Act on Public Information, Data Protection and Archiving (LIPDA) - Purpose (GIDA)

1. This law regulates

a) the public's access to information and official documents;

b) the processing of personal data by authorities;

c) the archiving of official documents.

2. Its purposes are

a) to ensure the transparency of the authorities' activities, thereby promoting free formation of opinion and participation in public life;

b) to ensure the protection of the rights and fundamental freedoms of individuals in the processing of personal data by authorities;

c) to ensure the preservation and access to documents that, according to the provisions of this law and special regulations, must be submitted to the archives.

1. The provisions of the other enactments of cantonal law that relate to personal data shall continue to apply to the processing of data of legal entities for 5 years after the entry into force of the amendment of the present law.

1. Data controllers are granted a period of 2 years from the date of entry into force of the amendment of this law to appoint a Data Protection Officer and ensure that this officer diligently performs their duties.

1. If a mandate granted to an agent under the old law is in effect at the time the amendment to this law comes into force, the agent shall continue to perform their duties in accordance with the new law until the originally designated end of the term of the mandate, without requiring an election as specified in Article 36.

2. A mandate contract concluded under the old law shall automatically terminate upon the coming into force of the amendment to this law, without the need for dissolution.

1. The current commission shall remain in office until the amendment of the new law comes into effect.

2. A new commission must be appointed upon the coming into effect of the amendment of the new law.

3. The mandate of the new commission shall end simultaneously with that of the new commissioner.

1. Subject to special provisions, the present law applies to all authorities defined in Article 3, paragraph 1.

2. The provisions on the principle of public access do not apply to the authorities mentioned in Article 3, paragraph 1, letters c, d, and e, if it restricts their competitiveness.

3. Processing of personal data regulated in other special laws is not subject to the data protection provisions of the present law.

1. Authorities

a) * the legislative, executive, and judicial branches of the canton, as well as the resident and municipal communities, their bodies and administrations, and the commissions dependent on them;

1. * ...

2. * ...

3. * ...

4. * ...

5. * ...

b) * the cantonal and municipal public-law corporations or institutions, their bodies and administrations, and the commissions dependent on them;

c) * legal entities or other private-law organizations in which a community holds a majority interest or exercises controlling influence;

d) * natural or legal persons and organizations entrusted with the execution of tasks under cantonal or municipal public law, within the framework of executing these tasks;

e) * associations of authorities.

2. Official Documents: all information in the possession of an authority concerning the fulfillment of a public task and that has been completed, regardless of the medium of information, including in particular: dossiers, messages, reports, audit reports, studies, approved minutes, statistics, registers, correspondence, instructions, opinions, preliminary opinions, or decisions; except for documents intended for personal use or commercial purposes, as well as documents for which there is no right of access in non-contentious or contentious proceedings.

3. Personal Data: all data relating to an identified or identifiable natural person (data subject).

4. Processing: any handling of personal data, regardless of the means and procedures used, particularly the collection and entry of personal data, the application of logical or arithmetic operations on these personal data, as well as their use, storage, alteration, disclosure, dissemination, archiving, deletion, and destruction.

5. ...

6. Data Processing Controller: authority, department, or any other public or private entity that alone or together with others determines the purpose and means of processing personal data in fulfillment of their legal tasks.

6bis Data Processor: private individual or authority processing personal data on behalf of the Data Processing Controller.

6ter Recipient: private individual or authority to whom personal data are disclosed (as Data Processing Controller, Data Processor, or third party).

7. Particularly Sensitive Personal Data

a) * personal data regarding religious, ideological, philosophical, political, or trade union views or activities;

b) * personal data concerning health, intimate sphere, sexual life, racial or ethnic origin;

c) * personal data on social welfare measures;

d) * personal data on criminal and administrative prosecutions or sanctions;

e) * genetic data;

f) * biometric data that allow the unique identification of a person.

8. Profiling: any form of automated processing of personal data that uses these personal data to evaluate certain personal aspects relating to a natural person, in particular, to analyze or predict aspects regarding work performance, economic situation, health, personal preferences, interests, reliability, behavior, location, or movement of this person.

8bis Breach of Personal Data Security: a security breach that, regardless of intention or unlawfulness, results in personal data being lost, deleted, destroyed, or altered, or disclosed or made accessible to unauthorized persons.

9. Archive: an institution responsible for the collection, management, storage, and valorization of official documents.

1. Media and journalists who regularly report on the affairs of the canton, the municipal and civic communities, or the courts shall be accredited upon request by the office of the Grand Council, the presidency of the State Council, the cantonal court, the municipal or civic council, or the office of the General Council.

2. The accredited media and journalists shall receive those work facilitation measures necessary for the exercise of their activities.

3. The accrediting authorities shall regulate the modalities of accreditation.

1. The meetings of the authorities are public within the framework of the provisions set forth by cantonal legislation, federal law, and international treaties.

1. The following are public

a) the sessions of the Grand Council;

b) the sessions of the legislative bodies of the resident and civic communities;

c) the proceedings and pronouncements of judicial authorities, subject to exceptions provided for by legislation.

2. If overriding public or private interest so requires, these authorities may order the exclusion of the public.

1. The other meetings of the authorities are not public.

2. If an overriding public or private interest requires it, the competent authorities may decide that these meetings are public or allow only the presence of the media.

1. Accredited media and journalists are reserved seats at public sessions or non-public sessions to which they are admitted.

2. Image and sound recordings or transmissions by accredited media and journalists are allowed, provided they do not disturb the proceedings and do not conflict with any overriding public or private interests. Image and sound recordings or transmissions of court proceedings and the pronouncements of judgments are generally not permitted.

1. Authorities shall, on their own initiative, provide information about their activities that are of interest to the public, unless this is contrary to an overriding interest.

2. Their information shall be precise, complete, clear, and provided promptly.

3. They shall disseminate the information through appropriate channels, taking into account its importance.

4. A copy of publications intended for public dissemination by the authorities and their departments shall be deposited with the Mediathek Wallis at the time of their release, which establishes the administrative procedures ensuring access to these documents.

5. The cantonal authorities shall consider regional needs and the bilingual requirements of the canton.

1. The judicial authorities provide information about ongoing proceedings insofar as public interest justifies it. The Cantonal Court regularly publishes its anonymized decisions.

1. Authorities generally disseminate their information through their own channels and the media.

2. They take into account the needs of various media to the extent possible and ensure equal treatment.

3. They provide information to the media free of charge.

4. Regarding the criminal proceedings of the courts and the public civil proceedings of the Cantonal Court, accredited media and journalists are informed in a timely manner about the dates and times, as well as the agenda providing information on the subject matter of the proceedings.

1. Every person has the right to access official documents in accordance with the provisions of this law.

2. Access to official documents related to pending judicial, administrative, and arbitration proceedings is governed by special laws and procedural rules.

3. The special provisions of other laws that designate certain information as confidential or that provide for access rights differing from this section are reserved.

1. The request for access to official documents must be submitted in writing, including in electronic form, and does not need to be justified.

2. It must contain sufficient details to allow for the identification of the requested item.

3. The request is directed to the authority that issued the official document; if an authority mistakenly receives a request, it shall forward it without delay to the competent authority.

4. If an official document was commissioned by an authority, that authority decides on the request.

5. If the issuing authority is not subject to the present law, the request is directed to the authority that is the main addressee of the official document.

6. If the request concerns an archived document, it must be directed to the relevant archive. If the request relates to a document with a protection period (Art. 43), the archive shall first obtain the opinion of the competent authority that authored the document.

1. The authority shall process the request carefully and promptly, but no later than 10 business days after receipt thereof.

2. This deadline may be exceptionally extended if the request pertains to a large number of documents or to complex or difficult-to-obtain documents.

3. The authority shall support the applicant to the best of its ability, particularly to enable precise identification of the sought official document.

4. If the authority receives requests from the media, it shall take into account their specific needs.

1. If an official document contains personal data, such data must be separated from the other information or anonymized, unless the affected person has disclosed this personal data themselves or has given their consent in writing, including electronically.

2. If fulfilling the requirements of the preceding paragraph requires an evidently disproportionate or technically impossible effort on the part of the authority, access to documents containing personal data is regulated by Article 22 of the present Act.

**1. Subject to different specific provisions, access to official documents includes:**

a) inspection on-site;

b) making of copies;

c) delivery of copies insofar as possible and if the size of the document permits.

**2. The authority may also provide verbal information about the content of an official document if it satisfies the requesting person; however, the authority can only do so if it is a document accessible under the present law.**

1. Access to an official document shall be denied if an overriding public or private interest so requires.

2. An overriding public interest exists if access to the document

a) may endanger the security of the state or public safety;

b) may adversely affect the foreign policy of the authority;

c) may impair the decision-making process of an authority;

d) may impair the implementation of specific administrative measures;

e) may weaken the negotiating position of an authority.

3. An overriding private interest exists in particular if

a) the official document contains personal data and disclosure thereof is not permitted under the present law;

b) access would reveal professional, manufacturing or business secrets;

c) information is provided that has been voluntarily communicated to the authority by third parties and the authority has assured its confidentiality.

4. Access to an official document may be denied if the request for information is abusive or entails a clearly disproportionate workload for the authority.

5. Not accessible are the minutes of the meetings of the Council of State as well as the executive councils of municipalities and civic communities.

6. The Grand Council, as well as the legislative bodies of municipalities and civic communities, may declare the minutes of their commissions' meetings as inaccessible.

7. Affected third parties shall be consulted if access to an official document could conflict with an overriding private interest. They may file a written objection, including in electronic form, against the disclosure of the document within 10 days after consultation. During the related procedure, the authority shall not disclose the document or the personal data.

1. If only some parts of an official document within the meaning of Article 15 are inaccessible, access to the remainder of the document must be granted, provided that the meaning or scope is not thereby distorted.

2. If the reasons justifying the inaccessibility of an official document within the meaning of Article 15 are time-limited, access shall be granted from the point in time at which these reasons lose their validity, without the need to submit a new request.

1. Personal data may be processed if a legal basis exists for doing so.

2. A basis in a law in the formal sense is required in the following cases

a) * it involves the processing of particularly sensitive personal data or profiling;

b) * the purpose of processing or the manner in which personal data is processed can lead to a serious infringement on the fundamental rights of the affected person.

3. Provided the processing does not pose particular risks to the fundamental rights of the affected person, personal data may, by exception, be processed on the basis of a law in the material sense if one of the following three conditions is met

a) * carrying out a task that is clearly defined in a law in the formal sense requires the processing of personal data as a necessity;

b) * the processing is necessary to protect the vital interests of the affected person or a third party;

c) * the processing pertains to personal data that has been manifestly published by the affected person and that person has not expressly objected to its processing.

1. Personal data subject to processing must

a) * be processed in good faith and in a transparent manner;

b) * be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes;

c) * be adequate, relevant, accurate - and updated if necessary -, complete, and proportionate to the purpose;

d) * be stored in a form which permits the identification of the data subject only as long as necessary for the purposes for which the data are processed;

e) * be destroyed or anonymized once they are no longer necessary for processing purposes.

2. The data controller is obligated, considering the risks, to design the processing of personal data in such a way, technically and organizationally, that the data protection regulations are complied with in all phases of processing, including from the planning stage.

3. The data controller is also obligated to ensure, through appropriate default settings, that the processing of personal data is limited to the extent necessary for the purpose of use, unless the data subject specifies otherwise.

4. If the consent of the data subject is required, it must be given voluntarily, specifically for the particular case, in an informed manner, and unambiguously.

**1. The Data Controller's Obligation to Inform**

1. The data controller is obliged to inform the data subject about the collection of personal data relating to them, regardless of whether these data are collected directly from the data subject or from third parties.

2. The data subject shall be informed of at least the following

a) * the identity and contact details of the data controller;

b) * the legal basis for the processing;

c) * the purpose of the processing;

d) * the personal data processed or categories of personal data processed;

e) * the recipients or categories of recipients of personal data, if any disclosure of personal data is intended;

f) * their rights (Art. 31 et seq.);

g) * the consequences of the data subject's refusal to provide the personal data requested by the authority;

h) * the necessary information to enable them to exercise their rights under this law and to ensure transparent processing of personal data;

i) * the duration of the storage of the personal data or the criteria for determining the duration of storage.

2bis. The information obligation of the data controller lapses if the data subject has already been informed.

3. If the personal data are not collected from the data subject, their information must be provided at the latest at the time of their registration or, if registration is not foreseen, at the first disclosure of the personal data to third parties. The data controller is released from their information obligation if

a) * the registration or disclosure of the personal data is expressly provided for by law;

b) * the information obligation cannot be fulfilled or can only be fulfilled with a manifestly disproportionate effort.

4. ...

**1. The Controller of Data Processing may refuse, restrict, or defer the disclosure provided in the preceding article if:**

a) a statute expressly provides for it;

b) it is required due to overriding interests of third parties;

c) it is necessary due to overriding public interests, particularly relating to the internal or external security of the state;

d) the provision of information could jeopardize a criminal investigation or another investigative procedure.

**2. Once the reason for the refusal, restriction, or deferment ceases to exist, the Controller of Data Processing is obligated to fulfill the duty to provide information, unless it proves to be impossible or only feasible with disproportionate effort.**

1. The data subject must be explicitly informed if a decision based solely on the automated processing of personal data produces legal effects concerning the data subject or significantly affects them.

2. The data controller shall provide the data subject, upon a written request, including in electronic form, the opportunity to present their viewpoint within ten days of receiving the notification. The data subject may request that the decision be reviewed by a natural person.

**1. The Controller and the Processor**

The Controller and the Processor ensure an adequate level of security for personal data through appropriate technical and organizational measures, considering the risk, including where necessary

a) *the pseudonymization and encryption of personal data;*

b) *the ability to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services;*

c) *the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident.*

**2. Risk Assessment**

In assessing the appropriate level of security, specific risks associated with processing must be considered, particularly those arising from the - whether accidental or unlawful - destruction, loss, alteration, unauthorized disclosure of, or access to personal data transmitted, stored or otherwise processed. These measures are reviewed periodically.

**3. Regulations by the State Council**

The State Council may issue provisions regarding the minimum requirements for the protection of personal data security.

1. Authorities may disclose personal data to third parties if one of the following three conditions is met

a) there is a statutory provision that permits this;

b) the data subject has given their consent in writing, including in electronic form;

c) the disclosure is essential for safeguarding an overriding public or private interest.

1bis Authorities may, upon request and if the requesting person demonstrates a legitimate interest, disclose to third parties the name, first name, address, and date of birth of a person.

2. Authorities may disclose particularly sensitive personal data to third parties if one of the following three conditions is met

a) a provision of a formal law permits this;

b) the data subject has given their consent in writing, including in electronic form;

c) the disclosure is necessary to protect the life or physical integrity of the data subject or a third party.

3. Personal data and particularly sensitive personal data may be transmitted to authorities in specific cases upon their request, if the transmission is legally permitted or if the information requested is necessary for the fulfillment of their legal duties.

4. A data subject who demonstrates a protectable interest can file an objection against the disclosure of specific personal data by the authority.

5. The authority shall reject the request if one of the following conditions is met

a) there is a legal obligation to disclose the personal data;

b) the fulfillment of its legal duties would otherwise be jeopardized.

1. Upon written request, including in electronic form, the municipal council may authorize the residents' registration office to systematically disclose the first name, last name, gender, address, and date of birth to a private individual, organization, or authority if the requesting party asserts a legitimate interest. This personal data may not be used for commercial purposes.

2. ...

3. Any individual may oppose the disclosure of their personal data as described in paragraph 1.

1. Personal data may be disclosed if the recipient is subject to the jurisdiction of states or organizations that ensure an adequate level of protection for the intended transfer of personal data.

1bis Sufficient guarantees, especially contractual ones, ensure an adequate level of protection for the foreign country. These guarantees must be approved, issued, or recognized by the cantonal commissioner.

2. In the absence of adequate protection and sufficient guarantees, personal data may only be disclosed abroad under one of the following conditions

a) The data subject has given their consent in writing, including electronically, after being informed of the risks associated with the lack of adequate protection;

b) The disclosure is essential for safeguarding an overriding public interest;

c) The disclosure is essential for the establishment, exercise, or defense of rights in court;

d) The disclosure is necessary to protect the life or physical integrity of the data subject or a third party;

e) The disclosure is directly related to the conclusion or execution of a contract

1. between the data controller and the data subject, or

2. between the data controller and their contractual partner in the interest of the data subject.

f) ...

3. ...

1. Authorities may process personal data for non-personal purposes, particularly for research, planning, and statistics, when

a) * the personal data are anonymized as soon as the purpose of the processing allows;

b) * the authority discloses sensitive personal data to private individuals only in such a way that the affected persons cannot be identified;

c) * the recipient discloses the personal data to third parties only with the consent of the authority that disclosed them;

d) * the results are published only in such a way that the affected persons cannot be identified.

2. If personal data are processed exclusively for non-personal purposes, the principles of the requirement for a legal basis (Art. 17 para. 1), compatibility with the legal purpose (Art. 18 para. 1 lit. c), and the disclosure of personal data (Art. 22) are not applicable.

1. In order to safeguard a prevailing public interest or a legitimate private interest of the concerned individual, the data controller may restrict the disclosure of personal data or subject it to certain conditions.

2. If personal data are protected under professional or official confidentiality, they may be disclosed only if the recipient is subject to an equivalent duty of confidentiality.

3. Statutory provisions that require the consent of the concerned individual remain reserved.

1. To contribute to the safety of individuals and property, an authority may install image capture and image recording devices in public places under the following conditions

a) A law in the formal sense permits this;

b) * necessary measures are taken to limit the impact on the affected individuals;

c) the recorded information is used only for the purposes specified in the law through which the surveillance system is introduced.

2. The public must be notified in a clear and appropriate manner about the surveillance measure and the responsible authority.

3. The duration for which the recorded data is retained, as well as the authorities authorized to review the recorded material, must be determined in special legislation based on the needs and objectives.

1. The installation of image capture and recording devices in communal public spaces for the purpose of ensuring public safety and order requires appropriate provisions in a municipal or intermunicipal regulation, which must be adopted by the General Council or the Assembly and homologated by the State Council.

2. The canton publishes model provisions for the municipalities.

3. The municipal regulation must specifically designate individuals who are authorized and properly sworn in to review the recorded images.

4. The installation of image capture and recording devices in cantonal public spaces to ensure public safety and order is regulated by cantonal law.

1. The controller and the processor must be able to demonstrate at any time that the processing carried out complies with this law.

2. If two or more authorities jointly determine the purposes and means of processing, they are jointly responsible for the processing and must define their respective obligations in a transparent manner.

1. The processing of personal data may be contractually or legislatively assigned to a data processor if

a) **\*** the personal data is processed in the manner that the data controller is permitted to process it;

b) **\*** no legal or contractual confidentiality obligation prohibits the transfer.

2. The contract, which must be in written form, including electronic form, must specify the subject matter and duration, as well as the nature and purpose of the processing, the type of personal data, the categories of data subjects, as well as the rights and obligations of the data controller. This contract provides that the data processor shall

a) act only on the instructions of the data controller;

b) commit to maintaining confidentiality;

c) delete and return all personal data upon completion of the provision of its services related to the processing of personal data as instructed by the data controller;

d) provide the data controller with all necessary information to demonstrate compliance with its obligations.

3. The data controller must particularly ensure that the data processor is capable of adhering to the principles outlined in Article 18 and ensuring the security of personal data as described in Article 21.

4. The data processor may assign processing to a third party only with prior written approval, including in electronic form, from the data controller.

5. It may invoke the same justifications as the data controller.

6. The data processor shall maintain a record of all processing activities carried out on behalf of the data controller. This record shall contain

a) the identity and contact details of the data processor and the data controller;

b) the categories of processing activities performed for the data controller;

c) the recipients or categories of recipients of personal data, including recipients in third countries or international organizations, provided that the disclosure of personal data is expressly requested by the data controller;

d) the measures to ensure the security of personal data.

**1. The appointee maintains a register of processing activities, which is made available to the authorities that complete it and report any changes. This register is public.**

**2. It contains information for each processing activity regarding:**

a) *the identity and contact details of the person responsible for data processing;*

b) *the legal basis for processing;*

c) *the purpose of processing;*

d) *the affected persons or categories of affected persons;*

e) *the processed personal data or categories of processed personal data;*

f) *the recipients or categories of recipients of personal data, if disclosure of personal data is intended, including recipients in third countries or international organizations;*

g) *the retention period or, if that is not possible, the criteria for determining this period;*

h) *the measures to ensure the security of personal data.*

**3. The State Council may provide exceptions from the registration requirement for certain processing activities.**

a) *...*

b) *...*

**4. ...**

1. The data controller shall report any personal data security breach to the commissioner without delay if it can significantly affect the fundamental rights and freedoms of the data subjects. If the controller believes that a breach does not need to be reported, they must document the reason for this decision.

2. The report must at least specify the nature of the personal data security breach, its consequences, and the measures taken or proposed.

3. The data processor shall immediately report any personal data security breach to the data controller.

4. The data controller must inform the affected individual without delay if it is necessary for their protection.

5. The data controller may limit, delay, or refrain from notifying the affected individual if

a) it is necessary due to overriding public interests, particularly to maintain the internal or external security of the state, or if the notification could jeopardize an investigation, inquiry, or administrative or judicial proceedings;

b) notification is impossible or would require disproportionate effort;

c) notification can be ensured through a public announcement in an equivalent manner;

d) it is necessary due to overriding interests of third parties.

1. The Controller responsible for data processing, in collaboration with their Data Protection Officer, conducts a Data Protection Impact Assessment (DPIA) in advance if a planned processing operation is likely to result in a high risk to the rights and freedoms of the data subject. If multiple similar processing operations are planned, a joint assessment can be conducted.

2. The high risk arises from the nature, scope, circumstances, and purpose of the processing. This is particularly the case

a) when there is extensive processing of particularly sensitive personal data;

b) when profiling is involved;

c) when large public areas are systematically monitored.

3. The impact assessment includes a description of the planned processing, an evaluation of the risks to the personality or fundamental rights of the data subject, and the planned measures to protect the personality and fundamental rights of the data subject.

4. If the Data Protection Impact Assessment reveals that a processing operation, despite the measures planned by the data processing Controller, presents a high risk to the personality or the fundamental rights of the data subject, the Commissioner must be informed in advance. The Commissioner must raise objections to the planned processing within a period of 2 months and suggest appropriate measures.

1. The Data Controller shall appoint a Data Protection Officer. The same Data Protection Officer may act for multiple Data Controllers.

2. The Data Protection Officer must meet the following conditions

a) they possess the required expertise;

b) they do not engage in activities incompatible with their duties as a Data Protection Officer.

3. The Data Protection Officer has, in particular, the following tasks

a) they advise the Data Controller;

b) they promote the information and training of employees;

c) they assist in the implementation of data protection regulations and propose measures if it becomes apparent that data protection regulations have been violated;

d) they serve as a point of contact for the data subjects and supervisory authorities.

1. Every data subject has the right, upon their request, to receive a confirmation free of charge and in an understandable form regarding the processing of their personal data, including the following information

a) the identity and contact information of the person responsible for data processing;

b) the legal basis for the processing;

c) the purpose of the processing;

d) the personal data being processed;

e) all information regarding the origin of the personal data;

f) the recipients or categories of recipients of the personal data, if disclosure of the personal data is intended;

g) the retention period or, if this is not possible, the criteria for determining this period;

h) where applicable, the existence of an automated individual decision, as well as the logic on which this decision is based.

2. No one can waive this right in advance.

3. The request must be submitted in writing, including in electronic form, and does not need to be justified.

4. The authority shall handle the request carefully and promptly, but no later than 30 days after its receipt.

5. This deadline may be exceptionally extended if the request for access pertains to a large number of documents or to complex or difficult-to-obtain documents.

6. Affected third parties will be consulted if access to personal data could harm their personality. They may submit an objection to the disclosure of the personal data in writing, including in electronic form, within 10 days after consultation. During this related procedure, the authority will not disclose the personal data.

**1. The notification of information or the right of access may be restricted or refused, particularly:**

a) if the request would lead to an obviously disproportionate administrative effort, provided that the requesting person does not assert a legitimate interest;

abis) if the request is obviously excessive due to its repetitive nature;

b) if the personal data for which information is requested are not processed in a personally identifiable manner;

c) if an overriding public interest or a legitimate private interest requires restriction.

**2. The person responsible for data processing must state in writing, including in electronic form, the reasons for restricting or refusing access.**

1. Any data subject may request the data controller to

a) * rectify or destroy inaccurate personal data;

b) * cease unlawful processing;

c) * eliminate the effects of unlawful processing;

d) * ascertain the unlawful nature of processing.

2. The applicant must specify the facts and grounds upon which their request is based, and indicate the evidence they wish to present. Evidence in their possession must be attached to the application.

3. If the data controller is unable to immediately prove the accuracy of the disputed personal data, the data subject may request that it be noted that the personal data is disputed, and raise an objection to its disclosure in accordance with Article 22, paragraph 5.

3bis Instead of deleting or destroying the personal data, the data controller shall restrict processing if

a) the accuracy of the personal data is disputed by the data subject and cannot be ascertained;

b) it is required due to the overriding interests of third parties;

c) it is required due to overriding public interest;

d) the deletion or destruction of the personal data could affect an investigation, inquiry, or administrative or judicial proceeding.

3ter If it emerges that inaccurate personal data has been disclosed or that personal data has been unlawfully disclosed, the recipient shall be informed without delay. The recipient must rectify or delete the inaccurate personal data.

3quater Paragraph 1 does not apply if the data controller can demonstrate that there are legitimate grounds for processing which override the interests, fundamental rights, and freedoms of the data subject.

4. ...

1. The affected person, who credibly demonstrates a legitimate interest, may at any time object to the processing of personal data concerning them.

2. ...

1. **Supervision of the Application of Legislation on the Principle of Public Access and the Protection of Personal Data**

The supervision over the application of legislation concerning the principle of public access and the protection of personal data is vested in the supervisory authority, which consists of two independent bodies: the Data Protection and Public Access Officer (the Officer) and the Cantonal Data Protection and Public Access Commission (the Commission). The supervisory authority exercises its oversight in the municipalities as well. It falls under the supervisory control of the Grand Council.

2. The Officer, as well as the president and the commission members, are appointed by the Grand Council. They are bound by official secrecy.

3. They exercise their functions independently and impartially, without receiving or seeking instructions from any authority or third parties.

4. The Officer and the Commission have the necessary resources and, in particular, their own budget. They submit their two separate budget proposals annually to the Grand Council through the State Council, which determines the amount of the global budget within the framework of adopting the state budget. The accounts are submitted to the Cantonal Financial Inspectorate for review.

5. For each financial year, the Officer and the Commission present a business report to the State Council and the Grand Council, drafted in both official languages. The report is published. Within their annual report, the Officer and the Commission present the accounts of the previous year.

1. The Commissioner is elected for a term of 4 years. The mandate is renewable. He may request to be relieved from his duties by the Grand Council at the end of a month, with a notice period of 6 months.

1bis The Commissioner is elected by the Grand Council upon the proposal of the Commission. The position is advertised. The Commission determines the procedure.

2. The Grand Council may decide, upon the preliminary opinion of the Commission, to relieve the Commissioner from his duties in the following cases

a) he is permanently unable to perform his duties;

b) he has seriously violated his service obligations either intentionally or through gross negligence.

3. The Commissioner hires his staff and ensures an on-call service. In doing so, the Commissioner ensures adequate representation of the two official languages. The Commissioner is administratively affiliated with the State Chancellery.

4. The Commissioner must not engage in any additional gainful activity, hold any office of the Confederation or a canton, nor exercise any federal, cantonal, or communal elective mandate, nor act as a member of the management, board of directors, supervisory body, or auditing body of a commercial enterprise. The State Council may permit the Commissioner to engage in secondary employment, provided it does not impair the performance of his function, independence, and reputation. The decision will be published in the Official Gazette.

5. Written documents and other materials created by the Commissioner in the course of his duties are the property of the State.

1. In the event of the unavailability of the appointee, the office of the Grand Council may, upon the recommendation of the commission, designate a person to temporarily perform the duties of the office.

1. The Commissioner

a) * monitors, ex officio, the application of data protection and transparency regulations; for this purpose, he may conduct inspections at the authorities at any time and, if necessary, initiate an investigation against an authority if the results of the inspections or indications suggest that a processing could contravene the provisions of data protection and transparency;

b) * advises the authorities on the application of data protection and transparency regulations and provides private individuals with information about their rights;

bbis) * participates in the training of municipalities and data protection officers in the areas of data protection and transparency;

c) * examines any report received regarding violations of this law and its implementing provisions and informs the originator of the report about the steps taken based on it and the result of any investigation;

d) * recommends to the authority, should a violation of the personal data protection regulations be identified, to amend or stop the processing and may refer the matter to the Commission for a decision at any time, which may be accompanied by sanctions under Article 292 of the Criminal Code;

e) * acts as a mediator between authorities and private individuals according to Article 53;

f) * ensures that the cross-border transmission of personal data occurs in a framework where the rights of the affected person are guaranteed, and approves the guarantees mentioned in Article 25, paragraph 2;

g) * ...

h) * comments on draft regulations related to data protection and transparency, measures involving the processing of personal data, or in other cases provided by law;

i) * maintains a register of processing activities and reports of breaches of personal data security according to Articles 30 and 30a;

j) * proposes appropriate measures if consulted in the case of a data protection impact assessment due to processing that would pose an increased risk to the personality or fundamental rights of the affected person according to Article 30b;

k) * files complaints according to Article 56;

l) * publishes his activity report according to Article 35, paragraph 5;

m) * assumes other tasks assigned to him by law.

2. The Commissioner can request files, obtain information, and have personal data processing demonstrated to him. The authorities concerned are obliged to cooperate in fact-finding. Official secrecy cannot be cited against him.

3. ...

4. ...

1. The Commissioner exercises his functions independently without receiving or seeking instructions from any authority or third parties. He is bound only by the law and the supervision of the Grand Council.

2. He independently determines the organization to fulfill his tasks.

3. The canton provides the Commissioner with permanent premises.

4. Unless otherwise provided in the present law, the employment relationships of the Commissioner and his staff are regulated by the Law on Personnel of the State of Valais (kGPers).

5. The Commissioner is not subject to the personnel controlling as provided in Articles 14 and following of the Ordinance on Personnel of the State of Valais (kVPers).

1. The Officer is required to collaborate with cantonal, federal, and foreign data protection and public access authorities in the exercise of his or her duties.

2. Within the framework of this cooperation, the Officer may exchange information or personal data with another data protection authority to fulfill respective legal tasks in the field of data protection, provided the following conditions are met

a) reciprocity of mutual assistance is ensured;

b) the information and personal data are only used for the data protection-related proceeding that underlies the cooperation request;

c) the receiving authority commits to upholding professional, business, and manufacturing secrets;

d) the information and personal data are disclosed to third parties only if the authority that transmitted them has given prior approval;

e) the receiving authority commits to complying with the requirements and restrictions imposed by the authority that transmitted the information and personal data.

3. To substantiate its request or to comply with a request, the Officer may, in particular, provide the following information

a) the name of the authority responsible for processing, the data processor, or other third parties involved in the processing;

b) the categories of the affected individuals;

c) the identity of the affected individuals, if its disclosure is indispensable and the individuals have consented, so that the Officer or another authority responsible for data protection can fulfill its/his/her legal duties;

d) the processed personal data or categories of processed personal data;

e) the purpose of processing;

f) the recipients or categories of recipients;

g) the technical and organizational measures.

4. Before the Officer discloses information to another data protection authority that may contain professional, business, or manufacturing secrets, he or she must inform the affected individuals who are the bearers of these secrets and invite them to comment, unless this is not possible or requires disproportionate effort.

1. The Commission consists of 5 members, including at least 2 legal professionals and one IT specialist, appointed for a term of 4 years by the Grand Council based on a proposal and report from the Council of State. The appointment is renewable. Commission members may not be members of the Grand Council. The other activities of the Commission members must be compatible with their function. The Commission is administratively affiliated with the State Chancellery.

2. The Commission meets at least once a year and additionally as needed depending on the cases to be handled. It can validly deliberate in the presence of at least 3 members.

3. The Commission may consult external experts if necessary.

4. The Council of State determines the compensation of the Commission members.

5. The Commission drafts and publishes regulations concerning its organization and operational procedures.

**1. The Commission Decides on Cases Referred to It**

a) * ...

b) * ...

c) * ...

**2. The Commission Possesses the Same Investigative Powers as the Commissioner Pursuant to Article 37, Paragraph 2.**

**3. It May Specifically:**

a) Inform an authority that the intended processing may violate the present law;

b) Order an authority to bring the processing into compliance with the present law, if necessary, specifically and within a certain deadline, especially by ordering the full or partial correction or deletion of personal data;

c) Temporarily or permanently restrict or prohibit processing.

**4. It Publishes Its Activity Report in Accordance with Article 35, Paragraph 5.**

1. Authorities, their members, as well as their dependent officials and employees, must manage and store official documents in an orderly manner.

2. Each authority regulates the administrative, classification, and storage procedures in close cooperation and agreement with the relevant archive.

1. Authorities must offer official documents that are no longer useful for conducting ongoing business to the relevant archive, unless they are required to archive these documents themselves. The provisions of special legislation remain reserved.

2. The archive assesses the archival value of the documents and decides on their permanent preservation or destruction in close cooperation with the concerned authorities.

3. The concerned authorities destroy personal data deemed not worthy of archiving by the archives, except when such data

a) * have been anonymized;

b) * must be retained for evidence or security purposes, or for the protection of the legitimate interests of the person concerned.

1. Documents that were publicly accessible under this law before being archived shall remain so, under the conditions set forth in Articles 12 to 16. Other archived documents will be made publicly accessible 30 years after their creation, provided there is no overriding public or private interest opposing this.

2. Documents containing particularly sensitive personal data or data from profiling are publicly accessible no earlier than 10 years after the death of the person concerned. If the date of death is not known, the protection period expires 100 years after the dossier is closed.

3. Archived documents may be accessed at any time by the authority from which they originate, as well as by the individuals concerned.

1. Access to archived documents may be restricted or denied if an overriding public or private interest could be jeopardized.

2. Furthermore, access to original documents may be restricted or denied if this is necessary to ensure their preservation.

3. Restrictions based on other laws remain reserved.

1. Archives may permit access to documents, upon a substantiated request and after consulting the authority from which the documents in question originate, even before the expiration of the protection periods established in Article 43 of this Law, if it is for scientific reasons or justified by a predominant public or private interest.

1. In the event of disputes related to the inspection of archived documents, Articles 52 to 56 of the present law shall apply.

1. The organization of the archives is regulated by special legislation.

2. All archives to which this law applies are subject to the supervision of the State Archives of Wallis, which may issue directives for this purpose.

**1. Consulted Third Parties**

The affected third parties shall be consulted if access to an official document or to personal data could counteract a prevailing private interest within the meaning of Article 15.

**2. Objection Process**

These parties may file a written objection, including in electronic form, against the disclosure of the document within 10 days following the consultation.

**3. Protection During Objection Proceedings**

During the objection proceedings, the authority shall not disclose the document or the personal data.

1. If an authority intends not to comply with a request based on this law, it must inform the affected individuals. At the same time, it must also notify them of the possibility of applying to initiate a mediation procedure with the commissioner.

1. ...

1bis In the event of disagreements arising from an application based on this law, the authority, the applicant, or the affected third party may request mediation from the appointed official. A brief written application with evidence must be submitted for this purpose.

2. ...

2bis The appointed official attempts to find a compromise between the interests asserted by the authority, the applicant, and the affected third party. The relevant authorities are obliged to cooperate in establishing the facts.

2ter The appointed official may conduct a mediation hearing. If one of the parties does not appear, the mediation is considered to have failed.

3. If a mediation is reached, the procedure is deemed concluded. If not, the appointed official provides the parties involved in the mediation process with a written recommendation within 10 days of the failure of the mediation.

4. The confidentiality of the procedure is guaranteed.

1. If mediation fails or the agreement reached is not adhered to, the authority, the applicant, the affected third party, or the representative can appeal to the Commission.

2. Before making a decision, the Commission grants them the right to a hearing.

1. Subject to contrary statutory provisions, access to official documents and personal data is free of charge.

2. A fee may be charged if responding to a request and/or mediation entails significant work or if a request is abusively renewed. The State Council determines the cases in which a fee may be charged and sets the tariff.

3. ...

4. The law regarding the tariff of costs and compensations before judicial or administrative authorities applies analogously.

1. Decisions of the Commission can be appealed to the Cantonal Court.

2. The appointee may lodge a complaint with all judicial authorities against any decision of the Commission or authority that applies the present law.

3. The procedure is further regulated in the Law on Administrative Procedure and Administrative Justice (VVRG).

4. A request for the recusal of the appointee or a member of the Commission is reviewed by the Cantonal Court. If the matter concerns the Cantonal Court, the Grand Council is responsible for reviewing the request for recusal. The Grand Council establishes the modalities.

1. This article governs the processing of personal data by authorities for the purpose of prevention, investigation, and prosecution of criminal offenses, or the execution of criminal penalties, including protection against and defense against threats to public security

a) within the framework of the application of the Schengen acquis;

b) within the framework of the application of international agreements concluded with the European Union or with states that are associated with Switzerland through one of the Schengen Association Agreements (Schengen States), which refer to Directive (EU) 2016/680 regarding data protection.

2. The data subject also has the right

a) to file an appeal with the Commissioner to have him conduct all necessary investigations or an examination in the following cases, if

1. the data processing controller postpones or restricts the provision of information according to Article 19a,

2. the data processing controller restricts or denies access according to Article 32,

3. the data processing controller refuses to correct or delete personal data, or to restrict processing according to Article 33;

b) to submit a direct complaint to the Cantonal Court against a decision pursuant to this law.

1. The State Council shall issue, by way of regulations, the provisions necessary for the implementation of this law.

1. All provisions conflicting with the present law are hereby repealed, in particular

a) the Act on the Protection of Personal Data of June 28, 1984;

b) Article 31 of the Cultural Promotion Act of November 15, 1996.

1. This Act is subject to an optional referendum.

2. The State Council shall determine the date of its entry into force.