**Art. 1 LPDP Law on Personal Data Protection (LPDP)** (LPDP)

This Law aims to protect fundamental rights, in particular personality and privacy, of individuals whose data are processed by public bodies in accordance with Article 2.

Scope of Application

1 The Act applies to every processing of personal data, irrespective of the purposes, methods and procedures used.

2 The Canton, the Municipalities, other corporations and institutions under public law and their organs are subject to the Act. Physical and legal persons under private law to whom public tasks are delegated are equated with these.

3 The Act does not apply to the extent that one of these entities participates in an economic activity that does not derive from sovereign power.

1. When civil, criminal or administrative proceedings are ongoing, the protection of the data subject is guaranteed by specific legislation. However, this Law also applies in such cases if the specific legislation does not guarantee the person equivalent protection. This Law is always applicable to administrative proceedings of first instance. [2]

2. Where civil, criminal or administrative proceedings involve the creation of data archives, this Law is always applicable.

[2] Para. amended by Law of 23.6.2008; in force since 1.10.2008 - BU 2008, 549.

[3] 1 Personal data means information or indications that directly or indirectly allow the identification of a person, whether a natural or legal person.

2 Personal data deserving of particular protection includes, in particular, information on religious, philosophical, or political opinions or activities, the intimate sphere, psychic, mental, or physical condition, as well as information on committed crimes, related penalties imposed, and measures taken.

3 Processing of personal data means any operation intended, in particular, to collect, store, use, modify, transmit, or destroy such data.

4 Systematic processing means an operation that implies regularity or duration (as opposed to processing data in a single case of necessity). [4]

5 A data file means a collection of personal data prepared or capable of being prepared for the identification of the data subjects.

6 The responsible body means the administrative authority registered in the Central Register that decides on the content and type of use of the data, ensuring its control and management.

7 Participating bodies mean the administrative units that have the right to process data autonomously but do not have the power to define the purpose or structure of the file.

8 Neutral data means surname, first name, and address.

[3] Art. amended by L 13.12.1999; in force since 1.1.2001 - FO 2000, 383.

[4] Para. introduced by L 23.9.2015; in force since 1.1.2016 - FO 2015, 514.

To the archives of the cantonal police, special legislation applies.

[6] 1 Personal data may be processed systematically if a legal basis exists. If the data is particularly sensitive, the legal basis must be in the form of a formal law.

2 The processing of data in individual cases may also be justified by the necessity for the fulfillment of a legal task or by the consent of the data subject.

3 The legal basis specifies, in particular, the object and purpose of the processing, the responsible body, the participating bodies and users, the recipients of data, the methods and conditions, the circle of data subjects, the data retention period, and the security measures.

Principles [7]

[6] Art. amended by L 23.9.2015; in force since 1.1.2016 - BU 2015, 514.

[7] Marginal note amended by L 23.9.2015; in force since 1.1.2016 - BU 2015, 514.

[8] 1 Personal data may only be processed lawfully.

2 Data processing must comply with the principle of good faith.

3 Personal data and the manner of their processing must be suitable and necessary for the fulfillment of the task.

4 Personal data may not be used or transmitted for a purpose that, according to good faith, would be incompatible with that for which they were originally collected.

5 Personal data must be accurate and, to the extent that the purpose of processing requires it, complete.

[8] Art. amended by L 23.9.2015; in force since 1.1.2016 - BU 2015, 514.

[9] 1 The body that processes or has personal data processed for the performance of its legal duties is responsible for data protection.

2 Each body that uses the data archive is responsible for the accuracy of the data it processes.

3 Civil liability for damages caused by a body to third parties through data processing is governed by the law on the civil liability of public entities and public agents.

[9] Art. amended by L 13.12.1999; in force since 1.1.2001 - BU 2000, 383.

1 Personal data should, where possible, be collected from the data subject.

2 When personal data are collected systematically, particularly through questionnaires, the legal basis and purpose of processing must be indicated. In other cases, this information shall be communicated to the data subject upon request, provided that it does not jeopardize the fulfillment of legal duties.

[10] Personal data may be transferred to other public bodies if

a) the responsible body is obliged or authorized to do so by law, or

b) the data, in the specific case, are indispensable to the requesting body for the performance of its legal duties, or

c) the data subject, in the specific case, has given their consent or the circumstances allow it to be presumed; in the case of personal data warranting special protection, consent must be explicit.

[10] Art. amended by Law of 15.3.2011; in force since 1.1.2013 - BU 2012, 426.

[11] 1. Personal data may be transmitted to private individuals if

a) the responsible body is authorised or obliged by law to do so, or

b) the data subject has made their data accessible to anyone and has not formally objected, in accordance with and within the limits of Art. 25a, to their transmission, or

c) the data subject, in the specific case, has given their consent or circumstances allow it to be presumed; in the case of personal data particularly worthy of protection, consent must be explicit.

2. Within the scope of official public information, the responsible body may transmit personal data even ex officio or by virtue of the Law of 15 March 2011 on Information and Transparency of the State if

a) the personal data to be transmitted are related to the fulfilment of public tasks, and

b) there is a preponderant public interest in the publication of the data.

3. In any case, personal data contained in official publications accessible to anyone may, upon request, be transmitted to the same extent and according to the same criteria used in the publication.

4. The Council of State regulates the transmission of personal data for directories and similar publications of general interest.

[11] Art. amended by the Law of 15.3.2011; in force since 1.1.2013 – BU 2012, 426.

[12] 1 The Residents' Registration Office shall transmit, upon written request, information concerning the surname, first name, sex, address, date of arrival and departure, profession, place of origin and date of birth of a single person, if the applicant demonstrates a legitimate interest.

2 The Municipal Council may systematically transmit neutral data, within the meaning of Art. 4 para. 7, if their use solely for ideal purposes is guaranteed.

3 The Municipal Council may transmit other data concerning a single person, provided that the applicant demonstrates an interest particularly worthy of protection.

3) Through cantonal services [13]

[12] Art. amended by L 13.12.1999; in force since 1.1.2001 - BU 2000, 383.

[13] Marginal note amended by L 13.12.1999; in force since 1.1.2001 - BU 2000, 383.

[14] The service managing the cantonal population register transmits to the applicants and under the same conditions the data referred to in Art. 12 para. 1; until the said register becomes functional, the cantonal service managing the Register of Foreigners shall process requests concerning foreign citizens.

[14] Art. modified by L 13.12.1999; in force since 1.1.2001 - BU 2000, 383.

1 The transmission of personal data may be limited or made subject to conditions if important public interests so require or if the data warrant particular protection for the data subject.

2 Personal data subject to specific secrecy provisions may only be transmitted if the recipient is also subject to a corresponding duty of secrecy or if they undertake such an obligation. Legal provisions that require the consent of the data subject remain reserved.

3 The responsible body may permit access to personal data through a retrieval procedure if this is explicitly provided for. Personal data warranting particular protection may only be made accessible through a retrieval procedure if explicitly provided for by a formal law. [15]

4 The responsible body may make personal data accessible to anyone through automated information and communication services if a legal basis provides for the publication of such data or if it makes information accessible to the public by virtue of Art. 11 para. 2. If the public interest in making them accessible no longer exists, these data must be removed from the automated information and communication service. [16]

[15] Para. introduced by the L 15.3.2011; in force since 1.1.2013 - BU 2012, 426.

[16] Para. introduced by the L 15.3.2011; in force since 1.1.2013 - BU 2012, 426.

[17] **1** Personal data may not be transmitted abroad if the personality of the data subject could suffer serious prejudice, due in particular to the absence of legislation ensuring adequate protection.

**2** If legislation ensuring adequate protection is absent, personal data may only be transmitted abroad if

a) sufficient guarantees, notably contractual ones, ensure adequate protection abroad;

b) the data subject has given their consent in the specific case;

c) in the specific case, the transmission is indispensable for protecting an overriding public interest or for establishing, exercising, or enforcing a legal claim;

d) in the specific case, the transmission is necessary to protect the life or physical integrity of the data subject;

e) the data subject has made the data accessible to anyone and has not formally objected to their processing.

**3** The responsible body shall inform the Cantonal Data Protection Commissioner about the guarantees pursuant to paragraph 2 letter a). The Council of State shall regulate the details.

**4** Where adequate protection is ensured, the transmission is lawful if the conditions applicable to the transmission of data within Switzerland are met.

[17] Art. introduced by L 23.6.2008; in force since 1.10.2008 - BU 2008, 549.

[18] 1 The responsible body may process or transmit personal data to third parties without reference to specific persons, namely for statistical, planning, scientific, and research purposes, if

a) the data are anonymized as soon as the purpose of processing allows;

b) the recipient transmits the data only with the authorization of the responsible body;

c) the results of the processing are published in a form that does not allow the identification of the data subjects; and

d) the recipient provides the conditions for respecting confidentiality and other provisions relating to data protection and security.

2 If personal data are processed without reference to specific persons, the obligation to observe purpose compatibility (Art. 6 para. 3) and the limits imposed on transmission (Art. 10 and 11) no longer applies.

[18] Art. amended by L 1 5.3.2011; in force since 1.6.2012 - BU 2012, 128.

1 If the responsible body commissions another public body or third parties to process personal data, data protection according to the present law must be guaranteed by conditions, agreements, or in other ways.

2 Without explicit derogating authorization, the mandated service may only use personal data for the principal and transmit them only to the latter.

Whoever processes personal data must take appropriate security measures against loss, theft, unlawful processing, and consultation.

1 Every project involving automated processing of personal data must, from the outset, take into account the needs for the protection of the persons concerned.

2 Before implementing data processing operations that potentially present specific risks for the rights and freedoms of individuals, the responsible body shall inform the Cantonal Data Protection Officer. [20]

[20] Para. introduced by Law of 23.6.2008; in force since 1.10.2008 - BU 2008, 549.

1 The responsible body shall keep a register of its data files. The register shall be public.

2 It shall contain, for each data file, information concerning the legal basis, purpose, and means of processing, the nature and origin of the personal data processed, as well as the bodies that share the file and the regular recipients of the personal data.

3 Data files that are not used to assess the data subjects and that

a) are used only for a short term;

b) are published in accordance with the law;

c) are merely copies or working tools.

[21] 1 The Cantonal Data Protection Officer manages the central register of data files.

2 The Council of State regulates, in particular, the content and publication of this register.

3 Municipalities reserve the right to establish their own central register if, in accordance with Art. 31b, they appoint their own supervisory authority.

Retention, archiving and

destruction [22]

[21] Art. amended by L 15.3.2011; in force since 1.6.2012 - BU 2012, 128.

[22] Marginal note amended by L 15.3.2011; in force since 1.6.2012 - BU 2012, 128.

[23] 1 Personal data shall be stored as long as specific and objective needs for their use exist and, therefore, as long as they are necessary for the purposes for which they were lawfully collected or processed.

2 The responsible body shall establish, for each data file, the modalities and terms for the storage, archiving, and destruction of personal data, unless this is determined by special provisions of federal or cantonal law.

3 In accordance with the Act on Archiving and Public Archives of 15 March 2011, the responsible body shall offer the competent archival institution to take over all documents containing personal data that it no longer permanently needs or that are no longer useful for current activities.

4 The responsible body shall determine, in collaboration with the competent archival institution, the modalities for the storage of such documents.

5 The responsible body shall destroy personal data that the competent archival institution has designated as having no archival value, except when such data

a) are anonymized;

b) must be stored as evidence, for security measures, or to safeguard a legitimate interest of the data subject.

[23] Art. amended by the Act of 15.3.2011; in force since 1.6.2012 – BU 2012, 128.

Anyone may consult the register of each responsible body or the central register of data archives.

1 Anyone may request information from the responsible body concerning the potential processing of data relating to them.

2 The information must be provided in an intelligible form and, upon request, in writing.

3 Unless important reasons prevent it, the data subject may, upon request, directly consult their own data.

1 Information may only be limited or refused when important public interests or the particularly protectable interests of third parties so require.

2 If the information cannot be communicated to the applicant because it would cause distress, it may be given to a person of their trust.

3 If the applicant is unable to demonstrate a protectable interest, the information may also be limited or refused when

a) it entails an excessive administrative burden and the applicant is unwilling to bear the costs;

b) the personal data have been definitively archived;

c) the personal data are processed without reference to specific persons.

1 Any person who can demonstrate a protectable interest may demand from the responsible body that inaccurate personal data be rectified.

2 If the responsible body disputes the inaccuracy, it is incumbent upon it to produce evidence of the accuracy of the personal data, if this cannot readily be expected from the applicant.

3 If it is not possible to prove either the accuracy or the inaccuracy of personal data, particularly if it concerns data that imply an assessment of human behavior, the data subject may request that their own version also be noted.

[24] 1 The data subject may at any time block the transmission of their data; the responsible body may require that the request be made in writing.

2 Notwithstanding such blocking, transmission is permitted if

a) the responsible body is legally obliged to do so, or

b) the requester makes it credible that the data subject blocked the transmission for the purpose of preventing the requester from enforcing legal claims and protecting other legitimate interests.

3 Article 11 paragraph 2 remains reserved.

[24] Art. amended by Law of 15.3.2011; in force since 1.1.2013 - AS 2012, 426; previous amendment: AS 2000, 383.

Anyone who demonstrates a legitimate interest may demand from the responsible body that

a) an unlawful processing of personal data be stopped;

b) personal data collected, stored, or used unlawfully be destroyed or that the consequences of the unlawful processing be eliminated;

c) the unlawfulness of a processing be established.

1 If several bodies use personal data from a common data file, the data subject may assert their rights against any body.

2 If an application for the rectification or destruction of personal data is granted, the responsible body shall inform third parties who have provided or received the data, provided that the data subject has a legitimate interest or a legal norm requires it.

[25] In the absence of specific provisions in this law, the proceedings shall be governed by the provisions of the Administrative Procedure Law of 24 September 2013.

[25] Art. amended by L 24.9.2013; in force since 1.3.2014 - BU 2013, 480.

… [26]

[26] Article repealed by Law 23.6.2008; effective from 1.10.2008 - BU 2008, 549.

[29] 1 The Council of State appoints a Cantonal Data Protection Officer as the supervisory and control authority. The Officer is subject to the high supervision of the Grand Council, which confirms the appointment, and is administratively assigned to the State Chancellery.

2 The Officer fulfils their mission autonomously and independently. Adequate resources are allocated to them.

3 The processing of personal data to which this law is applicable, as well as the processing by cantonal offices and institutions entrusted with tasks under federal public law, are subject to the Officer.

b) General duties [30]

[29] Art. amended by L 23.6.2008; in force since 1.10.2008 - BU 2008, 549; previous amendment: BU 2000, 383.

[30] Marginal note amended by L 23.6.2008; in force since 1.10.2008 - BU 2008, 549.

[31] The Cantonal Data Protection Officer specifically

a) supervises the application of data protection regulations by the subjects as defined in Article 2, paragraph 2;

b) informs data subjects of their rights;

c) acts as an intermediary between data subjects and the responsible bodies;

d) advises the responsible bodies on matters relating to data protection and security, particularly on projects involving automated processing of personal data;

e) invites the competent authority to take the necessary measures in case of a violation or risk of violation of legal data protection provisions;

f) preliminarily examines draft legislative acts and measures relevant to data protection, including processing operations that potentially present specific risks to individuals' rights and freedoms;

g) exercises high supervision over municipal data protection officers in data protection matters;

h) annually submits a report to the Grand Council and the Council of State commenting on their activities. This report is published;

i) acts as the consultative body for the Canton in data protection matters;

j) cooperates, to the extent necessary for the performance of their duties, with other supervisory authorities of the Cantons, the Confederation, and other countries, in particular by exchanging all useful information with them.

c) Competences and Modus Operandi [32]

[31] Art. amended by L 23.6.2008; in force since 1.10.2008 - BU 2008, 549; previous amendment: BU 2000, 383.

[32] Marginal note amended by L 23.6.2008; in force since 1.10.2008 - BU 2008, 549.

[33] 1 The Cantonal Data Protection Commissioner, as the supervisory and control authority, intervenes on its own initiative or upon notification from third parties.

2 It ascertains the facts ex officio. The responsible bodies must support the Commissioner in the performance of its functions, particularly by cooperating with the investigation.

3 To fulfill its duties, the Commissioner may demand oral or written information concerning data processing from public bodies and from third parties entrusted with processing personal data or who have received such data from them, consult all documents and files related to specific processing operations, conduct inspections, and request the presentation of processing operations as well as access to their IT systems. Official secrecy cannot be invoked against the Commissioner.

4 If the clarifications show that data protection regulations have been violated, the Commissioner recommends that the responsible body modify or cease the processing. It informs the competent superior authority of the recommendation.

5 If the legitimate interests of a person are clearly threatened or violated, the Commissioner may request the responsible body or the competent superior authority to immediately restrict or cease the processing of personal data.

6 If a recommendation from the Commissioner is rejected or not followed, in whole or in part, it may refer the matter to the competent superior authority. This authority's decision shall be formally communicated to the interested person and the Commissioner.

7 The Commissioner is entitled to appeal against the decision referred to in paragraph 6 and against the decision of the appeal authority.

[33] Art. amended by Law of 23.6.2008; in force since 1.10.2008 - BU 2008, 549; previous amendment: BU 2000, 383.

[35] 1 The Council of State appoints a cantonal Commission for Data Protection and Transparency every four years. The Grand Council confirms its appointment. [36]

2 The Commission is independent. It is composed of five members, including a magistrate or a former magistrate of the judiciary who assumes its presidency.

3 The Commission rules in cases provided for by law.

[35] Art. amended by L 23.6.2008; in force since 1.10.2008 - BU 2008, 549; previous amendment: BU 2000, 383.

[36] Para. amended by L 29.5.2017; in force since 21.7.2017 - BU 2017, 228.

[37] **1** Every data subject may assert the rights established by this law by requesting a judgment from the Cantonal Commission for Data Protection and Transparency. [38]

**2** The request for judgment is typically made as an appeal against a decision by the data processing body, or as a complaint against the latter; the data processing body is a party to the procedure; the Council of State may always intervene as a party.

**3** The Commission is not competent if an appeal against the decision can be brought before another court according to a special law, or if the matter has already been adjudicated by a court.

**4** The Commission may suspend its judgment to promote an attempt at conciliation with the Cantonal Data Protection Officer.

**5** The decisions of the Commission may be challenged before the Cantonal Administrative Court. The data subject, the data processing body, and the Cantonal Data Protection Officer are entitled to appeal.

[37] Art. introduced by Law of 23.6.2008; in force since 1.10.2008 - BU 2008, 549.

[38] Para. modified by Law of 29.5.2017; in force since 21.7.2017 - BU 2017, 228.

[39] Municipalities may appoint their own supervisory authority, in accordance with the procedures set out in the implementing regulation.

Sanctions [40]

[39] Article introduced by L 23.6.2008; in force from 1.10.2008 – BU 2008, 549.

[40] Marginal note amended by L 13.12.1999; in force from 1.1.2001 – BU 2000, 383.

Anyone who processes personal data under a mandate and intentionally fails to comply with the stipulated conditions shall, upon complaint, be punished with a fine not exceeding CHF 10,000. -- .

Official Secrecy [41]

[41] Marginal note amended by L 13.12.1999; in force since 1.1.2001 - BU 2000, 383.

[42] 1 The body that processes data, the supervisory and appeal authorities, and their members and officials, are subject to the obligation of confidentiality, except in cases where the transmission of data is provided for by law.

2 This obligation also continues after the cessation of their respective functions.

3 The transgression of this obligation is punished in accordance with Art. 320 of the Penal Code.

[42] Art. amended by L 23.6.2008; in force since 1.10.2008 - BU 2008, 549.

1 The Council of State and the Municipality, for the activities of their organs, issue regulations on fees, the amount of which may not, in any case, exceed CHF 50.--. They shall, in particular, fix the amounts for extracts and certificates.

2 The following are, however, exempt from fees

a) authorization to consult registers and data

b) the processing of requests in accordance with Articles 25 and 26, if they result in the elimination of an illegality.

… [44]

[44] Art. repealed by Law 23.6.2008; effective from 1.10.2008 - BU 2008, 549.

… [45]

[45] Art. abrogated by L 23.6.2008; in force from 1.10.2008 – BU 2008, 549; previous amendments: BU 2000, 383; BU 2002, 130.

1 The Cantonal Government shall issue the provisions necessary for the implementation of this Act.

2 In particular, it shall regulate

a) the principles of data security;

b) the organisation and management of the cantonal supervisory authority.

1 After the expiry of the terms for the exercise of the right of referendum, this law shall be published in the Official Bulletin of Laws and Executive Acts.

2 The Council of State shall fix its effective date. [46]

Published in OB 1990, 209.

[46] Effective date: 10 July 1990 - OB 1990, 209.