Act on the Protection of Personal Data under the Application of the Schengen Acquis in Criminal Matters (LPrDS) - Scope of Application (LPRDS)

1. This law concerns the protection of natural persons with regard to the processing of personal data for the purposes of preventing and detecting criminal offenses, investigations and prosecutions in such matters, or enforcing criminal penalties in the context of the application of the Schengen acquis and in the context of the implementation of international agreements concluded with the European Union or with states bound to Switzerland by one of the Schengen association agreements (Schengen States).

2. This law does not apply to the rights of the persons concerned in the context of ongoing proceedings before federal or cantonal courts or in the context of ongoing proceedings governed by the Code of Criminal Procedure [A] or by the International Mutual Assistance in Criminal Matters Act of March 20, 1981 [B], nor in the context of protection against threats to public security and the prevention of such threats; these are governed by the applicable procedural law.

1. Genetic data refers to information relating to an individual's genetic makeup obtained through genetic analysis, including the DNA profile.

2. Biometric data refers to personal data resulting from a specific technical processing and relating to the physical, physiological, or behavioral characteristics of a natural person, enabling or confirming their unique identification.

3. Profiling refers to any form of automated processing of personal data involving the use of such data to evaluate certain personal aspects relating to a natural person, especially to analyze or predict elements concerning that person's economic situation, health, personal preferences, interests, behavior, location, or movements.

4. Automated individual decision-making refers to any decision taken solely based on automated processing of personal data, including profiling, that produces legal effects concerning the individual or significantly affects them.

5. Genetic or biometric data are considered sensitive data under the law of September 11, 2007, on the protection of personal data [LPrD].

6. The Commissioner, as defined in this law, is the one established by the LPrD [C].

7. A data security breach refers to any breach of security, regardless of whether it is intentional or unlawful, leading to the loss, alteration, deletion, destruction, or unauthorized disclosure or access to personal data. The breach may be caused by a third party, but it can also occur when an employee exceeds their authority or acts negligently. A data security breach may result in the individual losing control over their data or in the misuse of such data. It can also lead to a violation of privacy, for example, by disclosing information the individual intended to keep confidential.

1. The data controller shall inform the data subject of any automated individual decision made concerning them, prior to making such a decision; the decision shall be identified as such.

2. If the data subject so requests, the data controller shall provide them with the opportunity to express their point of view. The data subject may require that the procedure applied be communicated to them and that the decision be reviewed by a natural person.

3. Paragraph 2 of this article does not apply when the data subject has a legal remedy against the decision.

1. Data controllers are required to implement, from the design phase of the processing, technical and organizational measures to ensure that the processing complies with data protection requirements and, in particular, the principles set by this law.

2. The technical and organizational measures must be appropriate in light of, in particular, the state of the art, the type of processing, its scope, as well as the risk that the processing of the data in question poses to the fundamental rights of the data subjects.

3. Data controllers are required, through appropriate default settings, to ensure that the processing is limited to the minimum necessary for the intended purpose.

1. A formal legal basis is required to establish a processing method likely to infringe fundamental rights or a profiling operation.

2. A formal legal basis is not required if

a. there is a need to protect the life or physical integrity of the data subject or a third party, or

b. the data subject has made their personal data publicly accessible, or

c. the data subject has not expressly objected to the processing.

1. Controllers shall maintain a record of processing activities.

2. The records of controllers shall contain at least the following information

a. the name of the controller;

b. the purpose of the processing;

c. a description of the categories of data subjects and the categories of personal data processed;

d. the categories of recipients;

e. the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;

f. where possible, a general description of the measures taken to ensure data security;

g. the third country or international organisation to which personal data are communicated, as well as the safeguards for the protection of personal data provided.

1. Where the envisaged processing is likely to result in a high risk to the fundamental rights of the data subject, the data controller shall, prior to the processing, carry out a data protection impact assessment. If the controller intends to carry out several similar processing operations, they may establish a common impact assessment.

2. The existence of a high risk depends, in particular when using new technologies, on the nature, scope, circumstances, and purposes of the processing. Such a risk exists in particular in the following cases

a. large-scale processing of sensitive data or personality profiles;

b. profiling.

3. The impact assessment shall contain a description of the envisaged processing, an assessment of the risks to the fundamental rights of the data subject, as well as the measures planned to protect these rights.

1. The data controller consults the Commissioner prior to processing when the data protection impact assessment indicates that the processing would pose a high risk to the fundamental rights of the data subject if the data controller does not take measures to mitigate this risk.

2. The Commissioner communicates their objections regarding the proposed processing to the data controller within two months. This period may be extended by one month in the case of complex data processing.

3. If the Commissioner has objections concerning the proposed processing, they suggest appropriate measures to the data controller.

1. The data controller shall notify the FDPIC without undue delay of any data security breaches that are likely to result in a high risk to the fundamental rights of the data subject.

2. The notification must at least indicate the nature of the data security breach, its consequences, and the measures taken or contemplated to remedy it.

3. The data processor shall notify the data controller without undue delay of any data security breach.

4. The data controller shall inform the data subject when necessary for their protection or when required by the FDPIC.

5. The data controller may restrict, defer, or waive the information of the data subject in the following cases

a. the overriding interests of a third party so require;

b. an overriding public interest, in particular the maintenance of the internal or external security of the canton or Switzerland, so requires;

c. informing the data subject is likely to compromise an investigation, inquiry, or administrative or judicial proceeding;

d. the duty to inform is impossible to comply with or requires disproportionate efforts;

e. the information of the data subject is equivalently guaranteed by a public communication.

1. Data controllers shall appoint a data protection advisor. They may appoint a common advisor.

2. The data protection advisor must meet the following conditions

a. they possess the necessary professional knowledge;

b. they do not carry out activities incompatible with their tasks as data protection advisor.

3. The data protection advisor shall notably perform the following tasks

a. they advise the data controllers;

b. they promote the information and training of employees;

c. they contribute to the application of data protection regulations and propose measures if it appears that data protection regulations have been violated.

1. Anyone with a legitimate interest may demand from the data controller

a. that they refrain from unlawful processing;

b. that they remove the effects of unlawful processing;

c. that they confirm the unlawful nature of processing.

2. The applicant may in particular demand that the data controller

a. rectify, erase, or destroy personal data;

b. publish or communicate to third parties their decision concerning, in particular, the rectification, erasure, or destruction of data, the opposition to a communication, or the marking of the contentious nature of personal data as provided for in paragraph 4 of this article.

3. Instead of erasing or destroying personal data, the data controller shall restrict processing in the following cases

a. the accuracy of the data is contested by the data subject and its accuracy or inaccuracy cannot be established;

b. overriding interests of a third party require it;

c. an overriding public interest, in particular the internal or external security of the canton or Switzerland, requires it;

d. the erasure or destruction of the data is likely to compromise an inquiry, an investigation, or an administrative or judicial procedure.

4. If the accuracy or inaccuracy of personal data cannot be established, a note indicating its contentious nature shall be added to the data.

5. The procedure is governed by the Law of 28 October 2008 on administrative procedure [D] (LPA).

1. The Commissioner initiates an investigation ex officio or upon complaint against the data controller or processor if there are indications that data processing could be contrary to data protection provisions.

2. He may decide not to initiate an investigation when the violation of data protection regulations is of minor importance.

3. The data controller or processor provides the Commissioner with all the information and documents necessary for the investigation.

4. If the affected person is the author of the complaint, the Commissioner informs them of the actions taken and the result of any investigation conducted.

1. Where the controller or the processor fails to comply with its obligation to cooperate, the Commissioner may, in the context of the investigation procedure, order in particular

a. access to all information, documents, records of processing activities and personal data necessary for the investigation;

b. access to premises and facilities;

c. the hearing of witnesses;

d. expert reports.

2. The Commissioner may also order provisional measures for the duration of the investigation.

1. If data protection provisions are violated, the Commissioner may order compliance, suspension, or cessation of all or part of the processing, as well as the erasure or destruction of all or part of the personal data.

2. The Commissioner may suspend or prohibit the transfer of personal data abroad if it contravenes the applicable legal provisions regarding the transfer of personal data to a third country or to an international organization.

3. When the data controller or the processor has taken the necessary measures during the investigation to restore a situation that complies with data protection requirements, the Commissioner may limit the response to issuing a warning.

4. The parties to the investigation procedure, including the data controllers, have the right to appeal, including against decisions on the suspensive effect or interim measures.

1. The Commissioner may exchange information or personal data with an authority of a Schengen State responsible for personal data protection for the accomplishment of their respective legal tasks in data protection, provided that the following conditions are met

a. reciprocity in administrative assistance is guaranteed;

b. the exchanged information and personal data are used only within the framework of the procedure related to personal data protection underlying the request for administrative assistance;

c. the recipient authority undertakes not to disclose professional, business, or manufacturing secrets;

d. the information and personal data are communicated to third parties only with the prior consent of the transmitting authority;

e. the recipient authority undertakes to respect the obligations and restrictions on use required by the authority that transmitted the information and personal data to it.

2. To substantiate its request for administrative assistance or to act upon a request for administrative assistance from the requesting authority, the Commissioner may communicate, in particular, the following information

a. the name of the department responsible for processing, the processor, or any other third-party body involved in the processing;

b. the categories of data subjects;

c. the identity of the data subjects when its communication is essential for the accomplishment of the legal tasks of the Commissioner or an authority of a Schengen State responsible for data protection;

d. the personal data or categories of personal data processed;

e. the purposes of the processing;

f. the recipients or categories of recipients;

g. the technical and organizational measures.

3. Before transmitting to an authority of a Schengen State responsible for data protection any information likely to contain professional, manufacturing, or business secrets, the Commissioner shall inform the holders of these secrets and invite them to comment, unless this proves impossible or requires disproportionate efforts.

1. In the absence of specific provisions provided by this law, the cantonal law on the protection of personal data [C] (LPrD) applies; the applicability of other laws is reserved.

2. The law on administrative procedure [D] (LPA) also specifically applies to the procedure to be followed concerning the application of Articles 11 to 14 of this law.

1. The Council of State is responsible for the execution of the present law. It shall publish the text in accordance with Article 84, paragraph 1, letter a), of the Cantonal Constitution and shall determine, by decree, the date of its entry into force.