Act on Electronic Identification Means and the State's Secure Online Service Portal (LCyber) - Objective (LCyber)

1. This law establishes the conditions and procedure for the issuance of an electronic identification means by the State, as well as the conditions for the organization, operation, and use of the secure online services portal of the State (hereinafter: the secure portal).

1. For the purposes of this [article/law], the following definitions apply

a. **secure portal**: the overall secure electronic communication system that the State makes available to users to enable them to access online services;

b. **online services**: the services offered by the State to users through the secure portal;

c. **electronic identification means**: the electronic elements used for the identification and authentication of a natural person;

d. **personal identification data**: all data enabling the State to issue an electronic identification means, including surname and first name(s), date of birth, copy of identity document, home address, email address, AVS insurance number;

e. **user**: the natural person or entity with an enterprise identification number within the meaning of the Federal Act of 18 June 2010 on the enterprise identification number [A] (hereinafter: an entity with an EIN) that benefits from access to the secure portal;

f. **account data**: data relating to the access procedure for the secure portal, the creation and maintenance of the user's account, including, for a natural person user, their personal identification data and, for an entity user with an EIN, the enterprise identification number, its trade name or name, its domicile or registered office address, the AVS insurance number, date of birth and email address of the persons authorised to represent it;

g. **content data**: the data intrinsic to requests and communications, including decisions, transmitted between the user and the State via the secure portal;

h. **metadata**: data describing the formal characteristics of the content data transiting on the secure portal, including their author, title, recipient, date, and time.

1. The issuance of an electronic identification means by the State and access to the secure portal are free of charge.

2. A fee may be charged when access to the secure portal is gained using an electronic identification means other than the one issued by the State.

1. The department responsible for information systems (hereinafter: the department) [B] is the competent authority for executing the law, including

a. issuing, managing, and deactivating electronic identification means;

b. granting access to the secure portal to a user;

c. exercising supervision over the secure portal;

d. ensuring the administrative organization of the secure portal;

e. developing and maintaining the technical infrastructure of the secure portal;

f. ensuring the security of the secure portal;

g. stipulating the conditions of use for the secure portal;

h. designating authorized persons to access user data in accordance with Article 13, paragraphs 2 and 3 of this law;

i. making any decision in application of this law.

2. The department may entrust the execution of its tasks to the service responsible for information systems (hereinafter: the service) [B].

3. The Council of State may provide for other cantonal services and authorities to contribute to the realization of the procedure for issuing electronic identification means and accessing the secure portal.

1. To carry out the tasks entrusted to them by this Law, the competent authorities within the meaning of Article 4 are authorized to systematically use the OASI beneficiary number

a. of persons applying for the issuance by the State of an electronic identification means;

b. of holders of an electronic identification means issued by the State;

c. of users.

1. In order to allow for identity and representation power verifications necessary for the execution of this law, as well as continuous security control of exchanges via the secure portal, the competent authorities within the meaning of Article 4 may access

a. data contained in the cantonal register of persons, with the exception of those relating to detention in a penitentiary establishment and membership of a religious community;

b. data contained in the cantonal register of companies.

2. The data referred to in paragraph 1 shall be made accessible to them via a retrieval procedure.

3. The Council of State may authorize access to other registers or databases if this proves necessary for the execution of this law.

1. At the beginning of the procedure, the competent authorities within the meaning of Article 4 raise awareness among anyone requesting an electronic identification means or asking to be a user of the secure portal about good practices in terms of IT security and personal data protection.

1. The Council of State determines the personal conditions to be met and the procedure to be followed to obtain an electronic identification means issued by the State.

2. It may recognize electronic identification means issued by other public or licensed providers.

3. The refusal to issue an electronic identification means by the State or its deactivation is subject to a decision.

1. The holder of an electronic identification means issued by the State must keep it strictly confidential.

2. He shall take the necessary and reasonable measures in view of the circumstances to prevent its misuse. These obligations are reiterated to him upon issuance of an electronic identification means.

3. In the event of misuse of an electronic identification means issued by the State, or if there is reason to fear such misuse, the competent authorities within the meaning of Article 4 may deactivate it without prior request from the holder. In such a case, the competent authorities shall inform the holder.

1. The use of the secure portal to access a State service is optional, unless otherwise stipulated by the Council of State.

1. The holder of an electronic identification means and the entity possessing an EID, through authorized individuals empowered to commit it and holders of an electronic identification means, may request to become a user of the secure portal.

2. The Council of State determines the procedure and conditions for access to the secure portal.

3. If a user violates the terms of use of the secure portal, their access may be restricted, suspended, or revoked.

4. The refusal, restriction, suspension, or revocation of access to the secure portal is subject to a decision.

1. The competent authorities within the meaning of Article 4 are authorized to process

a. personal identification data;

b. account data as well as content data and metadata related to the management of user access to the secure portal;

c. data relating to a procedure for refusing or deactivating the electronic identification means issued by the State, or relating to a procedure for limiting, suspending, or revoking access to the secure portal;

2. They shall limit the processing of the data referred to in paragraph 1 to what is strictly necessary for the performance of the tasks assigned to them by law.

3. The data referred to in paragraph 1 shall be destroyed five years after the deactivation of the electronic identification means issued by the State or the refusal to issue it, respectively five years after the user's access has ended.

1. The user has access to account data, content data, and metadata concerning them during their retention period.

2. Persons authorized under Article 4, paragraph 1, letter h may access the user's account data and metadata as part of their function.

3. The user may authorize access to the content data concerning them to persons authorized under Article 4, paragraph 1, letter h, especially when guidance is needed for using the secure portal or when reporting a malfunction or content anomaly to the department. Express consent is required.

1. User account data are retained on the secure portal until the end of the user's access.

2. Content data exchanged between the user and the State, along with the related metadata, are retained on the secure portal during the processing of the online service request by the relevant authority and for eighteen months after the closure of the procedure, but no later than the end of the user's access. Content data and metadata related to decisions are retained on the secure portal for eighteen months after their notification, but no later than the end of the user's access.

3. The data mentioned in paragraphs 1 and 2 are destroyed on the portal upon the expiration of their respective retention periods.

4. The relevant authority, as referred to in paragraph 2, decides on requests for the communication of content data and the related metadata.

1. The State is not liable for damages caused by the inability to use an electronic identification means it has issued or to access and use the secure portal.

2. Furthermore, the law of May 16, 1961, on the liability of the State, municipalities, and their agents (LRECA) [C] applies.

1. The user bears all risks resulting from the use of their electronic identification method by a third party.

2. The user is solely responsible for the protection and proper functioning of their computer system.

1. The Council of State enacts the implementing provisions of this law.

1. The Council of State shall submit to the Grand Council an evaluation report regarding the implementation of this law within five years following its entry into force.

2. This report shall be accompanied by a draft decree introducing measures if the objectives of the law, as defined in the statement of reasons, are not achieved.

1. The personal conditions that individuals must meet to obtain an electronic identification method issued by the State, and those to become users of the secure portal, will be identical for the three years following the entry into force of this law.

1. The Council of State is entrusted with the execution of the present law. It shall publish the text in accordance with article 84, paragraph 1, letter a) of the Cantonal Constitution and shall determine, by decree, the date of its entry into force.