Ordinance on the Digital Services of Public Authorities (OSNA) - Purpose (VDDB)

1. This Regulation aims to clarify and supplement the provisions of the Law on Digital Services of Public Authorities (LDSPA).

1. The State Council can, by way of resolution, extend the scope of the GDDB to natural or legal persons and organizations entrusted with the fulfillment of cantonal or communal public-law tasks—within the framework of fulfilling these tasks—and to associations of authorities, if

a) a demonstrable interest for the canton, particularly in an economic sense, justifies this, or

b) the affected entities request this.

1. In this Regulation, the following terms mean

a) Deployment: The entirety of necessary processes for a software application or system to be introduced into the intended operational environment; these processes include installation, configuration, testing, and modifications;

b) Cyberattack: An intentionally caused event occurring during the use of information technology resources, which may lead to a compromise in the confidentiality, availability, or integrity of information, or the traceability of their processing.

1. The organizational unit responsible for digital administration is the office responsible for digital administration (hereinafter: the DDO).

2. The organizational unit responsible for the operation and hosting of base services and cantonal digital services is the office responsible for information technology (hereinafter: the ITO).

1. When a cantonal digital service is directed at specific users, it may, in exceptional cases

a) only be provided with the help of special technologies;

b) only be provided along with technical information; or

c) only be available in one official language.

2. As far as possible, the special needs of certain categories of persons (such as persons with disabilities, elderly persons, or persons with a migration background) are taken into account. The national and international IT standards governing the accessibility of websites are guaranteed.

3. As far as possible, the information and assistance directed to users by cantonal authorities are clearly and simply formulated.

1. When designing project initiatives for cantonal digital services, the solutions chosen in other cantons or by the federal government shall be reviewed. These solutions must meet the standards and norms aimed for in Article 11.

1. The introduction of digital services will be addressed in the general process of transmission and processing of requests in accordance with the procedures set out in Article 13. The introduction date will be communicated to the requesting authority in the sense of Article 13, paragraph 1, after consultation with the affected entities.

2. The KDI may require the requesting authority, as referred to in Article 13, paragraph 1, to provide proof that certain technical regulations specified in Article 11, paragraph 3, have been complied with. The powers of the cantonal data protection and public information officer remain reserved.

3. The KDI determines the procedures for the introduction. The requesting authority in the sense of Article 13, paragraph 1, participates in the process free of charge.

1. The authority providing the service shall determine the point in time from which the use of a digital service provided by it becomes mandatory.

2. It is responsible for determining the exceptions to the use of the digital services it provides within the meaning of Article 7(2) GDDB.

1. Users benefit from free support.

2. This support is ensured by

a) the KDI for the basic services;

b) the authorities for the digital services they provide.

1. The authority providing open source software selects the appropriate license.

2. If an authority provides supplementary services pursuant to Article 10, paragraph 3 of the GDDB, it may charge the recipient a fee calculated based on the actual costs.

1. The standards and norms established by the strategic management committee are generally published.

2. The publication may refer to norms or standards from third parties.

3. The KDI establishes the technical rules that a digital service distributed over its infrastructure must comply with. It informs the strategic management committee accordingly.

1. Promotion of the Use of Digital Services May Specifically Include

a) Information measures;

b) Highlighting digital services at the physical counter.

1. Authorities submit a request when they wish to utilize one of the following three services

a) Provision of digital services on the canton’s IT infrastructure according to Article 7 paragraph 1 letter c GDDB;

b) Inclusion of a project in the implementation plan according to Article 11 paragraph 1 letter c GDDB;

c) Receipt of ICT resources or associated services according to Article 9 paragraph 1 GDDB.

2. They are forwarded for further processing

a) to the responsible IT coordinator if this concerns cantonal authorities, or

b) to the DDV for all other authorities.

3. Applications for the financial aid envisaged by Article 25 paragraph 1 GDDB must also be submitted to the DDV, which will then process the applications.

4. The DDV provides a tool that facilitates the submission of applications mentioned under paragraphs 2 letter b and 3.

1. The Strategic Steering Committee (hereinafter: the Committee) adopts its internal operating regulations, which outline, among other things, how decisions are made and communicated.

2. The head of the department responsible for digital administration is one of the three cantonal representatives referred to in Article 12, paragraph 2, letter a of the GDDB. He chairs the Committee.

3. The head of the DDV department participates in the meetings of the Committee in an advisory capacity.

1. The KDI hosts, operates and maintains the basic services and the cantonal digital services. It may delegate these tasks.

2. The KDI may also host, operate, and maintain digital services of other authorities if they request it. In such cases, an agreement will be concluded with the requesting authority outlining the fees and service level.

3. Each authority is responsible for hosting, operating, and maintaining its IT infrastructure.

4. The KDI documents and informs the affected organizations in advance about planned maintenance activities on the basic services.

5. If required for system or information security, the KDI may carry out any maintenance work on its infrastructure without prior notice.

6. The KDI may block access to a digital service without prior warning or explanation, particularly if it finds upon introduction that the security of the systems or information is at risk.

1. The Strategy on Digital Services of Authorities (hereinafter referred to as: the Strategy) aims to motivate users to primarily utilize the digital channel in their interactions with authorities. It includes, among other things, a vision, principles, strategic goals, operational focal points, and an implementation concept.

2. Every 2 years, the Committee prepares a report for the State Council, evaluating the Strategy. If necessary, the report may include proposals for amendments or a draft for a new Strategy.

3. The State Council approves the Committee's proposals by resolution.

1. The Implementation Plan is the instrument through which the strategy is concretized.

2. The plan records the projects that

a) contribute to achieving the goals or the operational focuses of the strategy, and

b) require personnel or financial resources from the canton.

3. The committee updates the Implementation Plan annually, taking into account the anticipated progress of the projects over a period of 4 years. The State Council approves the updated Implementation Plan by resolution.

1. Applications for the inclusion of a project in the implementation plan shall comply with the provisions of Article 13 and include at least a description of

a) the purpose;

b) the project deliverables;

c) the relevance to the objectives or to the operational focuses of the strategy;

d) the responsible organizational unit.

2. The priority of the selected projects is determined, in order of importance, by

a) the strategic alignment: The application is essential for the application of a legal basis, a decision of the State Council, or a strategy;

b) the benefit for the users: The application corresponds to a demonstrable need and allows for the simplification of interactions with the authority;

c) the business benefit: The application enables the expansion of the service offering, improvement of efficiency (cost reduction), quality, and processing time;

d) the impacts: The application affects the processes related to the provision of the service and the organization of work.

3. As a general rule, the project manager provides the information required for project control on a quarterly basis, in particular an assessment of compliance with deadlines, costs, goals, and risks concerning personnel, project scope, and regulatory developments.

1. Within the scope of its availability, the canton supports other authorities in matters of cybersecurity, specifically by

a) providing best practices;

b) participating in crisis management and in the development of a recovery strategy in the event of a cyberattack.

2. For compensation, it may also

a) offer specialized awareness measures or training;

b) promote the acquisition of labels and certifications.

1. Authorities shall report to the cantonal police any cyberattack that

a) jeopardizes the operation of digital services;

b) has resulted in manipulation or an information leak;

c) has remained undetected over an extended period, particularly if there are indications that the attack was carried out to prepare for further cyberattacks, or

d) is accompanied by extortion, threats, or coercion.

2. Upon reporting a cyberattack, the KDI, depending on its availability, shall assist the affected authority in managing the incident.

3. The report must be made immediately upon the discovery of the cyberattack and must include the following information

a) the authority affected by the cyberattack;

b) the nature of the cyberattack;

c) the effects of the cyberattack;

d) the measures taken and/or planned in response.

4. If the information listed under paragraph 3 cannot be provided at the time of reporting, the authority shall transmit it to the KDI as soon as it becomes known.

5. A report made pursuant to this article may only be used in criminal proceedings against the person obligated to report with their consent.

1. Users are informed upon their first login to the portal provided for in Article 6(3)(a) GDDB that their personal data will be used for the operation of the basic services.

2. Furthermore, when applying for a digital service, they are informed about which categories of personal data will be used for processing the application. The authority providing the digital service is responsible for the information provided.

**1. Personal Data Usage for Digital Services**

The personal data of users employed in digital services shall be retained only as long as necessary for the purposes for which they are processed. The following principles apply

a) Data related to account ownership and account access is retained as long as the account is active. If an account is deleted, the data is retained for a maximum of three months post-deletion;

b) Data associated with digital services is generally stored on the portal for 18 months. It is the responsibility of the users to secure these data on their private devices or storage if they wish to retain them longer;

c) Logging data is retained according to Article 30, paragraph 2 of the Implementing Regulation on the Law on Public Information, Data Protection, and Archiving (ARGIDA) for one year.

1. Authorities generally publish public government data on the national platform opendata.swiss, in a format that complies with national and international standards of the respective field.

2. Publication on another platform is also possible if the authority deems it appropriate.

1. The following documents are published on the official website of the canton

a) the strategy on the digital services of the authorities;

b) the implementation plan;

c) the norms and standards mentioned in Article 11, paragraph 1;

d) the open source codes.

1. The measures provided for in Article 22 Paragraph 1 GDDB may involve subsidies, consultancy or study mandates, financial aid for innovative projects, support for awareness and training, or even partnerships.

2. Depending on the type of measures, a public-law contract or a service contract is concluded.

1. The hourly rates are determined by the authority providing the service, proceeding according to the cost recovery principle and taking into account the customary hourly rates in the respective industry.

1. In the allocation of financing for joint services pursuant to Article 24(2) of the GDDB, consideration shall be given to the extent to which each of the authorities can reasonably assume a share.

1. Financial assistance as outlined under GDDB is available for the planning, development, and implementation of measures that implement at least one of the operational priorities of the strategy.

2. The amount of financial assistance is determined by the benefit and impact of the measure. The support must fundamentally be subsidiary. They are determined by the head of the department responsible for digital administration.

3. There is no entitlement to financial assistance.

4. Beneficiaries must be able to demonstrate the use of the granted assistance. The assistance may be reclaimed in whole or in part if it was granted based on false information or not used for the originally specified purposes.