauthorized or accidental destruction

b) accidental loss

c) technical errors

d) falsification, theft or unlawful use

e) unauthorized modification, copying, access or other unauthorized processing

2. The technical and organizational measures must be proportionate and periodically reviewed.

3. They particularly take into account the following criteria

a) Purpose of data processing

b) Nature and scope of data processing

c) Possible threats to the personal rights of the affected individuals

d) State of the art technology

1. The responsible body shall implement the appropriate technical and organizational measures to ensure information security. The measures consist, in particular, of

a) Access controls: Unauthorized persons must be denied access to facilities where personal data is processed.

b) User controls: Unauthorized persons must be denied the use of facilities where personal data is processed.

c) Data carrier controls: It must be impossible for unauthorized persons to read, copy, alter, destroy, or remove personal data carriers.

d) Access restrictions: The access of authorized persons must be limited to the personal data required for the performance of their duties.

e) Recipient identification: Recipients of disclosed personal data must be identifiable.

2. The measures taken must be documented in organizational regulations, information security policies, or access concepts for the purpose of demonstrating compliance with data protection regulations.

1. An increased risk to fundamental rights within the meaning of Art. 14b of the law exists in particular when a project

a) involves the collection of a large amount of particularly sensitive personal data or systematic profiling

b) is associated with the use of new technologies

c) affects a large number of people

d) involves systematic and extensive surveillance of public areas

1. The supervisory authority fulfills its tasks independently.

2. The cantonal supervisory authority is administratively assigned to the Department of Economic Affairs.

3. If there is assurance for the proper fulfillment of tasks according to data protection regulations, municipalities and other public institutions may establish their own supervisory authority with the authorization of the Government Council.

1. The reports of the cantonal supervisory authority on its activities are published in the administrative report.

2. If municipalities and other public institutions have established their own supervisory authority, they independently determine the manner in which the activity reports are published.

1. Public authorities may charge fees for operations based on the law and this regulation. For cantonal authorities, the Administrative Fees Ordinance applies, particularly its § 14.

2. For notifications pursuant to § 1 of this regulation as well as requests for injunctions and other claims under § 21 of the law, the rates specified in § 12 of the Administrative Fees Ordinance apply.

3. No fees shall be charged for

a) providing information in accordance with Art. 18 of the law, subject to the exceptions mentioned in the law

b) processing requests for corrections under Art. 20 of the law

c) processing requests for injunctions and other claims under Art. 21 of the law

d) providing information by the supervisory authority, its mediation activities, and handling submissions and complaints pursuant to Art. 25 para. 1 lit. b, c, and d of the law

4. In the cases of para. 3 lit. b to d, an appropriate fee may exceptionally be charged, with prior notification of the amount, if the request is abusive, particularly in cases of excessive requests concerning the same matter.

1. This regulation shall enter into force on December 1, 2021.

2. It is to be published in the Official Gazette and included in the cantonal legal collection.

3. It replaces the Regulation on the Protection of Personal Data (Cantonal Data Protection Regulation) of February 28, 1995.