Act on the Protection of Personal Data (Cantonal Data Protection Act, KDSG) - Purpose (KDSG)

1. This Act aims to protect the personal integrity and fundamental rights of natural persons whose personal data is processed.

1. This law applies to any processing of personal data of natural persons by the authorities of the canton, municipalities, as well as public-law corporations and institutions.

2. It is not applicable if personal data are already archived in the state archive or other competent public archives for legal, historical, or scientific reasons, or are to be archived according to Article 15, and their processing due to their age can no longer violate the worthy interests of individuals.

3. If an authority participates in economic competition without acting in a sovereign capacity, the rules of federal law for data processing by private individuals apply mutatis mutandis. The provisions regarding the supervisory authority remain reserved.

4. The rights and claims of affected persons during pending civil and criminal proceedings, as well as during constitutional and administrative legal proceedings, with the exception of first-instance administrative proceedings, are governed exclusively by the respective applicable procedural law.

5. Deviating and supplementary provisions remain reserved, provided they ensure protection against unlawful processing of personal data within the meaning of this law.

1. The following terms mean

a) Personal data: all information relating to an identified or identifiable natural person

b) Particularly sensitive personal data

1. Data regarding religious, ideological, political or trade union views or activities

2. Data concerning health, intimate sphere, or affiliation with a race or ethnicity

3. Genetic data

4. Biometric data uniquely identifying a natural person

5. Data concerning administrative and criminal prosecutions or sanctions

6. Data related to social assistance measures

c) Data collection: any set of personal data organized in such a manner that the data is retrievable by the individuals concerned

d) Processing: any handling of personal data, regardless of the means and procedures used, particularly obtaining, storing, retaining, using, modifying, disclosing, archiving, deleting, or destroying data

e) Profiling: any type of automated processing of personal data consisting of using such data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning the natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or relocation

f) Breach of data security: a security breach resulting in the accidental or unlawful loss, deletion, destruction, alteration, or unauthorized disclosure or access to personal data

g) Authorities: all bodies and offices of the canton, municipalities, public-law institutions and entities as well as commissions and private persons entrusted with the fulfillment of public duties

h) Responsible authority: authority that, alone or jointly with others, determines the purpose and means of processing

i) Data processor: private person or authority processing personal data on behalf of the responsible authority

1. Personal data may only be processed if

a) there is a legal basis for doing so, or

b) the processing is necessary for the fulfillment of a legal duty.

2. For the processing of specially protected personal data or for profiling, a basis in a formal legal statute is required, unless the processing is indispensable for a task specified in a formal legal statute.

3. The authorities must ensure that personal data is accurate and, as required by the purpose of processing, complete and up-to-date.

4. Personal data may only be processed lawfully, proportionately, and in good faith. It may not be processed for a purpose that is incompatible with the purpose of the original collection.

1. The processing of personal data may be contractually or legislatively transferred to a data processor if

a) the data is processed in the manner that the responsible authority itself would be permitted to do, and

b) no statutory or contractual confidentiality obligation prohibits the transfer.

2. The responsible authority must, in particular, ascertain that the data processor is capable of ensuring data security.

3. The data processor may only transfer the processing to a third party with prior approval from the responsible authority.

4. The data processor can assert the same justification grounds as the responsible authority.

1. In systematic data collections, particularly through questionnaires, the authority shall disclose the purpose and legal basis for the processing.

**1. The responsible authority shall conduct a data protection impact assessment in advance if a processing operation could entail a high risk to the personality or fundamental rights of the data subject. If multiple similar processing operations are planned, a joint assessment may be conducted.**

**2. The high risk arises, particularly with the use of new technologies, from the nature, scope, context, and purpose of the processing. It is specifically identified:**

a) in the extensive processing of particularly sensitive personal data

b) when systematically monitoring extensive public areas

**3. The data protection impact assessment shall include a description of the planned processing, an evaluation of the risks to the personality or fundamental rights of the data subject, as well as measures to protect the personality and the fundamental rights.**

1. If the data protection impact assessment reveals that the proposed processing still poses a high risk to the personality or fundamental rights of the affected person despite the measures envisaged by the responsible authority, it shall first obtain the opinion of the data protection officer.

2. The data protection officer shall inform the responsible authority of their objections to the proposed processing within two months. This period may be extended by one month if it concerns a complex data processing operation.

3. If the data protection officer raises objections to the proposed processing, they shall propose appropriate measures to the responsible authority.

1. Personal data may only be disclosed if

a) there is a legal basis for this according to Article 4, paragraphs 1 and 2;

b) the disclosure of the data is necessary for the recipient to fulfill a legal duty;

c) the person concerned has expressly consented to the disclosure, or, if they are unable to do so, the disclosure is in the interest of the person concerned and their consent can be assumed;

d) the disclosure is necessary to protect the life or physical integrity of the person concerned or a third party, and it is not possible to obtain the consent of the person concerned within a reasonable time;

e) the person concerned has made their data generally accessible and has not expressly prohibited its disclosure; or

f) the recipient credibly demonstrates that the person concerned refuses consent or objects to the disclosure to prevent him or her from enforcing legal claims or exercising other legitimate interests; the person concerned must be given an opportunity to comment in advance, unless this is impossible or involves disproportionate effort.

2. Personal data contained in publicly accessible official or officially approved publications may only be disclosed to the extent and in accordance with the order they are published.

3. The responsible authority shall deny disclosure, restrict it, or attach conditions if

a) essential public interests or obviously legitimate interests of the person concerned require it; or

b) statutory confidentiality obligations or special data protection provisions require it.

1. Personal data may be disclosed to countries of the European Union and to contracting states of Convention 108 of the Council of Europe for the Protection of Individuals with regard to Automatic Processing of Personal Data, provided that the conditions are met that must be satisfied for the disclosure of data domestically.

2. Personal data may only be disclosed to third countries if, in addition to the conditions set out in paragraph 1, one of the conditions of Article 16 of the Federal Act on Data Protection (SR [235.1](https://db.clex.ch/link/Bund/235.1/en)) is fulfilled.

3. Notwithstanding paragraphs 1 and 2, personal data may be disclosed abroad if

| | | | |

| --- | --- | --- | --- |

| a) | the disclosure is necessary: | | |

| | | | |

| --- | --- | --- | --- |

| | 1. | for the protection of an overriding public interest | |

| | | | |

| --- | --- | --- | --- |

| | 2. | for the establishment, exercise, or enforcement of legal claims before a court or another competent foreign authority | |

| | | | |

| --- | --- | --- | --- |

| | 3. | to protect the life or physical integrity of the data subject or a third party, and it is not possible to obtain the consent of the data subject within a reasonable period | |

| | | | |

| --- | --- | --- | --- |

| b) | the data subject has made the data publicly accessible and has not explicitly prohibited processing | | |

| | | | |

| --- | --- | --- | --- |

| c) | the data comes from a legally provided register that is public or accessible to persons with a legitimate interest, provided in each case that the legal conditions for inspection are met | | |

4. If personal data is made accessible to the public through automated information and communication services, this is not considered a disclosure abroad, even if the data can be accessed from abroad.

1. Personal Data may be processed for non-personal purposes, particularly for research, planning, or statistics, if

a) the data is anonymized as soon as the purpose of processing permits,

b) the responsible authority discloses sensitive personal data to private individuals only in such a way that the affected individuals cannot be identified,

c) the recipient discloses the data to third parties only with the consent of the responsible authority that initially disclosed the data, and

d) the results are published only in such a way that the affected individuals cannot be identified.

1. The responsible authority and the data processor shall ensure data security appropriate to the risk through suitable technical and organizational measures.

2. The measures must enable the avoidance of data security breaches.

1. The responsible authority shall report a data security breach to the designated Data Protection Officer as soon as possible, which is likely to result in a high risk to the personal rights or fundamental rights of the affected individual.

2. The processor shall report a data security breach to the responsible authority as soon as possible.

3. The responsible authority shall inform the affected individual if it is necessary for their protection or if the designated Data Protection Officer requests it. At a minimum, it shall specify the nature of the data security breach, its consequences, and the measures taken or envisaged.

4. The responsible authority may restrict, delay, or forgo informing the affected individual if

a) private or public confidentiality interests prevail,

b) the notification is impossible or requires a disproportionate effort, or

c) the information to the affected individual is ensured in a comparable manner through a public announcement.

5. A report made pursuant to this article may only be used in criminal proceedings against the reporting party with their consent.

1. The canton, municipalities, as well as public law corporations and institutions, maintain a public register of their data collections.

2. The register contains for each data collection information regarding the legal basis, purpose, and means of processing, the type and origin of the processed personal data, as well as the entities involved in the data collection and the regular data recipients.

1. If data collections and personal data are no longer constantly needed, the responsible authority must determine the possibility of archiving with the relevant public archives.

2. Personal data not designated as worthy of archiving shall be destroyed, unless they

a) are anonymized, or

b) need to be retained for evidential or security purposes or to protect the legitimate interests of the person concerned.

3. The government council shall regulate the procedure for archiving and the use of the state archive in a regulation.

**1. Every person has the right to inspect the registers of data collections.**

1. Every person can request information from the responsible authority as to whether personal data concerning them is being processed.

2. The affected person receives the information necessary to assert their rights under this law and to ensure transparent data processing.

3. If the responsible authority has personal data processed by a processor, it remains obligated to provide information.

4. No one can waive their right to information in advance.

1. The information may be restricted or refused if significant public or legitimate private interests necessitate this.

2. If the information cannot be granted to the requesting person because it would be too burdensome, it may be provided to a person of their trust.

1. Any individual may request the responsible authority to correct or complete inaccurate personal data concerning themselves.

2. If the responsible authority disputes the inaccuracy, it must prove the accuracy of the personal data.

3. If neither the accuracy nor the inaccuracy of the personal data can be proven, particularly for data containing an assessment of human behavior, the affected person may request the inclusion of a counter-statement.

1. Any person may request from the responsible authority regarding their own data that

a) unlawful processing of personal data be ceased

b) the consequences of unlawful processing be rectified

c) the unlawfulness of processing be confirmed in writing

1. The restriction or denial of the right to access, rectification, or cessation must be communicated to the requesting person in the form of an appealable decision.

2. The procedure is governed by the provisions of the Ordinance on Administrative Justice (RB 2.2345).

1. Inspection, Information, and Correction are generally free of charge.

2. Exceptionally, a fee may be charged if the handling of an information request requires significant administrative effort or if the data subject repeatedly inspects or requests information about the same data.

1. The district council elects, upon request of the government council, the appointed person for data protection as well as a deputy. The term of office is four years.

2. The appointed person for data protection performs their duties independently, impartially, and without any binding professional instructions.

3. A public office, secondary employment, or any possible additional professional activity requires the approval of the government council. Approval is granted if the activity does not impair the performance of duties, independence, and reputation.

4. The appointed person for data protection operates under the supervision of the district council, requests from it the financial resources necessary to fulfill their duties, has control over these resources, and is responsible, within the approved budget, for employing staff and regulating their employment conditions. Administratively, they are assigned to the relevant directorate.

5. The district council may relieve the appointed person for data protection of their duties before the end of the term of office if they

a) have severely breached official duties willfully or through gross negligence, or

b) have permanently lost the ability to exercise the office.

6. With the approval of the district council, the government council may delegate the tasks of the appointed person for data protection to a suitable person or office of another canton or establish a joint body with other cantons for these tasks.

**1. The Appointed Data Protection Officer is the Cantonal Oversight Body for Data Protection.**

2. The Officer

a) monitors the application of data protection regulations

b) advises authorities on the application of data protection regulations

c) comments on draft legislations and measures that are of significant importance to data protection

d) mediates between authorities and between authorities and private individuals

e) follows developments that are significant for the protection of personal data

f) raises awareness among data-processing authorities of their data protection obligations and among the public about data protection concerns

3. The Appointed Data Protection Officer fulfills these tasks by, in particular

a) conducting inspections at authorities subject to this law

b) reviewing planned data processing systems that pose particular risks to the rights and freedoms of affected individuals prior to their commissioning

c) addressing inquiries and submissions made by affected individuals regarding their privacy rights and, if necessary, issuing recommendations or orders to the responsible authorities

d) collaborating with oversight bodies in other cantons, the federal government, and abroad

e) regularly reporting to the Landrat on their activities. They may publish important findings and measures in the field of data protection

4. Personal data processing related to ongoing civil and criminal proceedings as well as during constitutional and administrative proceedings, with the exception of first-instance administrative proceedings, does not fall under the supervision of the Appointed Data Protection Officer.

1. The appointed Data Protection Officer acts ex officio or upon notification.

2. The Officer investigates the facts ex officio and is entitled to obtain information from the responsible authorities and processors, regardless of any duty of confidentiality, request records and documents, and have data processing demonstrated. The responsible authorities and processors are obliged to cooperate.

3. If the Data Protection Officer identifies a violation of data protection regulations, they attempt to find an amicable solution with the responsible authority or the processor.

4. In the event of disagreement, the Data Protection Officer may issue a ruling against the responsible authority or the processor.

5. Rulings by the Data Protection Officer can be directly challenged by filing an administrative appeal with the Higher Court.

1. The designated person for data protection, their deputy, and their assistants are bound by the same confidentiality obligations concerning information and personal data acquired in the course of their duties as the responsible authority.

1. The Government Council may issue implementing provisions for this law.

1. A fine will be imposed on anyone who

a) intentionally provides false information to the designated data protection officer during the investigation of the facts or refuses to cooperate

b) processes personal data as defined in Article 11 and disregards the conditions of this provision

c) processes personal data on behalf of an authority and uses or discloses the data in violation of the mandate

2. The procedure follows the provisions of criminal justice.

1. The Act of 20 February 1994 on the Protection of Personal Data (Data Protection Act; DPA) is repealed.

1. The lawfulness of existing data processing shall be assessed according to the old law for no longer than two years after the entry into force of this Act, provided that the purpose of processing remains unchanged and no new data is acquired.

2. The person commissioned with data protection shall be elected for the first time under the new law at the beginning of the next legislative period.

1. This law is subject to a referendum. It shall enter into force on November 11, 2023.