Implementing regulation of the Act of 11 September 2007 on Personal Data Protection (RLPrD) - Conservation and Disposal of Personal Data (as per Art. 11) (RLPRD)

1. The data controller anonymizes or destroys personal data that is no longer necessary for the purpose for which it was collected. The Cantonal Data Protection and Information Officer (hereinafter: the Officer) shall be informed. Exceptions are provided for by the Personal Data Protection Law [A] and the present regulation, as well as legislation related to archives.

2. The Officer is authorized to issue specific guidelines regarding the retention and disposal of data.

1. In the event of well-founded doubt, the controller shall consult the Commissioner before deciding on

a. the oral communication or listing of data to third parties outside the cantonal administration, in the absence of an express legal provision;

b. the creation of direct access to existing files, the handover of copies of all or part of a file, the connection between files, or any other analogous means of transmission, for the benefit of third parties belonging or not belonging to the cantonal administration.

1. The communication of data from files subject to Law [A] for a directory or another similar work of general interest is the subject of an agreement between its publisher or the user and the data controller, subject to any other legal provision.

1. The agreement must imperatively

a. enumerate the personal data transmitted;

b. determine the origin of the personal data transmitted;

c. instruct the publisher to grant the data subject access to the data concerning them and to indicate its origin;

d. fix the frequency at which the work must be published with the corrections and additions requested both by the data controller and by the concerned individuals;

e. specify the security measures incumbent upon the publisher;

f. provide for the right of control of the Commissioner;

g. fix the conditions for compensation to be paid by the publisher.

2. The agreement may furthermore

a. append other ancillary clauses to the transmission of personal data;

b. provide for a contractual penalty in the event that the publisher violates its obligations.

1. Data contained in a directory of addresses or another similar work of general interest may be made accessible by another medium, provided that the data and their classification criteria are the same as in the publication.

1. The Officer manages the registry of files in such a way that it can be supplemented as needed.

2. The Officer updates it periodically, at least once a year.

1. The file register is accessible on the Official's website and can also be consulted at their premises.

2. It is published in their activity report.

1. The Commissioner may issue directives concerning the maintenance of the register of files. This register must imperatively include the "file description" and the "transmission log," which shall notably mention the following

a. for the "file description": nature and purpose of the file, existence of sensitive data and/or personality profiles, origin of the data, co-processing, modalities of access to the file; the file description shall contain for each file additional information concerning the approximate number of data subjects and the foreseen time of data destruction or archiving;

b. for the "transmission log": third parties benefiting from the transmission, personal data transmitted, legal provision authorizing the transmission, decision, periodicity of the transmission, modalities of the transmission (access to the file). Specific arrangements may be agreed upon with services that carry out a large number of transmissions.

1. The municipal regulations concerning video surveillance specify, in particular, the following points

a. the purpose pursued by the installation;

b. the security rules and procedures regarding the retention of recorded images, including those extracted from the video surveillance system;

c. the person(s) authorized to manage the video surveillance;

d. the rules of access to images, including those extracted from the video surveillance system;

e. public information and its modalities;

f. the location and scope of the camera(s);

g. the retention period for images and the method of image destruction.

1. Information collected through a video surveillance system may only be used within the context of a judicial procedure.

1. When the response to the request requires work exceeding one hour, a fee of 40 francs per hour is charged beyond this duration, up to and including four hours. Beyond that, the fee amounts to 60 francs per additional hour. The requester is informed of the probable cost in advance.

2. In the case of a request on the same subject submitted more than three times per year by the same person, a fee of 60 francs per hour is charged.

3. A fee of 20 centimes per copy is charged from the 21st page for any copy of a file exceeding 20 pages.

1. The monitoring of data recorded on an IT basis is carried out by the Commissioner, with the support of the Cantonal IT Security Office (hereinafter: OSIC).

2. At the request of the Commissioner, the OSIC may notably

a. contribute to responding to requests for advice from services and entities subject to Law [A], for example during the development of IT projects;

b. assist them in obtaining the data necessary for maintaining the register of files;

c. assist them in controlling the effective security level of personal data and their transmission.

3. The Commissioner, after consulting the OSIC, may issue directives on the processing of data recorded on an IT basis (data security, etc.).

1. The Department of Finance and External Relations is responsible for the implementation of this regulation, which comes into force on November 1, 2008.