General Implementing Ordinance of the Act on Reference Databases and on Register Harmonisation (OgBDR) - Purpose (AVGRDB)

1. This Regulation establishes the general implementing provisions for the GRDB.

1. This regulation governs

a) the structure, management, maintenance, dissemination, and archiving of the reference databases (hereinafter: RDB) as well as their lifecycle;

b) the roles of the coordination offices for administration and statistics, the data protection and public information officer (hereinafter: data protection officer), and the department responsible for information technology;

c) the rights and obligations related to the RDB, the holders of administrative registers, and the suppliers of source data;

d) the governance and control provisions with regard to access, maintenance, and use of the RDB as well as access to the data of the RDB;

e) the connections and modalities for shared data usage among the RDB;

f) the fees for accessing the data of the RDB;

g) the organization, operation, resource provision, and budget of the RDB competence center.

2. The content of each RDB is regulated in a specific ordinance.

1. This regulation applies to the Reference Database of Natural Persons (hereinafter RDB-NP), the Reference Database of Businesses and Companies (hereinafter RDB-BU), the Reference Database of Buildings and Dwellings (hereinafter RDB-GW), the source databases, and the administrative registers that constitute the RDB.

1. The definitions in accordance with Article 4 GRDB apply.

2. For the purposes of this regulation, the following terms are understood to mean

a) Group Access: Access that defines the scope and prerequisites for the access of an organizational unit or a consuming entity to an RDB;

b) Individual User Access: Access that establishes the individual access rights of an employee of a unit that has group access;

c) Administrator Access: Access that determines the scope of access and access rights of an administrator for an RDB for a unit with group access;

d) User: a natural person with individual access or administrator access rights;

e) Supplementary Data: additional data that are absolutely necessary for administrative or statistical data collection;

f) Registry Holder: a person responsible for processing the data of a specific registry, ensuring its completeness, currency, and the quality of the data contained;

g) Logging: a record that captures the visibility, traceability, and timing of an event.

1. This Regulation establishes the foundation for the RDB Competence Center (hereinafter: KRDB) in accordance with Article 8 GRDB.

2. The State Council appoints the members of the KRDB Directorate Board, which shall comprise at least representatives from various administrative coordination bodies. Among the board members, it designates the President.

3. The KRDB utilizes the resources delegated by the service departments.

4. The KRDB sets the individual objectives jointly with the service department to which it is administratively affiliated, and evaluates their realization.

5. The KRDB organizes itself independently. It meets at least twice a year with representatives from the producing bodies, representatives from the statistical coordination bodies, and the representative from the IT department. Whenever an agenda item pertaining to the management of the data life cycle is on the agenda, the State Archivist attends the meeting by virtue of their position.

6. The KRDB prepares a budget, establishes monitoring, and drafts an annual report on the tasks entrusted to it.

1. The KRDB has the following duties

a) to ensure the establishment, implementation, and maintenance of procedures for access to the RDB;

b) to oversee the management of data by the coordination offices for administration or statistics;

c) to receive requests for information regarding the RDB and coordinate their responses;

d) to coordinate and supervise the links between the RDB;

e) to take on the management of projects related to the RDB;

f) to ensure the forwarding of applications for group access to the data protection officer;

g) to guarantee that group access is made available to the data protection officer annually;

h) to ensure that the administration coordination offices keep the access list up to date;

i) to ensure budget management and control;

j) to monitor the collection of fees related to the RDB;

k) to coordinate tasks performed by resources delegated to it and participate in the annual assessment;

l) to ensure compliant management of the data lifecycle.

1. The scope of the information contained in the RDB is determined in the GRDB.

2. The typology of the information contained in the RDB is specified in the specific regulations.

3. The State Council may prescribe the collection of additional data pursuant to Article 7, paragraph 2, and Article 10, paragraph 4, of the GRDB by providing for them in specific regulations. Authorities are obligated to transmit the additional data to the RDB.

4. The information regarding access and its logging forms an integral part of the RDB data.

1. The producing entities systematically forward the updates of their data to the RDB via an appropriate interface.

2. The holders of registers and source databases are responsible for the accuracy, completeness, and timeliness of their data. If updates are not possible, they must promptly inform the Coordinating Office for Administration.

3. The Coordinating Office for Administration ensures the receipt of data transmitted from source databases, their duration, their currency, and their compliance with regard to the RDB.

4. The department responsible for information technology ensures the technical and security compliance of the data entry.

1. Source databases can have the status "active" or "passive."

2. They are active if the transmission of data to the RDB is approved, and passive if the transmission of data to the RDB is rejected.

3. The active source databases are listed in the specific regulations.

4. The Coordination Office Administration maintains an updated directory for each RDB of the active source databases, the holder(s) of the linked registers, as well as the typologies and scope of the data used.

1. The active source databases transmit updates to their data according to Article 8 at least weekly.

2. Otherwise, the information technology office reports this to the relevant register holder and informs the administrative coordination office.

**1. The State Council establishes the conditions for the approval of applications and the deadlines for remedial actions. It specifies in the implementing regulations which applications must be certified.**

**2. The KRDB may require registry holders to have their applications certified if the regularity or quality of the transmissions does not meet the expected standards.**

**3. The office responsible for information technology is accountable for the certification of applications. It sets the technological and security standards for the delivery of source data.**

**4. Providers of IT solutions for source data may apply for the approval of their solution, provided they meet the established requirements.**

1. The application for retroactive activation of a source database is submitted to the department head by the Coordination Office, with the KRDB and the Data Protection Officer providing their preliminary opinions.

2. The activation application includes

a) the scope of the transmitted data;

b) the mode of transmission;

c) the data transmission procedures;

d) proof that the additional source database is necessary for the operation of the RDB.

3. Before commissioning, the activation of a source database must undergo a technical and security compliance review.

4. In the event of approval, the KRDB and the Data Protection Officer are informed about the activated source database.

1. Access to the data is granted to

a) the units;

b) the users.

2. Every access request must contain a substantiated and documented proof provided by an organizational unit or consuming entity.

3. An updated list of accesses and specific access requests for each RDB shall be made available to the KRDB.

4. Users will be informed about the logging of their accesses.

5. Granted access also permits access to the source databases of the respective RDB according to the conditions set forth in the authorization.

1. The application for group access to a RDB and the data includes

a) the scope;

b) the duration;

c) the type(s) of access;

d) the third-party application which the entity wishes to connect, the logging mode, and the tracking mode;

e) the legal basis permitting an entity to gain access;

f) the proof within the meaning of Article 12, paragraph 2.

2. The application for group access is submitted to the coordination office administration of the respective RDB.

3. The approval for group access is granted by the head of the department responsible for the respective coordination office administration and comes into effect within 20 days, unless there is a negative preliminary opinion from the data protection officer. In the event of differing opinions, the Council of State decides.

1. The application for individual user access to an RDB and the data within the framework of an approved group access includes

a) the scope;

b) the duration;

c) the type(s) of access;

d) the identity of the employee;

e) evidence as per Article 12, paragraph 2.

2. The application for individual user access is submitted to the coordinating office of the administration of the respective RDB.

3. The coordinating office of the administration grants approvals for individual user access.

1. The application for an administrator access to an RDB and the data within the framework of an approved group access includes

a) the scope;

b) the duration;

c) the type(s) of access and the extended rights;

d) the identity of the employee;

e) the proof pursuant to Article 12, paragraph 2.

2. The application for administrator access is submitted to the administrative coordination office of the respective RDB.

3. The authorization for administrator access is granted by the head of the department responsible for the respective administrative coordination office.

1. The office responsible for information technology provides the list of approved accesses and the access log annually.

2. The administrative coordination office conducts the annual review of the approved accesses and the access log.

3. The list of group accesses is made available annually to the data protection officer for potential review.

1. Authorizations for group access shall be revoked or modified as soon as the conditions justifying the access are no longer present or in the event of misuse.

2. The consuming entity holding an access authorization must immediately report any event questioning its authorization for group access to the relevant coordination office.

3. The consuming entity must report to the coordination office as soon as possible if the conditions for individual user access have changed or no longer exist.

1. Once individual user access or administrator access is granted, the employee becomes an authorized user.

2. The user agrees to access RDB data solely within the scope of performing their duties.

3. The user is personally liable for any use of RDB data beyond fulfilling their duties. This is without prejudice to the provisions of the Law on the Personnel of the State of Valais and all other applicable cantonal or federal regulations.

1. The unit responsible for statistics shall have access to all databases for statistical purposes.

2. The authorized persons responsible for cantonal statistics shall be granted individual user access to the databases, provided it is necessary for the performance of their duties.

3. The unit responsible for statistics may compare data, provided they anonymize it.

1. The retrieval of data from the RDB by the user is conducted through a secure tool that can manage permissions and access rights.

2. The department responsible for information technology provides a query tool, ensures its operation, and guarantees compliance with the technological and security standards of the tool.

3. The department responsible for information technology ensures the logging of access to the RDB application.

1. Third-party applications may connect to an RDB according to the scope specified in the group access authorization.

2. The third-party application must comply with the logging and security requirements developed for the specific RDB.

3. The department responsible for information technology determines the modalities for connections between third-party applications and the RDB.

4. The updating of data for the third-party application can be carried out via

a) subscribing to RDB notifications;

b) replicating the data in an internal database within the third-party application;

c) real-time querying of RDB data without storing these data.

5. The consuming entity ensures that the third-party application authorized as part of its group access always meets the requirements of paragraph 2, and must promptly notify the Coordination Office Administration in the event of non-compliance.

6. If the third-party application no longer meets the logging and security requirements, the connection to the RDB will be immediately terminated, and the group access authorization will be amended.

7. The department responsible for information technology maintains a register of third-party applications with access to the RDB, in which it specifies the connection modalities.

1. The department responsible for information technology assigns each user a unique username, which is associated with their rights and permissions.

2. The data for individual user or administrator access is personal and cannot be assigned or transferred.

3. The usernames and associated rights and permissions are retained in accordance with the provisions issued by the function responsible for information security of the State of Wallis.

4. The coordination office administration manages the administrative handling of the usernames of the users of the relevant RDB.

1. The data from an RDB may be shared with another RDB according to the modalities established in Article 29 GRDB.

2. The creation and commissioning of a new link between the RDBs are approved by the Data Protection Officer, after the Coordination Agency Administration submits an application validated by the head of the department responsible for the Coordination Agencies Administration, and the KRDB has provided a preliminary opinion.

3. The application for creating a link includes

a) the specification of the RDBs to be linked;

b) the reconciliation mode;

c) the technical specifications of the link;

d) the operational control and security procedures that ensure the segmentation of the information.

4. The newly approved link shall be communicated to the KRDB.

1. Users are permitted to download files containing RDB data necessary for the completion of their tasks, provided they have been granted download rights.

2. The use of the downloaded data is exclusively reserved for the user for the fulfillment of the tasks assigned to them.

3. Users shall ensure to exercise special care in the use of the transmitted data and guarantee the security and confidentiality of the data.

1. When discrepancies are identified during the inspection and review of the updates to the source databases transmitted to the relevant RDB, they must, if possible, be addressed by the source database in the shortest possible time. The update of the source database register as a result of a change in the RDB data must be approved by the holder of this register.

2. Users who identify errors and/or discrepancies in the data shall inform the Coordination Office Administration of these issues, if possible.

3. The Coordination Office Administration analyzes, communicates, and monitors the corrections of the identified errors and/or discrepancies.

1. The Administrative Coordination Units assume the following responsibilities for the relevant RDB

a) Participation in the KRDB;

b) Verification of data delivery by the register holders;

c) Data maintenance, i.e., concerning the quality and timeliness of the data;

d) Analysis, dissemination, and verification of data corrections;

e) Receipt and processing of access requests;

f) Granting of authorizations for individual user access;

g) Annual review of authorized accesses and access logs or of the administrator;

h) Monitoring changes to or revocation of group, individual user, or administrator access;

i) Administrative management of user usernames;

j) Maintenance of an updated directory of active source databases, the holder(s) of the linked registers, as well as the typologies and scope of the data used for each RDB;

k) Forwarding of a request for subsequent activation of a source database to the head of the department;

l) Processing of information requests for the relevant part;

m) Correction of incorrect data in an RDB upon request.

1. The Coordination Offices for Statistics are the cantonal points of contact for the Federal Statistical Office concerning the relevant RDB.

2. They guarantee

a) the coordination of the delivery of statistical data to the Federal Statistical Office;

b) the communication of identified errors to the register holder, provided that this information is not transmitted by the Federal Statistical Office.

1. The department responsible for information technology is responsible for

a) ensuring the functionality and technical security of the RDB,

b) determining the technical requirements for data connection and transmission in coordination with the information security function;

c) providing the list of approved accesses and the access log annually;

d) providing the query tool;

e) ensuring the operation and compliance with technological and security standards of the query tool;

f) ensuring the logging of accesses to the RDB application;

g) establishing the modalities for connections between third-party applications and the RDB;

h) maintaining a register of third-party applications with access to the RDB and specifying the connection modalities;

i) assigning each user a unique username, linked to their rights and permissions;

j) ensuring the technical and security conformity of data entry;

k) ensuring data storage in accordance with best practices applicable to IT;

l) supporting the coordination office administration in the execution of its tasks.

1. Within the framework of this regulation, the Data Protection Officer has the following tasks and responsibilities

a) To issue preliminary opinions, in which they examine the application of the provisions on data protection and the principle of public access;

b) To issue orders, in which they examine the application of the provisions on data protection and the principle of public access;

c) To verify the application of the provisions on data protection and the principle of public access upon request.

2. Furthermore, reference is made to the provisions on data protection.

1. Any person may submit a request for access to files concerning them and view the related data.

2. The request for access is limited to the scope of a single RDB.

3. The request for access is addressed to the Administrative Coordination Office.

4. Requests for access are processed within the statutory time limits.

5. The response to a request for access may be restricted in accordance with data protection law.

1. Any person whose data is recorded in an RDB may request the Coordination Office Administration to correct any inaccurate data.

2. The Coordination Office Administration shall inform the person about the corrections made.

1. The deletion of outdated data from the RDB, as well as access data, shall occur at least once a year, with an appropriate protocol being created.

2. Data that is matched or enables the creation of personality profiles in the context of statistical tasks shall be deleted after the completion of the evaluation work.

1. The amount of fees to be charged by the KRDB for querying the RDB data is determined by analogous application of the GTar as well as according to the volume of data transmitted.

2. The basic fee is to be set in accordance with Article 23 GTar.

3. An additional fee of between 2 and 5 cents is charged per individual file transmitted.

1. The penalty provided for in Article 31 GRDB is imposed by the State Council.

2. Sanctions pursuant to other legal provisions remain reserved.

1. The procedure shall be subject to any special provisions in accordance with the Act on Administrative Procedures and Administrative Jurisdiction.

1. Upon its entry into force, this implementing regulation supersedes the provisions that are repealed by it and are referenced in the applicable legislation.

2. From the entry into force of this regulation, the authorities are granted a two-year period to comply with the provisions of the regulations concerning the GRDB. The State Council may extend this period annually. [1]