Regulations for the application of the Cantonal Law on Personal Data Protection (RLPDP) (RLPDP)

… [1]

[1] Article repealed by R 17.9.2008; in force from 1.10.2008 - BU 2008, 554.

[2] 1 The database or personal data bank is an archive or set of archives of personal data processed electronically or in computerized form by one or more bodies.

2 The provisions on personal data archives apply by analogy to the database, subject to specific security requirements.

[2] Art. amended by R 17.9.2008; in force from 1.10.2008 - BU 2008, 554.

Considered copies or working tools within the meaning of Art. 19 para. 3 lit. c) of the Act, are collections of personal data that contain the entirety or a part of a personal data file already notified in the Central Register or that serve exclusively to simplify work.

1 The responsible body

a) officially verifies the lawfulness of every processing of personal data;

b) ensures that the collection is organized in a way that respects the rights of the affected person, particularly the right to information and the right to rectification.

2 In order to guarantee compliance with data protection provisions, the responsible body shall notify the Cantonal Data Protection Officer (hereinafter: the Officer), in their capacity as the cantonal supervisory and control authority, of its intention to carry out systematic processing of personal data. [3]

Processing by multiple bodies

[3] Para. amended by R 17.9.2008; in force since 1.10.2008 - BU 2008, 554.

[4] The use by multiple organs responsible for a bank of personal data or the processing by one organ of personal data contained in the data archive of another responsible organ, is subject to prior notification to the Commissioner.

Data Collection

(Art. 9 LPDP) Exceptions

[4] Art. amended by R 17.9.2008; in force since 1.10.2008 - BU 2008, 554.

The exceptions to Art. 9 para. 1 of the law are permitted if the collection is necessary for the fulfillment of a mandate conferred upon a judicial or administrative authority.

The responsible body must inform the data subject if personal data concerning them are used for a purpose other than the original one.

1 The responsible body shall, ex officio, verify the compatibility of the purposes of its own processing with those of the recipient of the transmission.

2 In case of incompatibility, the responsible body shall immediately notify the Commissioner thereof. [5]

[5] Para. amended by R 17.9.2008; in force since 1.10.2008 - BU 2008, 554.

1 The responsible body decides upon application concerning the transmission of personal data to private individuals or organizations.

2 In the event of a request for systematic or periodic transmission of personal data, the application must contain

a) information concerning the applicant;

b) the type of data subject to transmission;

c) the purpose for which the data will be used.

1 The transmission of personal data must be preceded by the stipulation of an agreement between the responsible body, owner of the data, and the requesting party.

2 The agreement must indicate

a) the legal basis;

b) the list of personal data subject to transmission;

c) the origin of the personal data;

d) the obligation for the requesting party to guarantee the data subject the right of access and information relating to the origin of the data;

e) the security measures incumbent upon the requesting party;

f) the reservation, in favour of the Commissioner, to be able to control the use of the transmitted data at any time; [6]

g) the obligation for the requesting party to comply with the principles of data protection legislation;

h) the costs borne by the requesting party;

i) the amount of the contractual penalty to be applied in the event of a breach of obligations by the requesting party.

3 If the transmission of personal data is periodic, the agreement must also contain the frequency of transmission and a reference to the last update of the data.

Transmission of data for addressing purposes

[6] Letter amended by R 17.9.2008; in force since 1.10.2008 - BU 2008, 554.

1. Transfers of personal data for the purpose of compiling directories and similar publications must be subject to an agreement.

2. The name, surname, and address may be transferred.

[8] 1 The responsible body intending to transmit personal data abroad must comply with the general principles of the FADP and ensure in advance the adequacy of data protection in the destination state.

2 Before transmission abroad, it informs the Commissioner about the guarantees and data protection rules in accordance with Art. 14a para. 2 lit. a FADP.

3 The obligation to inform is considered fulfilled if the data are transmitted using model contracts or standard clauses prepared or recognised by the Commissioner, and if the responsible body generally informs the Commissioner of the use of such model contracts or standard clauses.

4 The Commissioner publishes a list of such model contracts or standard clauses.

5 The responsible body may also apply other safeguards, such as a specific data protection convention or clauses contained in other contracts; these special safeguards must ensure an adequate level of protection.

6 The responsible body takes appropriate measures to ensure that the recipient complies with the guarantees and data protection rules.

7 The Commissioner examines the guarantees and data protection rules communicated to him (Art. 14 para. 2 FADP) and communicates the result of his examination to the responsible body within 30 days of receiving the information.

[8] Art. introduced by R 17.9.2008; in force since 1.10.2008 - BU 2008, 554.

[9] 1 To assess the adequacy of data protection in view of a transmission abroad, the responsible body may rely on the list, published and updated by the federal authorities, of States that possess legislation ensuring adequate data protection.

2 The Commissioner shall oversee and coordinate the necessary information.

[9] Art. introduced by R 17.9.2008; in force since 1.10.2008 - BU 2008, 554.

1 The transmission of personal data to individuals or services that process statistics or to research institutions must be subject to the stipulation of an agreement.

2 The responsible body shall ensure that

a) no norm excludes the transmission;

b) the personal data are processed in such a way as to make the identification of a specific person as difficult as possible.

Security (Art. 17 DPA)

1 The responsible body shall take all suitable measures to ensure data security in accordance with the type of data processed (neutral or sensitive).

2 The Data Protection Officer may at any time verify the effectiveness of the security measures and issue instructions for their enhancement. [10]

[10] Art. amended by Ordinance of 17.9.2008; in force since 1.10.2008 - BU 2008, 554.

[11] The responsible body communicates to the Commissioner every establishment, destruction, or modification of personal data archives.

Central Register (Art. 20 LDPP)

[11] Art. modified by R 17.9.2008; in force since 1.10.2008 - BU 2008, 554.

1 The Central Register contains information on the name of the archive, the responsible body, the type of processing, the legal basis, and the nature of the data.

2 It is public and may be consulted at any time at the Commissioner’s office.

3 The Commissioner publishes the establishment and updates of the Central Register in the Official Gazette. [12]

[12] Para. amended by R 17.9.2008; in force since 1.10.2008 - BU 2008, 554.

The central register and the register of the responsible body may be consulted freely.

Information (Art. 23 FDPA)

1 Anyone intending to obtain information from the responsible body must prove their identity.

2 The responsible body shall inform the interested person, immediately or within a short period, about

a) the data concerning them available in the archive;

b) the legal basis, the purpose of processing, the participating bodies, and the regular recipients.

3 The information shall be provided in written form and, if requested, verbally, or, if technical means permit, through direct consultation.

Limitations (Art. 24 FDPA)

1 The restriction on consulting archives must be motivated in writing. [13]

2 Special provisions concerning health data are reserved.

Rectification (Art. 25 LPDP)

[13] Para. amended by R 17.9.2008; in force since 1.10.2008 - BU 2008, 554.

The rectification shall be notified to all regular recipients of the personal data.

[16] In the exercise of his duties, the Commissioner acts through the Data Protection Service, for which he is responsible.

Cantonal Commission for Data Protection

(Art. 31 et seq. DPA) [17]

[16] Art. amended by R 17.9.2008; in force since 1.10.2008 - BU 2008, 554.

[17] Marginal note amended by R 17.9.2008; in force since 1.10.2008 - BU 2008, 554.

[18] 1 The Cantonal Data Protection Commission adopts its own regulations concerning its organization, functioning, and procedure.

2 The regulations are published in the Official Bulletin of Laws and Executive Acts.

[18] Art. amended by R 17.9.2008; in force since 1.10.2008 - BU 2008, 554.

… [19]

Municipal supervisory authorities (Art. 31b DPA)

Municipal regulations and appointment [20]

[19] Art. repealed by R 17.9.2008; in force since 1.10.2008 – BU 2008, 554.

[20] Marginal note amended by R 17.9.2008; in force since 1.10.2008 – BU 2008, 554.

[21] 1 Municipalities may provide in their regulations for the establishment of a Municipal Data Protection Service, appointing a Municipal Data Protection Officer (hereinafter: Municipal Officer) every four years.

2 The Municipal Officer is responsible, within the municipal territory, for the competencies referred to in Art. 30 letters a), b), c), d), e), f) of the law.

3 The Municipal Officer performs their mission autonomously and independently. Adequate resources are allocated to them by the municipality.

4 The Municipal Officer collaborates, to the extent necessary for the performance of their duties, with the Cantonal Officer, in particular by exchanging with them all useful information.

[21] Art. modified by R 17.9.2008; in force since 1.10.2008 - BU 2008, 554.

[22] The Cantonal Commissioner provides a preliminary opinion to the Council of State on the approval of municipal regulations concerning the protection of personal data.

[22] Art. modified by R 17.9.2008; in force since 1.10.2008 - BU 2008, 554.

[23] The Municipality communicates to the Cantonal Commissioner the name of the person appointed as Municipal Commissioner.

[23] Art. modified by R 17.9.2008; in force from 1.10.2008 - BU 2008, 554.

[24] The Municipal Commissioner transmits to the Cantonal Commissioner a copy of the Municipal Register of Personal Data Archives and its relative updates.

[24] Art. modified by R 17.9.2008; in force since 1.10.2008 - BU 2008, 554.

Municipalities are required to amend, if necessary, their municipal regulations within two years from the entry into force of these regulations.

The Regulation on the Application of the Data Protection Act of July 5, 1990 is hereby repealed.

This Regulation shall be published in the Official Gazette of Laws and Executive Acts and shall enter into force on January 1, 2001.

Published in OG 2000, 386.