Act on Data Protection (TG DSG) - Purpose

1. To Protect Personal Rights, This Law Regulates the Processing of Data by Public Authorities.

1. The provisions of this law apply to any processing of personal data, regardless of the means or procedures used, unless other laws contain specific provisions.

2. Subject to the provisions of this law as public bodies within the meaning of this law are

1. the state, the municipalities, organizations under cantonal public law with their own legal personality, and individuals tasked with public duties of these communities, whether they are members of authorities, officials, or employees, whether they work full-time, part-time, permanently, or temporarily;

2. private organizations and individuals, insofar as they are entrusted with public duties.

3. This law does not apply to activities under private law.

1. Personal data are details about natural or legal persons, as long as they are identified or identifiable.

2. Particularly sensitive personal data include, specifically, information about

1. religious, ideological, or political beliefs or activities;

2. the personal private sphere;

3. the mental, psychological, or physical condition;

4. measures of social welfare or care services;

5. criminal offenses and the penalties or measures imposed for them.

3. Processing of personal data refers to any handling of personal data, such as collecting, storing, using, modifying, disclosing, or destroying.

4. Data collection is any collection of personal data that is arranged or can be arranged according to individuals.

1. Personal data may only be processed if there is a legal basis for doing so, or if it serves a statutory purpose.

2. Personal data and the manner in which they are processed must be suitable and necessary for the fulfillment of tasks.

3. Personal data may not be used or disclosed for a purpose that, in good faith, is incompatible with the original purpose.

4. Particularly sensitive personal data may only be processed if either the admissibility arises from an explicit legal basis, the processing is imperatively required by a statutory task, or the data subject explicitly consents or their consent can be assumed because they claim corresponding public benefits.

1. Personal data must be accurate and complete to the extent required by the purpose of processing.

1. The party responsible for data protection is the one who processes or has personal data processed.

2. If multiple entities use personal data from a shared data collection, an organ must be designated which holds the main responsibility for data protection.

1. Personal data for data collections shall be collected from the person concerned whenever possible.

2. If personal data is collected systematically, particularly through questionnaires, the legal basis and purpose of the processing must be disclosed. In other cases, this information must be provided to the person interviewed upon request, unless fulfilling the legal duty would thereby be compromised.

1. The processing of personal data must be reviewed in advance by the supervisory authorities pursuant to § 17 if it may involve special risks to the rights and freedoms of the data subjects.

1. Personal data may only be disclosed to public authorities if

1. the responsible authority is legally authorized to do so or

2. the receiving authority proves that it requires the personal data to fulfill its legal duties or

3. the data subject has expressly consented, or consent can be presumed under the circumstances.

1. Personal data may only be disclosed to private parties subject to official secrecy if

1. the responsible authority is legally authorized to do so, or

2. the person concerned has explicitly consented, or their consent can be assumed under the circumstances.

2. Personal data contained in publicly accessible official or officially approved publications may only be disclosed to the extent and in the manner in which they are published.

3. The government council regulates the disclosure of personal data for directories or similar reference works of general interest.

1. Personal data may only be transferred to recipients subject to the jurisdiction of states or organizations that are not parties to the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data if these states or organizations provide an adequate level of protection for the intended data transfer.

2. This is subject to the individual consent of the data subject in each specific case and Article 2, paragraph 2 of the Additional Protocol of 8 November 2001 to the Convention referred to in paragraph 1.

1. The disclosure of personal data may be restricted or subject to conditions due to important public or legitimate private interests.

1. If personal data is processed for non-personal purposes, particularly for statistics, planning, science, or research, it may no longer be used or disclosed in a way that allows conclusions to be drawn about the individuals concerned. The results may not be published in a manner that permits inferences about the affected individuals.

2. The responsible body may disclose personal data to private parties, provided that it is additionally ensured that such data will not be passed on to third parties and that data security is guaranteed.

3. If personal data is processed exclusively for non-personal purposes, §§ 4(3), 8, and 9 shall not apply.

1. If personal data are processed by third parties, data protection within the meaning of this Act must be ensured by the responsible authority through a contract or an order.

2. Without explicit authorization, the third party may use personal data only for the responsible authority and disclose it only to this authority.

1. Any person processing personal data shall ensure adequate protection against loss, theft, unauthorized processing, or unauthorized access.

1. Publicly accessible places may be monitored with technical devices for the protection of persons and property if

1. the monitoring is made recognizable in an appropriate manner,

2. the stored personal data is deleted after 100 days or handed over to the police within this period as part of a criminal report, and

3. the supervisory authorities in accordance with § 17 have been informed in advance about the introduction of monitoring.

2. The installation of monitoring devices is ordered by the public authority which holds the right of use or sovereignty over the place to be monitored.

3. The responsible public authority ensures that personal data is protected against unauthorized access. It regulates the access authorization.

1. The responsible authority shall maintain a register of the data collections it has created.

2. The register shall contain, for each data collection, information on the legal basis, purpose, and means of processing, the type and origin of the personal data, the bodies involved in the data collection, as well as the regular recipients of the personal data.

3. Data collections that are

1. only temporary;

2. lawfully published;

3. maintained by the police or other law enforcement agencies in individual proceedings;

4. solely personal work tools and not used otherwise;

shall not be included in the register.

1. The canton maintains a central register of its data collections.

2. Municipalities and other public-law entities maintain their own central register.

1. The responsible authority shall determine when personal data must be destroyed for each data collection.

2. The provisions of the law on record-keeping and archiving remain reserved.

1. The government council appoints a Data Protection and Public Access Officer who performs their duties independently.

2. This officer supervises the processing of data by

1. organs of the canton as well as cantonal public law corporations and institutions,

2. private individuals and organs of private organizations, insofar as they have been entrusted with cantonal public tasks.

3. Municipalities designate their own supervisory authorities.

1. The Data Protection and Transparency Officer has the following tasks

1. He monitors compliance with the data protection regulations;

2. he advises the affected individuals about their rights;

3. he mediates between the affected individuals and the responsible bodies;

4. he advises the bodies on issues of data protection and data security;

5. he performs the tasks assigned to him by the law on the principle of transparency.

2. The Data Protection and Transparency Officer collaborates with the oversight bodies of the municipalities, cantons, federal government, and foreign countries to fulfill the supervisory tasks.

3. He is subject to the same confidentiality obligations regarding personal data that he becomes aware of in the course of his activities as the responsible body.

4. He reports on his activities to the government council and periodically informs them and the public about significant findings and assessments, as well as the effects of the data protection provisions.

1. The Data Protection and Public Information Officer may

1. conduct investigations irrespective of any confidentiality obligations, obtain all information necessary for fulfilling the supervisory mandate regarding data processing, review all documents, conduct inspections, and request demonstrations of processing activities;

2. order the blocking, deletion, or destruction of data, prohibit data processing, or issue instructions to the responsible body on data processing;

3. file a legal remedy against decisions made under this law with the competent department or against decisions of the departments with the administrative court;

4. file a criminal complaint in cases of violations against the Data Protection Act.

2. The responsible bodies are required to support the Data Protection and Public Information Officer.

**1. Everyone may inspect the registers of data collections.**

1. Everyone may request access from the responsible body to data concerning them that is contained in a data collection within the register.

1. Inspection and any provision of information are fundamentally free of charge.

2. If granting the inspection or providing information causes a disproportionate administrative burden, costs may be imposed for these actions.

1. Access to personal data may be restricted or denied if significant public or legitimate private interests require it.

2. If access cannot be granted to the applicant because it would be too burdensome, it may be permitted to a person of their trust.

3. Insofar as granting access would lead to a disproportionate administrative burden, or the personal data is processed exclusively for non-personal purposes, access may be restricted or denied unless the applicant credibly demonstrates a legitimate interest.

1. Anyone who demonstrates a legitimate interest may request the correction of inaccurate personal data.

2. If the responsible authority disputes the inaccuracy, the burden of proof for the accuracy of the personal data lies with them, provided that the applicant cannot reasonably be expected to provide contrary evidence.

3. If, due to the nature of the data, neither the accuracy nor inaccuracy of the personal data can be proven, particularly in the case of value judgments, the affected person may request the inclusion of a counterstatement.

1. An affected party may request from the responsible authority that

1. any unlawful processing of personal data be ceased or refrained from,

2. personal data that has been unlawfully collected, stored, or used be destroyed and the consequences of the unlawful processing be remedied,

3. the unlawfulness of a processing be determined.

1. Anyone who credibly demonstrates a legitimate interest may request that the responsible authority restrict the disclosure of certain personal data.

2. The restriction may be lifted if

1. a law mandates the disclosure, or

2. the restriction prevents the responsible authority from fulfilling its legal obligations.

1. Appeals against decisions based on this law may be lodged with the competent department responsible for the matter.

2. Decisions of the departments and the Data Protection and Public Access Officer are subject to appeal to the Administrative Court.

1. Any person who processes personal data on behalf of another and intentionally uses or discloses it contrary to instructions shall, upon request, be punished with a fine.

1. This statute shall enter into force at a time to be determined by the Executive Council following its approval by the populace.