Law on Information and Data Protection (LIDP) (IDG)

1 This Act governs the handling of information by public bodies.

Subject Matter

and Purpose

2 It aims to

a. make the actions of public bodies transparent, thereby promoting

the free formation of opinion and the exercise of democratic rights,

and facilitating the control of state actions;

b. protect the fundamental rights of individuals whose data is processed

by public bodies.

28 This Act applies to public bodies.

Scope of Application

gungsbehörden in accordance with § 86 para. 1 lit. b and c of the Law on Criminal Prosecution-

Court and Authority Organization in Civil and Criminal Procedure of May 10, 201012, the rights of affected persons and the

rights of access of third parties are governed by special legal provisions.

2 This Law applies to the processing of personal data, unless

special laws contain no provisions.

1.7.24 - 125

1

170.4 Law on Information and Data Protection (IDP)

3 Insofar as the courts are subject to this Law, the Data Protection Officer shall not have the powers according to § 10

para. 2, § 12a para. 1 and 2, § 34 lit. c, d and f, as well as §§ 35–36a.

c. Participation in

27 1 This law does not apply to the relationship between the Exceptions

Cantonal Council and its standing committees, as well as the authorities a. Cantonal Council

and institutions subject to its supreme supervision.

2 To the extent that the Cantonal Council is subject to this law, the Data

Protection Officer does not have the powers according to § 10

para. 2, § 12a para. 1 and 2, § 34 lit. c, d and f, as well as §§ 35–36a.

27 1 This Law does not apply where public bodies participate in

economic economic competition and do not act in a sovereign capacity.

Competition

2 For the processing of personal data, the Federal Act on

Data Protection17 applies mutatis mutandis. Supervision is exercised by the

Data Protection Commissioner in accordance with §§ 30 et seq.

Definitions

28

1 Public bodies are

a. the Cantonal Council, the municipal parliaments, and the municipal assemblies;

b. authorities and administrative units of the canton and the municipalities;

c. organisations and individuals governed by public and private law, insofar as they are entrusted with the performance of public tasks.

2 Information comprises all records relating to the performance of a public task, regardless of their form of presentation and their data carrier. Excluded are records that are not finalised or that are exclusively intended for personal use.

3 Personal data is information relating to an identified or identifiable person.

4 Special categories of personal data are

a. information where, due to its significance, the nature of its processing, or the possibility of its linkage with other information, there is a particular risk of a violation of personality rights, such as information about

1. religious, philosophical, political, or trade union views or activities,

2. health, the intimate sphere, ethnic origin, as well as genetic and biometric data,

3. measures of social assistance,

4. administrative or criminal prosecutions or sanctions.

b. compilations of information that permit an assessment of significant aspects of the personality of natural persons.

Act on Information and Data Protection (IDG)

170.4

c. automated evaluations of information to analyse significant personal characteristics or to predict personal developments (profiling).

5 Processing means any handling of information, such as procuring, storing, using, modifying, disclosing, or destroying.

6 Disclosure means making information accessible, such as granting access, transmitting, or publishing.

II. Principles for Handling Information

1. In General

The public body shapes its handling of information in such a way that it can provide information rapidly, comprehensively, and factually.

Transparency principle

1 The public body shall manage its information in such a way that its

administrative actions are comprehensible and accountability is

ensured. If several public bodies process a common information

holding, they shall regulate the responsibilities.

2 If the public body no longer requires information and finding aids

for its administrative actions, it shall store them for a maximum of

ten years.

3 After the expiry of the retention period, the public body shall offer

the information and finding aids to the competent archive. Information

that is not archived must be destroyed.

4 For the cantonal administration, the Government Council shall

regulate the details in an ordinance.

1. **Processing of Information by Third Parties**

Public bodies may outsource the processing of information to third parties, provided there is no legal provision or contractual agreement to the contrary.

2. It remains responsible for the handling of information in accordance with this Act.

1 The public body protects information through appropriate organizational and technical measures.

information security

1.7.24 - 125

3

170.4

Law on Information and Data Protection (LIDP)

2 The measures are based on the following protection goals

a. Information must not be unlawfully accessed,

b. Information must be accurate and complete,

c. Information must be available when needed,

d. Information processing must be attributable to a person,

e. Changes to information must be recognizable and traceable.

3 The measures to be taken depend on the nature of the information, the type and purpose of its use, and the respective state of the art.

2. Special Principles for Handling Personal Data

Legality

Purpose Limitation

1 A public body may process personal data to the extent that it is suitable and necessary for the fulfillment of its legally defined tasks.

2 The processing of special categories of personal data requires a sufficiently specific regulation in a formal law.

1 Public bodies may process personal data only for the purpose for

which they were collected, unless a legal provision expressly provides

for further use or the data subject consents in individual cases.

2 Public bodies may process personal data for a non-personal

purpose if they are anonymized and the evaluations do not allow any

conclusions to be drawn about the data subjects.

Data Protection

Impact

Assessment

and Prior

Consultation

Avoidance of

Personal Reference

**28 1 Data Protection Impact Assessment**

When planning to process personal data, the public body assesses the risks this processing poses to the fundamental rights of the data subjects (data protection impact assessment).

**2 Advance Consultation**

Before processing personal data that entails particular risks for the fundamental rights of data subjects, the public body submits the planned processing to the Data Protection Officer for review (advance consultation).

1 Public bodies shall design data processing systems and programmes in such a way that as few personal data as possible are collected that are not necessary for the performance of their tasks.

2 They shall delete, anonymise or pseudonymise such personal data as soon as and to the extent possible.

4

Law on Information and Data Protection (IDG)

170.4

28 1 The public body shall inform the data subjects about the collection

of personal data. This also applies to the collection from third parties.

2 The information shall include details regarding

a. the responsible public body,

b. the collected data or categories thereof,

c. the legal basis and purpose of processing,

d. the data recipients or categories of data recipients, if the data are

disclosed to third parties,

e. the rights of the data subject.

3 The duty to inform shall not apply

a. if the data subject already has the information according to paragraph 2,

b. if the collection of personal data is provided for by law,

c. if providing the information is not possible or would require

disproportionate effort,

d. in the cases according to § 23.

**27 Reporting Obligation**

1 The responsible public body shall promptly report to the Data Protection Officer any unauthorized processing or loss of personal data if the fundamental rights of the data subject are jeopardized.

2 It shall inform the data subject if circumstances require it or if the Data Protection Officer demands it.

3 It may restrict the information provided to the data subject, in whole or in part, if a preponderant public or private interest so requires.

28 1 The public body ensures compliance with data protection data protection

regulations, in particular through organizational provisions. compliance

and quality

2 To ensure the quality of information processing, it can have assurance

its procedures, organization, and technical facilities reviewed and

assessed by an independent and recognized body.

3 The Government Council regulates the details in an ordinance.

1.7.24 - 125

5

170.4 Act on Information and Data Protection (IDG)

III. Disclosure of Information

Information

activities ex

officio

Media

Disclosure

of personal

data

a. General

b. Special

personal data

1 The public body shall on its own initiative provide information on its activities of general interest.

2 It shall make information available on its structure, responsibilities, and contact persons.

3 The public body may only provide information on pending proceedings if this is necessary to correct or prevent false reports, or if immediate information is indicated in a particularly serious or sensational case.

4 It shall make a directory of its information holdings and their purposes publicly accessible. It shall identify information holdings that contain personal data.

1. Public bodies shall, as far as possible, consider the needs of the media in their information activities.

2. They may provide for the accreditation of media professionals.

1. Public bodies disclose personal data if

a. a legal provision authorizes it;

b. the data subject has consented in the individual case; or

c. in the individual case, it is indispensable for averting an imminent danger to life and limb, or the necessary protection of other essential legal interests outweighs the interest in non-disclosure.

2. Personal data may also be disclosed to another public body, as well as to bodies of other cantons or the Confederation, in an individual case, if the body requesting the personal data requires them for the performance of its statutory duties.

1. Public bodies may disclose special categories of personal data if

a. a sufficiently specific provision in a formal law authorizes such disclosure;

b. the data subject has expressly consented in the individual case to the disclosure of special categories of personal data; or

c. in the individual case, it is indispensable for averting an imminent threat to life and limb, or the necessary protection of other essential legal interests outweighs other considerations.

2. It may also disclose special categories of personal data in individual cases to another public body, or to the bodies of other cantons or the Confederation, if the body requesting the special categories of personal data requires them for the fulfilment of its statutory duties.

Law on Information and Data Protection (IDG)

170.4

1 The public body may disclose personal data for processing for non-personal purposes, provided this is not excluded by a legal provision.

2 The recipient must demonstrate that the personal data will be anonymized, that no conclusions can be drawn about affected persons from the evaluations, and that the original personal data will be destroyed after the evaluation.

To recipients who are not subject to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, the public body may disclose personal data if

a. an adequate level of data protection for the data transfer is ensured in the recipient state,

b. a legal basis permits this to protect certain interests of the data subject or predominant public interests, or

c. adequate contractual safeguards are put in place by the public body.

IV. Right of Access to Information and Other Legal Claims

1 Every person has the right of access to information held by a public body.

2 Every person has the right of access to their own personal data.

3 In administrative and administrative justice proceedings that have not been finally concluded, the right of access to information is governed by the applicable procedural law.

Information

1 The data subject may demand from the public body that it

a. corrects or destroys inaccurate personal data,

b. refrains from unlawfully processing personal data,

c. eliminates the consequences of unlawful processing,

d. establishes the unlawfulness of the processing.

2 If the correction or destruction of personal data is demanded and neither

their accuracy nor inaccuracy can be established, the public body shall

add a note indicating that the personal data are disputed. It shall restrict

the processing.

Protection of own

personal data

1.7.24 - 125

7

170.4 Act on Information and Data Protection (IDG)

Blocking of

personal data

1 The data subject may block the disclosure of their personal data to private parties if the public body is authorised to disclose personal data without any prerequisites based on a specific legal provision.

2 The public body shall disclose personal data despite a block if the applicant proves that the block prevents them from asserting their own rights against the data subject.

Balancing of Interests

V. Restrictions in Individual Cases

1 The public body refuses disclosure of information, in whole or in

part, or postpones it, if a legal provision or an overriding public

or private interest so requires.

2 A public interest exists, in particular, if

a. the information concerns positions in contract negotiations,

b. the disclosure of the information impairs the decision-making process

of the public body,

c. the disclosure of the information jeopardizes the effectiveness of

investigation, security, or supervisory measures,

d. the disclosure of the information impairs relations among the

municipalities, with another canton, with the Confederation, or with

foreign countries,

e. the disclosure impairs the targeted implementation of specific

official measures.

3 A private interest exists, in particular, if the disclosure of the

information infringes upon the privacy of third parties.

Application

VI. Procedure for Access to Information

1 Anyone wishing to access information pursuant to § 20 para. 1 shall submit a written request.

2 Upon oral inquiries, the public body may provide information orally.

8

Act on Information and Data Protection (IDG) 170.4

1 The public body may refuse a request if its examination of the

request refers to information that is already public and made available

in an appropriate manner. In such a case, the source must be specified.

2 If processing the request causes the public body disproportionate

effort, it may make access to the information conditional on the requesting

person demonstrating a legitimate interest.

1 If the public body intends to grant access to information, and the request concerns personal data or information classified as confidential, the public body shall give the affected third parties an opportunity to comment within a reasonable period.

2 If the request concerns special categories of personal data, the public body shall refuse the request if the affected third parties do not expressly consent to the access.

**1 The public body issues a decision if it wants to refuse, restrict, or postpone access to the desired information.**

**2 If it intends to grant access to information against the will of third parties, it shall notify the affected third parties by means of a decision.**

1 Within 30 days of receiving the request, the public body shall grant access to the information or issue a decision concerning the restriction of the right of access.

2 If the public body is unable to meet this deadline, it shall inform the requesting person before its expiry, stating the reasons and indicating when the decision on the request will be available.

**29 Fees and Charges**

1 The public body generally does not charge a fee for processing requests from private individuals.

2 If the processing of the request involves considerable effort and this bears no reasonable relation to the public interest, the public body may impose an appropriate fee on the requesting person. It shall inform the requesting person of the amount of the fee in advance, stating the reasons.

3 If information is suitable for commercial use, a charge based on market rates may be levied.

1.7.24 - 125

9

---

170.4 Law on Information and Data Protection (IDG)

VII. Data Protection Officer

Position and Remuneration

Personnel

Budget Management, Controlling and Accounting

Officers in Municipalities and Organisations

**30 1 The Cantonal Council elects a Data Protection Officer for a term of four years.**

2 The salary of the Data Protection Officer corresponds to the maximum amount of salary class 27 for cantonal employees.

3 The Data Protection Officer is independent. Administratively, they are assigned to the Cantonal Council's Executive Board.

4 The Cantonal Council may remove the Data Protection Officer from office before the end of their term for serious breaches of official duties or professional inadequacy, upon application by its Executive Board. A two-thirds majority of the members of the Cantonal Council is required for this decision.

4 1 The personnel law of the Canton applies to the Commissioner

and their staff. The provisions of this Act remain reserved.

2 The Commissioner is responsible for the hiring and promotion

of their staff within the framework of the budget approved by the Cantonal Council.

3...24

19 1 The delegate is subject to the Act on Controlling and Accounting (CRG)13 and the executive decrees of the Government Council pertaining to this Act.

2 He or she is equivalent to the Government Council with regard to expenditure authorities. §§ 19–25 CRG13 apply mutatis mutandis.

3 The delegate maintains separate accounts. He or she annually submits to the Cantonal Council an overview of the development of services and finances, a budget draft, and the accounts.

**4 1** The municipalities and the organisations in accordance with Section 3 may appoint their own data protection officers. The Government Council may obligate municipalities and organisations with at least 50,000 inhabitants to do so.

**2** The municipalities and the organisations in accordance with Section 3 shall regulate the election and organisation independently. They shall ensure that the data protection officers possess the necessary professional qualifications and are independent in the exercise of their duties and powers. The cantonal data protection officer shall exercise supervisory authority.

**10**

Law on Information and Data Protection (IDG)

The Commissioner

a. supports and advises public bodies on data protection matters,

b. advises private individuals on their rights,

c. monitors the application of data protection regulations,

d. mediates between data subjects and public bodies in disputes concerning data protection,

e. informs the public about data protection issues,

f. assesses enactments and projects that concern data protection,

g. offers training and further education on data protection matters.

1. The Commissioner may, with public bodies, supervisory powers

and with mandated third parties pursuant to § 6, irrespective of any confidentiality obligation, obtain information about the processing of data, inspect the data, and have processing demonstrated to them, insofar as it is necessary for their activity.

2. The public bodies and the mandated third parties shall cooperate in establishing the facts.

**28 1 Recommendations**

If the Commissioner identifies a violation of data protection provisions, he or she shall make a recommendation to the public body as to which measures should be taken.

2 If the public body does not follow a recommendation, it shall inform the Data Protection Commissioner of this, stating the reasons.

27 1 If the public body does not follow a recommendation in the event of a significant breach of data protection provisions, the Commissioner may order that the processing be wholly or partially adjusted, interrupted, or terminated, and that the personal data be wholly or partially deleted or destroyed.

2 The public body concerned may challenge the Commissioner's orders by filing an appeal with the Administrative Court. The parties are the Commissioner and the public body concerned.

The Commissioner shall cooperate with the authorities of other cantons, the Confederation and foreign countries which perform the same tasks, in order to fulfil the monitoring and cooperation tasks pursuant to Section 35.

1.7.24 - 125

11

170.4

Tasks

Powers

Recommendations

Administrative measures

Cooperation

170.4 Act on Information and Data Protection (IDPA)

Duty of confidentiality

The Commissioner and the staff are obligated to the same confidentiality with regard to information they become aware of in the course of their work as the processing public body.

Reporting

The Commissioner reports periodically to the election body on the scope and main areas of activity, important findings and assessments, and the impact of the law. The report is published.

Legal Protection

20 1 Appeals against orders of the commissioner in personnel or administrative matters may be lodged with the Administrative Delegation26 of the Cantonal Council's Executive Board.

2 The duty of confidentiality pursuant to § 38 also applies to the appellate bodies.

3 In all other respects, legal protection is governed by the Administrative Justice Act of May 24, 19599.

Processing of personal data in breach of contract

VIII. Criminal Provisions

1 Any person commissioned in accordance with § 6 who, without express authorization from the contracting public body, uses personal data for themselves or others, or discloses it to others, shall be punished with a fine.

2 The investigation and judgment of infringements shall be the responsibility of the District Governor's Offices.

IX. Final and Transitional Provisions

Transitional Law

Information holdings with special personal data existing at the time this Act comes into force may be processed or disclosed by the public body for five years after this Act comes into force, without the conditions of § 8 para. 2 or § 17 para. 1 lit. a being fulfilled.

12

Act on Information and Data Protection (IDG)

170.4

1 In the following laws, the expression "Data Protection Act" or "Act on the Protection of Personal Data" is replaced by the expression "Information and Data Protection Act"

a. Act on the Outsourcing of IT Services: § 3 para. 1 and 2,

b. Tax Act15: § 122 para. 2.

2 In the following laws, the expression "particularly sensitive personal data" or "particularly sensitive data" is replaced by the expression "special personal data"

a. Act on the Outsourcing of IT Services: § 3 para. 1,

b. Financial Control Act14: § 25 para. 2.

repealed on June 6, 1993.

previous law

Adaptation

a. Law on Municipal Affairs (Municipalities Act) of June 6 other enactments

19265:...18

b. Law on the Organization and Rules of Procedure of the Cantonal Council (Cantonal Council Act) of April 5, 19817: . . .18

c. Law on Legal Protection in Administrative Matters (Administrative Justice Act) of May 24, 19599: . . .18

d. Law on the Employment Relationship of State Personnel (Personnel Act) of September 27, 199810: . . .18

e. Law on the Insurance Fund for State Personnel of June 6, 199311:...18

f. Archives Act of September 24, 19956: . . .18

g. Law on Public Passenger Transport of March 6, 198816:...18

h. Law on Controlling and Accounting (CRG) of January 9, 200613: ...18

1.7.24 - 125

13

170.4

Law on Information and Data Protection (IDG)

Transitional provision on the amendment of December 12, 2022

(Official Gazette 79, 157)

If the amendment comes into force during the current term of office of the Data Protection Officer, the previous law shall remain applicable until the end of the current term of office.

1 Official Gazette 62, 121.

2 Entry into force: October 1, 2008 (Official Gazette 63, 317).

3 Official Bulletin 2005, 1283.

4 §§ 30–33 in force since June 1, 2007 (Official Gazette 62, 136).

5 State Law Collection 131.1.

6 State Law Collection 170.6.

7 State Law Collection 171.1.

8 State Law Collection 172.71.

9 State Law Collection 175.2.

10 State Law Collection 177.10.

11 Obsolete.

12 State Law Collection 211.1.

13 State Law Collection 611.

14 State Law Collection 614.

15 State Law Collection 631.1.

16 State Law Collection 740.1.

17 SR 235.1.

18 For text, see Official Gazette 62, 121.

19 Version according to § 44 lit. h of the Law on Information and Data Protection of February 12, 2007 (Official Gazette 62, 135; Official Bulletin 2005, 1283). In force since October 1, 2008 (Official Gazette 63, 317).

20 Inserted by the Law on the Adaptation of Cantonal Administrative Procedure Law of March 22, 2010 (Official Gazette 65, 390; Official Bulletin 2009, 801). In force since July 1, 2010.

21 Version according to Law of April 12, 2010 (Official Gazette 65, 518; Official Bulletin 2009, 2315). In force since September 1, 2010.

22 Version according to the Law on the Adaptation of Cantonal Authority Organization and Cantonal Procedural Law in Civil and Criminal Matters to the New Federal Procedural Laws of May 10, 2010 (Official Gazette 65, 520, 570; Official Bulletin 2009, 1489; Official Bulletin 2010, 513). In force since January 1, 2011.

14

Law on Information and Data Protection (IDG)

170.4

23 Version according to the Cantonal Council Act of December 17, 2012 (Official Gazette 68, 149; Official Bulletin 2012, 189). In force since May 6, 2013.

24 Repealed by the Cantonal Council Act of December 17, 2012 (Official Gazette 68, 149; Official Bulletin 2012, 189). In force since May 6, 2013.

25 Version according to the Law on Strengthening the Information Rights of Supervisory Commissions of May 26, 2014 (Official Gazette 69, 482; Official Bulletin 2014-01-10). In force since January 1, 2015.

26 Version according to the Cantonal Council Act of March 25, 2019 (Official Gazette 74, 387). In force since May 1, 2020.

27 Inserted by Law of November 25, 2019 (Official Gazette 75, 263; Official Bulletin 2018-07-13). In force since June 1, 2020.

28 Version according to Law of November 25, 2019 (Official Gazette 75, 263; Official Bulletin 2018-07-13). In force since June 1, 2020.

29 Version according to Law of November 15, 2021 (Official Gazette 77, 420; Official Bulletin 2020-12-18). In force since October 1, 2022.

30 Version according to Cantonal Council Resolution on the Harmonization of Legal Provisions for the Ombudsperson, the Head of Financial Control, and the Data Protection Officer of December 12, 2022 (Official Gazette 79, 157; Official Bulletin 2022-07-15). In force since May 1, 2024.

1.7.24 - 125

15