Implementing regulation of the Act of 6 November 2018 on Electronic Identification Means and the State's Secure Online Services Portal (RLCyber) - Purpose (RLCyber)

1. The purpose of this regulation is to implement the law of November 6, 2018, on electronic identification means and the secure portal for online state services (hereinafter LCyber) [A].

1. The department responsible for information systems (hereinafter: the department) [B] executes this regulation. It may delegate its competencies and tasks to the service responsible for information systems (hereinafter: the service) [B].

2. Any public or concession entity designated by decision of the Council of State contributes to the implementation of the procedure for issuing the electronic identification means issued by the State (hereinafter: EIM) and access to the secure portal.

3. The department establishes guidelines concerning the minimum requirements for security, training, and personal data protection applicable to the procedure for issuing an EIM and access to the secure portal.

1. The Council of State recognizes by decision the electronic identification means issued by other public or concessioned providers.

2. This decision lists the public or concessioned providers of recognized electronic identification means.

1. Any person aged 15 or over may obtain an EID if they

a. hold an OASI number;

b. have a personal email address; and

c. have a means of identification within the meaning of Art. 2a or a personal mobile phone number.

1. The application for an MIE is initiated with the service upon the first connection to the secure portal via an identification method as defined by Art. 2a or an electronic form.

2. Once the application is initiated, the applicant receives a request to validate the application from the service. During this validation, the applicant provides, based on the required data for the identification method used, their social security number, date of birth, personal email address, and personal mobile phone number.

3. Upon receipt of the application via an electronic form, the department issues a personal and secret code to the email address provided by the applicant, valid for 90 days.

4. The application also serves as a request for personal access to the secure portal.

1. Once the personal and secret code has been obtained, the applicant shall personally appear before an authority designated in Article 2, paragraph 2, or before the department for identification. The department may also offer the possibility of identification by video, without the need for an in-person visit.

2. The applicant shall present their personal and secret code and,

a. for Swiss nationals, a valid Swiss identity document within the meaning of the Federal Act of 22 June 2001 on Identity Documents for Swiss Nationals (IDDA; SR 143.1); or

b. for foreign nationals, a valid and recognised legitimacy document within the meaning of Article 13, paragraph 1, of the Federal Act of 16 December 2005 on Foreign Nationals and Integration (FNIA; SR 142.20) [C] or a valid residence permit issued by a Swiss foreign police authority.

3. If identification is established, the department shall issue an MIE.

4. The consent of the legal representative is required for persons who do not have the capacity to exercise civil rights.

5. The service shall regulate the procedures for verifying the consent of the legal representative in the terms of use.

1. The identification of a natural person is valid for 5 years.

2. Before the expiration of this period, the department invites the holder of an MIE to request its renewal. The identification procedure of Article 5 applies by analogy to the renewal of the identification of the holder of an MIE.

1. The holder of an MIE may request its deactivation at any time. They submit their request to the department electronically or appear in person at a prefecture, with one of the documents mentioned in Article 5, paragraph 2, letter a or b.

2. Upon the expiration of the identification's validity period, the MIE is temporarily blocked for 6 months, and if the holder's identification is not renewed within this period, it is deactivated.

3. The MIE is deactivated upon the death of the holder.

4. Decisions of the department based on Article 8, paragraph 3, LCyber [A] are reserved.

5. The deactivation of the MIE results in the termination of all the holder's access to the secure portal.

1. The holder of an MIE gains access to the secure portal immediately upon issuance of this MIE, without any additional request.

2. The entity possessing a business identification number (hereinafter: BIN) within the meaning of the Federal Act of June 18, 2010, on the Business Identification Number (BIN Act; SR 431.03) [D], which wishes to access the secure portal, submits an electronic application via an electronic form. This entity acts through an individual holder of an MIE who has the authority to request access to the secure portal and manage said access (hereinafter referred to as the representative).

1. The representative indicates the business identification number of the entity possessing a Foreign Direct Investment (FDI) that he represents, as well as the basis of his powers of representation. The department defines the documents that can attest to the representative's powers of representation.

2. The representative must also have his powers of representation validated by the competent authorities as defined in Article 2.

3. Once the powers of representation are validated, the department issues, via postal mail, a personal and confidential code, valid for 90 days, to the address of the entity possessing an FDI. The representative of the entity possessing an FDI finalizes the application by entering this personal and confidential code on the secure portal.

4. If the access conditions are fulfilled, the department grants access to the secure portal to the entity possessing an FDI. The representative is associated with the entity possessing an FDI.

1. User authentication is necessary to access the secure portal. It is required each time the secure portal is accessed.

2. Authentication takes place using the MIE.

1. Any natural person holding an MIE and any entity possessing an IDE with access to the secure portal has a user account.

2. If the holder of the MIE has access to multiple user accounts, they must specify which account they wish to access at each login. The authentication performed during a login to the secure portal allows access to only one account at a time.

3. After 30 months without logging into the secure portal, the user is notified that their account will be deactivated within 6 months. If there is no new login by the holder within this period, the account is deactivated.

1. The department establishes the terms of use for the secure portal. It can modify them at any time. The modification takes effect immediately upon its publication on the secure portal.

2. Upon first access, the user is informed of the rights and obligations related to the use of the secure portal, as derived from the applicable legislation and the current terms of use.

1. The referrer is responsible for managing access to the secure portal of the entity holding an IDE.

2. It is incumbent upon them to define the roles of any MIE holders who must have access to the user account and the data of the entity holding an IDE, and in particular to

a. designate and revoke persons authorized to act on behalf of the entity holding an IDE, defining for each the online services to which they have access;

b. designate and revoke the representatives of the entity holding an IDE and define their powers of representation, specifying for each the online services to which they have access;

c. delegate the tasks mentioned in letters a and b.

3. The roles defined on the secure portal are limited solely to actions performed thereon.

4. The creation of roles on the secure portal does not equate to a confirmation of the validity of the representation relationships concerned.

1. The entity possessing an EID may at any time request a change of representative. It submits its request to the department electronically. The department defines the documents required to attest to the representative's authority.

2. The entity possessing an EID specifies in its request whether the previously registered representative should retain access to the EID entity's account.

3. The department proceeds with the change of representative once the authority is validated by the competent authorities in accordance with Article 2.

1. The user may electronically authorize one or more other users to represent them and access online services of the secured portal in their name and on their behalf.

2. The principal determines the scope of the representation powers and, in particular, the online services and data to which they grant the representative access, as well as the recipient of electronic communications.

3. They may modify or revoke these authorizations at any time.

4. Each concerned authority defines, for the online services it offers, whether it permits online representation, within the technical framework provided by the service.

1. The user is required to keep their account data, contact email address, the list of authorized representatives, and the scope of each representative's authority up to date on the secure portal.

2. The same obligation applies to the reference regarding the account data related to the entity with an IDE, its contact email address, and the roles assigned to authorized persons and representatives in accordance with Article 13.

3. The reference is also required to report the removal of the entity with an IDE from the IDE register.

1. The user may at any time waive their access to the secure portal. They shall submit their waiver to the department electronically or personally visit a prefecture with one of the documents mentioned in Article 5, paragraph 2, letter a or b.

2. The user's access terminates upon their death.

3. The termination of access for a physical person user results in the deactivation of the user's MIE.

1. The representative of the entity holding an IDE can announce at any time that the entity is waiving its access. They must submit a waiver to the department, either electronically or in person at a prefecture, carrying one of the documents mentioned in Article 5, paragraph 2, letter a or b.

2. When the representative's access ends, the department informs the entity holding an IDE and requests the designation of a new representative. It grants a deadline for the appointment of a new representative. If the IDE entity does not appoint a new representative within this period, the department revokes the entity's IDE access.

3. The user's access ends at the time of announcement of the deregistration of the entity holding an IDE from the IDE register by the representative, or, in the absence of such an announcement, after three years of account inactivity.

1. If the termination of access occurs during a procedure, the competent authority shall continue the procedure without using the secure portal, by non-electronic means. Special regulations are reserved.

1. The department informs the holder of a MIE and the user about the personal data collected at the time of the application for obtaining a MIE as well as upon the user's first login to the portal.

1. Persons authorized under Article 4, paragraph 1, letter h of the Cyber Law to access account data, metadata, and user content data on the secure portal are subject to a confidentiality obligation regarding access to user data.

2. Any access to a user's data is recorded by the service for a duration of 18 months (access history).

3. In the event of a user's request to review the access history to their data, the department provides them with this history without disclosing the identity of the persons authorized under Article 4, paragraph 1, letter h of the Cyber Law [A] who accessed the data.

**1. After consultation with the Cantonal Data Protection Officer, the department may authorize the processing of personal data by the service if it appears indispensable for conducting a pilot test or preparing an application during the process of adopting or adapting the necessary legal basis for such processing.**

**2. The service shall submit an evaluation report to the department no later than two years after the implementation of the trial phase. In this report, the service shall propose either the continuation or the termination of the processing.**

1. MIEs issued by the service to the representatives of the municipalities before the entry into force of the LCyber [A] are recognized as having been validly issued, subject to compliance by their holder with the personal conditions of Article 3.

2. The consent of the legal representative is necessary for individuals who do not have the exercise of civil rights at the time of the entry into force of this regulation.

3. The identification of their holder must be renewed within a period of 5 years from the issuance of the MIE. The procedure of Articles 5 and 6 applies by analogy.

1. The department is responsible for the enforcement of this regulation which comes into effect on December 1, 2020.