Ordinance on Information and Data Protection (OIDP) (IDV)

1 Public bodies are, within their area of responsibility, responsible for the compliance with and implementation of the principles governing the handling of information and personal data in their information activities and data protection measures.

2 They shall disclose information if the conditions are met and after weighing public and private interests

a. through official information activities in the sense of § 14 of the Information and Data Protection Act of 12 February 2007 (IDG)2, and

b. by granting access to information upon request in the sense of § 20 IDG.

3 The public bodies of the Canton obliged to implement the IDG in the sense of § 3 para. 1 lit. b IDG are, each within their respective areas of responsibility

a. the Government Council,

b. the entities designated in § 59 and Annex 2 of the Ordinance on the Organisation of the Government Council and the Cantonal Administration of 18 July 20073, unless the Directorates make other arrangements.

4 The other public bodies designated in § 3 para. 1 IDG shall themselves determine the obliged entities for their respective areas of responsibility. For this purpose, they may in particular designate central entities.

5 Special provisions on competence in the present Ordinance and other enactments of cantonal and communal law remain reserved.

1 Information within the scope of opinion-forming processes can be restricted, especially when it concerns politically controversial issues or when the relevant matters could become the subject of later legal disputes. The information activity after a decision has been made must be decided on a case-by-case basis.

Opinion-forming

process

1.4.20-108

1

170.41 Ordinance on Information and Data Protection (IDV)

2 For matters of the Government Council, the proposals, co-reports, and special statements of the directorates and the State Chancellery remain excluded from disclosure even after the Government Council has made its decision.

Section 2: Information Activity ex officio

Responsibilities

Means

Publication of

information

Register of

information

holdings

If information concerns various public bodies, these shall coordinate with each other regarding the performance of information activities ex officio according to § 14 IDG.

1 The information activity of public bodies takes place via official publication organs, the Internet, or the media.

2 The body responsible for information activity may determine further means of information.

3 If information is accessible in a publication organ or on a website of a public body, the information is considered sufficiently accessible within the meaning of § 25 para. 1 IDG.

The public body shall publish important information from its area of responsibility as quickly as possible, provided that

a. this does not cause unreasonable effort and

b. no legal provisions preclude its publication.

The directory of information holdings according to § 14 para. 4 IDG contains in particular information about the classification system, which provides an overview of the areas of responsibility of the public body (records schedule), and about all systematically accessible data collections.

3. Section: Access to Information upon Request

A. Access to General Information

a. Informal Request

1 General Information on the Activities of Public Bodies

within the meaning of Art. 20 para. 1 IDG may be requested informally

from the body responsible according to Art. 1.

2

Ordinance on Information and Data Protection (IDV) 170.41

2 An informal request is inadmissible if

a. a hearing of affected third parties according to Art. 26 IDG is required,

b. detailed clarifications are necessary for the balancing of interests, or

c. its processing involves particular effort.

3 In the case of inadmissible informal requests, the inquiring person

shall be informed of the requirement for a written application and generally of

potential cost implications.

1 Special Information on the Activities of Public Bodies b. Written

Requests for special information on the activities of public bodies must be submitted in writing to the body responsible under § 1.

2 The request should contain, as precise as possible, details regarding the subject matter and the general description of the information, as well as its date of creation and authorship.

3 If the public body cannot determine which information is being requested without unreasonable effort, it may ask the applicant for clarification. It shall inform the applicant of the consequences of failing to provide clarification.

4 If the applicant fails to provide the additional information required to identify the requested information within ten days, the request shall be deemed withdrawn.

Request

1 The public body to which the request is addressed shall process it itself, unless another body has been declared responsible.

2 If the request obviously concerns information held by another body, it shall be transferred to that body for processing. This applies in particular when the requested body possesses the desired information but did not itself create it or receive it as the primary addressee.

3 If the request concerns information held by multiple bodies, these bodies shall coordinate with each other regarding the processing and assessment of the request.

1 Informal requests are answered orally or electronically, insofar as the content of the requested information allows.

2 Access to information upon written request is granted through inspection at the public body or by delivery of copies.

3 It may be granted electronically if the requested information does not contain personal data or if the personal data is sufficiently protected from unauthorized access by third parties.

**170.41 Ordinance on Information and Data Protection (IDV)**

a. Principle

1.4.20-108

3

b. Inspection at the public body

1 Inspection takes place at the public body responsible for processing the request.

2 The body may limit itself to providing copies, particularly when information needs to be anonymized.

3 It may verify the identity of the applicant upon entry to its premises.

4 It ensures appropriate protection of the information during inspection.

5 It allows the creation of copies upon request.

c. Delivery of copies

1 The public body shall provide the applicant with copies of official documents upon request, to the extent that their condition and nature permit.

2 It shall draw attention to restrictions on use, to the extent that the body's information is protected by copyright.

d. Form

1 Public bodies shall make information accessible, as far as possible, in the form in which it was prepared for official use. They are not obliged to translate or otherwise process the information in advance.

2 If access to information can only be granted in part, the parts subject to a restriction may be redacted or severed. If this is not reasonably possible, a summary of the information may be provided.

Multitude of

Requests

The public body can, in cases where a multitude of requests or applications relate to the same information, grant access in a manner deviating from §§ 11 and 12.

Complex Applications

1 The public body may specifically request proof of a legitimate

access interest within the meaning of Article 25(2) IDG when it cannot process

the request with its available resources without the substantial impairment

of the performance of its other tasks.

2 If proof is provided, the public body may reasonably extend the

period for granting access under Article 28(1) IDG.

4

Ordinance on Information and Data Protection (IDV) 170.41

B. Access to one's own personal data

¹ A person requesting access to their personal data under Article Application

20, paragraph 2 of the IDG must submit a written application to the

relevant body.

² The application may be submitted electronically if the public body

permits it.

³ The applicant must identify themselves.

**1 The requested body processes the application and grants access.**

**2 If the application relates to personal data that is part of a data collection jointly processed by several public bodies, the requested body may transfer its processing to the responsible body.**

**3 If the requested body has personal data processed by a third party, it shall transfer the application to that third party for processing, provided it has contractually obliged the third party to provide information and cannot provide the information itself.**

¹ The information is generally provided in writing in the form of a form and print-

out or a photocopy. It may be provided in other suitable ways or, with the consent of the applicant, orally.

2 It may be provided electronically with the consent of the applicant, if the transmission is adequately protected from access by unauthorized third parties.

3 The information includes

a. the information concerning the applicant that is available in the information holdings of the public body,

b. the legal basis and purpose of the data processing, the bodies involved in the data processing, and the regular recipients of information.

**Information on Personal Data of Deceased Persons**

Information on personal data of deceased persons will be provided if the applicant demonstrates an interest in the information and there are no overriding interests of relatives of the deceased person or third parties. Close kinship, as well as marriage, registered partnership, and marriage-like cohabitation with the deceased person at the time of death, establish an interest.

1.4.20-108

5

**Blocking of Personal Data**

170.41

Ordinance on Information and Data Protection (IDV)

**1 Whoever requests the disclosure of personal data to private parties according to**

1 Disclosure of personal data for non-personal purposes pursuant to Article 18 IDG may be made in particular for research, planning, statistics, and person-independent expert opinions.

2 It requires a written application with the following information

a. Name of the recipient,

b. Brief description of the project,

c. Description of the personal data required,

d. Procedure and type of data processing,

e. Information on the measures to be taken to protect the information, particularly regarding storage, anonymization, and destruction of the personal data.

3 The public body issues a written decision. It may subject this decision to conditions for the protection of personal data.

Abs. 1 IDG wishes to have their data blocked, they must notify the competent public

body in writing.

2 If the body has executed the block, it must notify this in writing.

Disclosure

of personal

data for non-

personal

purposes

Cross-border

disclosure

of personal

data

Electronic

publications

4. Section: Further provisions on the handling of information

Where personal data is made generally accessible using automated information and communication services, this shall not be considered a transmission abroad.

6

Ordinance on Information and Data Protection (IDV)

170.41

1. Special risks within the meaning of Article 10 IDG exist in particular for a project involving the processing of personal data when it

a. provides for a retrieval procedure,

b. concerns the collection of a large number of special categories of personal data,

c. is associated with the use of new technologies,

d. provides for at least three different public bodies to process personal data jointly, or

e. affects a large number of persons.

2. The notification from the public body concerning the project to the Data Protection Officer contains

a. a description of the project,

b. an outline of the legal situation,

c. an overview of the measures to prevent infringements of personal rights.

3. The Data Protection Officer shall carry out the prior review within a reasonable period and communicate the results of the review to the public body.

4. With the consent of the Data Protection Officer, the Data Protection Officer may participate in the project organisation of the project instead of a prior review.

5. A prior review is not required if, within the framework of the legislative procedure forming the basis for the intended processing of personal data, the type of processing has been defined and protective measures have been provided.

1 Insofar as information processing by third parties in accordance with the contract-

1 Examination and assessment bodies in accordance with § 13 IDG are the certification bodies accredited under the Ordinance on Data Protection Certification of 28 September 2007 (VDSZ). The provisions of the VDSZº regarding subject matter and procedure apply mutatis mutandis.

2 The tasks of the Federal Data Protection and Information Commissioner in accordance with Articles 9 and 10 VDSZ6 are performed, where necessary, by the Data Protection Officer.

Responsibility

for Data

Protection

Coordination

Body IDG

Communication

with the Data

Protection

Officer

Section 5: Organisational Provisions

When multiple public bodies process personal data from the same information inventory, they regulate the main responsibility for data protection. Each body remains responsible for its own data processing.

1 The State Chancellery operates an IDG Coordination Office for the cantonal administration within the meaning of § 1 para. 3. This Coordination Office8

a. supports public bodies in the implementation and enforcement of the principle of public access in accordance with the IDG,

b. promotes information and further training for employees in the area of the principle of public access in accordance with the IDG,

c. receives requests for inspection of minutes of the Government Council that are submitted within 20 years after the conclusion of the relevant annual volume of minutes.

2 The Coordination Office cooperates with the Data Protection Officer in the performance of its duties.

3 For communication with the Coordination Office, the Directorates shall each designate a central contact person.

1 The public bodies of the Canton communicate directly with the Data

Protection Officer. In matters of fundamental importance or particular scope,

communication shall take place through official channels via the Directorate and with

notification to the IDG Coordination Office.

2 The public bodies of the Canton shall consult the Data Protection

Officer at an early stage in matters related to fundamental data protection

issues, particularly in corresponding legislative projects.

8

Ordinance on Information and Data Protection (IDV) 170.41

1 Reporting by Units of the Cantonal Administration

The units of the cantonal administration shall annually submit to the State Chancellery, through official channels, for inclusion in the annual report

a. the number of written requests for access to information submitted in the reporting year,

b. the number of written requests accepted and those rejected in whole or in part,

c. special occurrences in connection with the disclosure of information.

2 The State Chancellery shall provide the Data Protection Officer with the information for reporting in accordance with § 39 DPA.

Section 6: Data Protection Officer

The Directorate of Justice and Home Affairs proposes a Data Protection Officer to the Government Council for election.

1 The Data Protection Officer shall communicate with the Government Council through the State Clerk. The State Clerk shall submit to the Government Council the reports and recommendations of the Officer that are of significance for the entire cantonal administration.

2 The Officer shall communicate directly with the cantonal administrative units. Recommendations and matters of general importance or particular significance shall also be communicated to the central contact person of the competent department and the IDG Coordination Office.

3 Communication with other public bodies shall be governed by the organisational arrangements made by these bodies.

If the public body does not wish to follow a recommendation from the Data Protection Commissioner, it shall issue a reasoned decision within 60 days of receiving the recommendation.

1.4.20-108

9

170.41 Ordinance on Information and Data Protection (IDV)

Section 7: Legal Protection and Fees

Opinion in § 34.8 In internal administrative appeal proceedings against cantonal orders

case of appeals concerning the principle of public access in accordance with the IDG or this Ordinance, the IDG Coordination Office must be invited to submit an opinion.

Fees § 35. 1 Unless this Ordinance contains a special provision, the provisions

of the Fee Ordinance for Administrative Authorities of June 30, 19664 and the Fee Ordinance for Municipalities7 shall apply.

2 The fees for granting access to information are determined by the

Annex to this Ordinance.

3 The public body shall waive the collection of fees if the costs of

collecting the fees exceed the fee amount. Fees below CHF 50 will not be collected.

4 Costs arising exclusively from the consideration of special needs

of persons with disabilities are not taken into account when determining fees.

5 The authority may waive the collection of fees or reduce the fee if it rejects the access request or grants only partial access.

Information § 36. 1 If the estimated total costs exceed CHF 500, the authority shall

on estimated inform the applicant of the expected amount of the fee.

costs 2 If the applicant does not confirm the request within ten days, it shall be deemed withdrawn. The authority shall inform the applicant of this.

Implementing 8. Section: Final Provisions

provisions § 37. The public bodies shall take the necessary measures for the implementation of the IDG and this Ordinance within two years of the entry into force of the Act.

10

Ordinance on Information and Data Protection (IDV) 170.41

**Entry into force**

1 OS 63, 319; for justification, see ABI 2008, 916.

2 LS 170.4.

3 LS 172.11.

4 LS 682.

5 SR 235.11.

6 SR 235.13.

7 Version in accordance with Executive Council Decision of 29 June 2016 (OS 72, 311; ABI 2016-07-15). In force

since 1 January 2018.

8 Version in accordance with Executive Council Decision of 23 October 2019 (OS 75, 4; ABI 2019-12-13). In

force since 1 January 2020.

1.4.20-108

11

170.41

Annex

Ordinance on Information and Data Protection (IDV)

Schedule of Fees for Access to Information (§ 35)

1. Reproductions

Photocopy in A4 or A3 format

from normal single sheet originals up to A3, per page

from special original formats, from bound

originals or from poor original quality,

per page

Electronic copy (if the documents are not

already available in electronic form)

transmitted online

Swiss Francs

-.50

2.-

from single sheet originals up to A3, per page

from special original formats, from bound

originals or from poor original quality,

per page

-.50

2.-

Electronic copy stored on machine-readable data

carrier, in addition to the per-page price

35.-

Audio or video recording, recorded by

public body

per data carrier

35.-

Paper prints of photographs, 16 or 35 mm film

copied onto videocassette, as well as all other

copies that must be produced by external partner companies

according to quote

2. Examination and preparation of official documents

for granting access, as well as

participation in information access

Workload for the examination and preparation

of official documents

per hour

Participation in information access

per hour

12

100.-

100.-