Personal Data Protection Act (LPrD) - Purpose (LPRD)

1. This law aims to protect individuals against the misuse of personal data concerning them.

1. The designation of functions applies equally to women and men.

1. This Act applies to all processing of data concerning natural or legal persons.

2. The following entities are subject to this Act

a. the Grand Council;

b. the Council of State and its administration;

c. the Judiciary and its administration;

cbis. the Court of Auditors;

d. the municipalities, as well as inter-municipal associations, federations, fractions, and agglomerations;

e. natural and legal persons to whom the canton or a municipality entrusts public tasks, in the execution of said tasks.

f. the Public Prosecutor's Office;

g. the Council of the Judiciary.

3. This Act does not apply to

a. deliberations of the Grand Council and the general and municipal councils;

b. civil, criminal, or administrative proceedings;

c. personal data processed in application of the Federal Intelligence Act.

1. For the purpose of this Law

1. Personal data means any information relating to an identified or identifiable person;

2. Sensitive data means any personal data relating to

- religious, philosophical, political, or trade union opinions or activities, as well as ethnic origin;

- the intimate sphere of the person, in particular their psychological, mental, or physical state;

- individual measures and aid arising from social legislation;

- criminal and administrative proceedings or sanctions.

3. Personality profile means an assemblage of data that allows for the assessment of the essential characteristics of a natural person's personality;

4. Data subject means any natural or legal person about whom data is processed;

5. Processing of personal data means any operation or set of operations, whether or not performed by automated means, and applied to personal data, including collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, as well as restriction, erasure, or destruction;

6. Communication means making data accessible, in particular by transmitting it, publishing it, authorising its consultation, or providing information;

7. File means any structured set of personal data accessible according to determined criteria, whether this set is centralised, decentralised, or distributed functionally or geographically;

8. Data controller means the natural or legal person, public authority, service, or any other body which, alone or jointly with others, determines the content and purposes of the file;

9. Data processor means the natural or legal person, public authority, or any other body which processes personal data on behalf of the data controller;

10. Call-up procedure means an automated mode of data communication by which recipients decide themselves on the communication of data, subject to authorisation by the data controller;

11. Recipient means a natural or legal person, whether private or public law, who receives data communication, whether or not it is a third party. However, authorities that may receive data communication within the framework of a particular investigation mission are not considered recipients;

12. Entities means the entities described in Article 3, paragraph 2 of this Law;

13. Law in the formal sense means laws in the formal sense adopted by the Grand Council or, at the communal level, regulations adopted by the general and communal councils;

14. Deterrent video surveillance means video surveillance used to prevent the commission of offences in a certain location.

1. Personal data may be processed only if

a. a legal basis authorizes it, or

b. their processing serves the performance of a public task.

2. Sensitive data may be processed only if

a. a law in the formal sense expressly provides for it,

b. the performance of a task clearly defined in a law in the formal sense absolutely requires it, or

c. the data subject has consented thereto or has made their data accessible to everyone.

1. Data shall only be processed for the purpose indicated at the time of their collection, as provided by law or for the performance of the relevant public task.

1. The processing of personal data must comply with the principle of proportionality.

1. The collection of personal data must be recognizable to the data subject.

1. Entities subject to this law shall ensure that the personal data processed is accurate.

1. The data controller shall take appropriate measures to ensure the security of files and personal data, particularly against their loss, destruction, and any unlawful processing.

1. Personal data must be destroyed or anonymized as soon as they are no longer necessary for the purpose for which they were collected.

2. Specific legal provisions remain reserved regarding the retention of data, particularly with respect to archiving, or conducted for historical, statistical, or scientific purposes.

1. When the processing of personal data requires the consent of the data subject, such consent is considered valid only if the data subject freely expresses their will after having been duly informed. In cases involving sensitive data and personality profiling, the consent must additionally be explicit.

1. The data controller shall inform the data subject of any collection of personal data concerning him or her.

2. The information provided to the data subject shall be as follows

a. the identity of the data controller;

b. the purpose of the processing for which the data are collected;

c. in cases where data communication is envisaged, the categories of data recipients;

d. the right to access the data;

e. the possibility of refusing to provide the requested data and the consequences of such refusal.

3. If the data are not collected from the data subject, the data controller must provide the data subject in writing with the information listed in the preceding paragraph, at the latest when the data are recorded, unless this proves impossible, requires disproportionate effort, or the recording or communication is expressly provided for by law.

1. The data controller may defer, restrict, or even refuse information, to the extent that

a. the law expressly provides for it;

b. a prevailing public or private interest so requires;

c. the information or communication of the data risks compromising a criminal investigation or another investigative procedure; or

d. the requested information cannot objectively be provided.

2. As soon as the reason justifying the restriction of the duty to inform ceases to exist, the data controller must provide the information, unless this is impossible or requires disproportionate efforts.

1. Personal data may be communicated by entities subject to this Act when

a. a legal provision within the meaning of Article 5 so provides;

b. the applicant establishes that they need it to perform their legal tasks;

c. the private applicant demonstrates a preponderant interest in the communication that outweighs the interest of the data subject in the data not being communicated;

d. the data subject has expressly given their consent or circumstances allow said consent to be presumed;

e. the data subject has made the personal data accessible to everyone and has not formally opposed their communication; or

f. the applicant makes it plausible that the data subject refuses their consent only with the aim of preventing the applicant from asserting legal claims or making other legitimate interests prevail; in this case, the data subject shall, as far as possible, be invited to comment before the data is communicated.

2. Paragraph 1 also applies to information transmitted upon request under the Information Act [B].

3. Authorities may spontaneously communicate personal data in the context of public information, under the Information Act [B], provided that the communication meets a public or private interest prevailing over that of the data subject.

1. Data may be made accessible through an appeal procedure between entities subject to the law under the conditions of Article 15. Sensitive data or personality profiles may only be made accessible through an appeal procedure if a formal law or regulation provides for it.

2. Data may only be made accessible to private individuals through an appeal procedure if a formal law or regulation provides for it. Sensitive data or personality profiles may only be made accessible if a formal law expressly provides for it.

1. Data processing may be entrusted to a third party under the following cumulative conditions

a. processing by a third party is provided for by law or by contract;

b. the data controller is legitimate to process the data concerned themselves;

c. no legal or contractual obligation of confidentiality prohibits it.

2. The third party is responsible for the security of the data it processes.

1. The Cantonal Data Protection and Information Officer (hereinafter: the Officer) maintains a register of files, which is public and accessible online.

2. The Council of State enacts the rules applicable to the maintenance of the register [C].

1. Entities subject to this law are required to immediately inform the Officer of any project aimed at creating a new file containing personal data.

2. The Council of State determines the information to be provided when announcing a file.

1. Files may become operational as soon as the Officer has been informed of their establishment.

1. The following do not need to be declared, if they do not contain sensitive data or constitute a personality profile

a. files containing exclusively publicly accessible information;

b. correspondence registration files;

c. address files;

d. ephemeral files whose lifespan does not exceed one year.

1. The entities referred to in Article 3, Paragraph 2 may install a deterrent video surveillance system, with or without a recording system, on public property or their assets allocated to the performance of a public task, subject to compliance with the principles and prescriptions of this law.

1bis. The purposes of a deterrent video surveillance system are to ensure the safety of persons and property, to prevent the commission of offenses in a certain place, and to contribute to the investigation and prosecution of offenses.

2. …

3. …

4. The installation of the video surveillance system must constitute the most appropriate means to achieve the intended goal. All measures must be taken to limit the impact on the persons concerned.

5. …

6. …

7. The Council of State specifies the aforementioned conditions.

1. Prior to its operation, the installation of a video surveillance system must be subject to an authorization request by the data controller. The same applies to any subsequent modification of the system.

2. The competent authority may seek the opinion of the Data Protection Officer before making a decision. The Data Protection Officer receives a copy of the decision.

3. If a system no longer meets the legal requirements, the authorization is revoked.

4. The Data Protection Officer publishes a list of authorized deterrent video surveillance installations.

5. The Council of State specifies the authorization procedure in a regulation.

1. When the request originates from a cantonal entity, the competent authority is the head of the department on which the concerned entity depends.

2. When the request originates from a communal entity, the competent authority is the district prefect.

3. When the request originates from a cantonal public law institution or a legal entity to which the canton has delegated public tasks, the competent authority is the supreme body of the institution.

1. The Agent has the standing to appeal a decision of authorization to the Cantonal Court.

2. The Data Controller has the standing to appeal a decision of authorization refusal to the Cantonal Court.

1. The data controller must visibly indicate the existence of the video surveillance system in the immediate vicinity of the latter.

2. This information includes the contact details of the data controller and mentions the right of access to the images concerned.

1. Unless an authority orders their preservation as part of a criminal procedure, the recorded images must be automatically destroyed after a period of seven days, or in the case of harm to persons or property, after a maximum of one hundred days.

1. The operation of a video surveillance system may be delegated to a third party under the conditions of Article 18.

2. The delegation is subject to an authorization decision in accordance with the procedure provided for in Articles 22a and 22b.

3. The data controller conducts regular checks to ensure that the legal conditions are met.

1. If the specific needs of an entity mentioned in Article 3, paragraph 2, letters a to c bis justify it, the competent authority may issue a principal authorization, known as a framework authorization, allowing the beneficiary entity to install and operate several video surveillance installations under the conditions defined by the framework authorization.

2. For each installation of a video surveillance system, the cantonal entity benefiting from a framework authorization shall inform the competent authority and the Supervisor.

3. The Council of State specifies the conditions for granting a framework authorization in a regulation.

1. The data controller shall take appropriate security measures to protect the data recorded or transferred over computer networks and to prevent any unlawful processing thereof. In particular, they shall limit access to the data and to the premises containing them.

2. They must install and maintain an automatic logging system to monitor access to the images.

1. Access to the images is limited to persons designated by the data controller, as well as those who can claim a right of access to their own data, as defined in Chapter VI.

2. The data controller defines the procedure to be followed for the technical operations of managing systems and computer data related to video surveillance.

3. For the purpose of obtaining evidence, the recorded images may be analyzed in cases of criminal complaints, criminal charges, or concrete indications of the commission of a criminally punishable act.

4. The data controller may only transmit the recorded images to the authorities responsible for prosecuting the criminal offense.

1. In addition to complying with the conditions set forth in the previous section, the installation of a video surveillance system on public property and assets allocated for the performance of a municipal or inter-municipal public task requires the adoption of a municipal or inter-municipal regulation.

2. The images recorded by the video surveillance system may only be used in accordance with the methods, conditions, and purposes established in the regulation that institutes it.

3. This regulation must not derogate from the minimum conditions established by law.

1. The installation of a video surveillance system within or in the immediate vicinity of a municipal or inter-municipal educational establishment requires, in addition to the authorization provided in Article 22a, the approval of the department responsible for education.

1. Correctional facilities may install a security video surveillance system.

2. The Council of State sets the conditions to be respected with regard to the operation of a security video surveillance system.

3. Furthermore, the provisions of the present chapter do not apply to video surveillance in correctional facilities.

1. Entities subject to this law are entitled to process personal data and communicate it for research, planning, or statistical purposes, under the following conditions

a. they are anonymized as soon as the purpose of their processing permits;

b. the recipient communicates the data to third parties only with the consent of the entity that transmitted it;

c. the results of the processing are published in a form that does not allow the identification of the data subjects.

2. Articles 5, 6, and 15 of this law are not applicable.

3. The Cantonal Statistics Act [D] is applicable for the remainder.

1. Every individual has, at all times, free access to data concerning themselves.

2. They may also request confirmation from the data controller that no data concerning them has been collected.

3. The person asserting their right must prove their identity.

4. No one can waive their right of access in advance.

1. A request for communication of personal data is not subject to any formal requirements. However, it must contain sufficient information to allow identification of the data concerned.

2. The communication of data takes place on-site or is made in writing, unless otherwise stipulated.

3. With the applicant's consent, the communication may also be made orally.

4. The communication of data is, as a general rule, free of charge.

5. The data controller responding to the request may levy a fee

a. when the communication requires significant work;

b. in the case of repetitive requests;

c. when a copy is requested.

6. The State Council sets the tariff of fees.

1. The data controller shall respond within thirty days from the date of receipt of the request by the concerned entity.

1. The data controller may restrict or even refuse consultation if

a. the law expressly provides for it;

b. a preponderant public or private interest so requires;

c. it is impossible or requires disproportionate efforts.

2. The right to access medical data is governed by the Public Health Act [E].

3. As soon as the reason justifying the restriction of the duty of access ceases to exist, the data controller must provide the information.

1. Every person has the right to object to the communication of personal data concerning them if they demonstrate a legitimate interest worthy of protection.

2. The data controller shall reject or lift the objection

a. if the communication is expressly provided for by a legal provision;

b. if the communication is indispensable for the performance of the recipient's public tasks and outweighs the interests of the data subject.

1. Persons with a legitimate interest may demand that the data controller

a. refrains from unlawful data processing;

b. remedies the effects of unlawful data processing;

c. declares the unlawfulness of data processing;

d. repairs the consequences of unlawful data processing.

2. Where appropriate, they may request the data controller to

a. rectify, destroy, or anonymize the data;

b. publish or communicate the decision or rectification to third parties.

3. If neither the accuracy nor the inaccuracy of data can be established, the data controller shall add a note to the data indicating its disputed nature.

1. For any request based on this law, particularly under Articles 25 to 29, the data controller shall issue a decision including the reasons for not taking action.

2. The data controller shall send a copy of this decision to the Data Protection Officer.

1. The interested party may appeal to the Official, or directly to the Cantonal Court.

2. Moreover, the Administrative Procedure Law [F] applies to decisions made under this law, as well as to appeals against such decisions.

1. As soon as the appeal is filed, the Officer shall notify the data controller.

2. The Officer attempts to mediate in order to bring the parties to an agreement. For this purpose, he has the means described in Article 38 of this law.

3. If the mediation is successful, the case is closed.

4. In the event of failure of mediation, the Officer issues a decision which he notifies to the data controller and the concerned party.

5. The data controller and the concerned party may appeal to the Cantonal Court within 30 days of the notification.

1. The procedure is free of charge.

2. A fee may be charged in the event of an abusive request.

3. …

1. The Officer is appointed by the Council of State for a period of 6 years.

2. The term is renewable.

1. The Officer exercises their activity independently.

2. The Council of State decides on their administrative attachment.

3. The Officer is bound by official secrecy.

1. The Supervisor oversees the application of the provisions relating to data protection.

2. To this end, they have the means provided for in Article 38 of this law.

3. If they deem that the provisions on data protection have been violated, the Supervisor issues a recommendation to the concerned entity, advising to modify or cease the relevant processing.

4. The concerned entity must respond in writing. If the Supervisor's recommendation is not followed, the Supervisor can bring the matter before the department or the concerned entity for a decision.

5. The Supervisor may appeal against the decision made pursuant to the previous paragraph, as well as against the decision made by the competent authority (Article 30). The Administrative Procedure Act [F] applies.

6. The audit reports prepared by the Supervisor under the preceding provisions are communicated to the President of the Council of State and the President of the Management Commission of the Grand Council.

1. In addition to the aforementioned oversight, the Commissioner

a. promotes data protection within the canton;

b. informs data controllers about the requirements for data protection;

c. advises data subjects on the rights arising from this Act;

d. is consulted during the drafting of any law, regulation, directive, or other standard involving the processing of personal data;

e. intervenes, at the request of data controllers or data subjects, to resolve issues subject to this Act, without prejudice to the appeal provided for in Articles 30 to 33 of this Act;

f. may be consulted on projects relating to the installation of video surveillance systems and has a right of appeal in this matter, in accordance with Articles 22 et seq. of this Act;

g. maintains the Register of Data Files established in Article 19 of this Act;

h. collaborates with other competent data protection authorities in other cantons, the Confederation, or abroad.

2. Furthermore, the Commissioner hears appeals provided for in Article 31 of this Act.

1. In the performance of his duties, the Commissioner may

a. access data undergoing processing and collect all information necessary for the performance of his duties;

b. issue an opinion prior to the implementation of a file;

c. request the data controller to restrict or immediately cease, temporarily or permanently, the processing of personal data, if the legitimate interests of the data subject so require.

1. The data controller is required to assist the Officer in the performance of his duties. To this end, he provides the necessary information or documents and allows him access to his premises.

2. Official secrecy cannot be invoked against the Officer.

3. Third parties are also obligated to provide the information requested by the Officer.

1. The Officer prepares an annual activity report.

2. This report is public. It provides information, among other things, on the recommendations provided for in Article 36, paragraph 3, addressed during the year and, where applicable, on the steps taken by the Officer in accordance with Article 36, paragraphs 4 and 5.

3. The Officer may prepare a special report at any time, either on their own initiative or at the request of the Grand Council or the Council of State.

1. Any person who has intentionally disclosed personal or sensitive data in an unlawful manner, which came to their knowledge in the performance of their duties, shall be liable to a fine.

2. The same penalty applies to a person who has intentionally disclosed personal or sensitive data in an unlawful manner, which came to their knowledge in the course of activities performed on behalf of persons bound by the obligation of confidentiality.

3. The obligation of discretion continues beyond the termination of employment relationships.

3bis. Anyone who installs a video surveillance system without having first obtained authorization or who operates a video surveillance system without complying with legal conditions shall be liable to a fine.

4. Federal criminal law is reserved.

1. All data processing must comply with this law, particularly regarding legality, within five years following its entry into force.

2. …

3. Any deterrent video surveillance system installed by cantonal entities, public law institutions, and legal entities entrusted by the canton with public tasks must comply with the provisions of Chapter IV of this law within one year following the entry into force of the law of June 5, 2018, amending the law of September 11, 2007, on personal data protection; however, the rules regarding the retention period of images are immediately applicable.

4. Any modification of a communal video surveillance system, authorized before the entry into force of the law of June 5, 2018, amending the law of September 11, 2007, on personal data protection, is subject to the authorization procedure provided for in Chapter IV of this law.

1. Applications for authorization submitted before the entry into force of the law of June 5, 2018, amending the present law, and for which an authorization decision has not yet been made, are subject to the procedure of Articles 22 and following of the Law of September 11, 2007, on the protection of personal data.

1. The Law of May 25, 1981, on Computer Files and the Protection of Personal Data is repealed.

1. The Council of State is entrusted with the execution of the present law. It shall publish the text in accordance with article 84, paragraph 1, letter a) of the Cantonal Constitution and shall determine, by decree, the date of its entry into force.