Canton of Zurich — Cantonal Legislation 180.7

This regulation supplements state data protection legislation and applies to the Evangelical Reformed Church and the Roman Catholic Church as well as the Christian Catholic Church of Zurich, insofar as their cantonal organs or district church administrations process personal data. It applies to the Evangelical Reformed and Roman Catholic parishes when they have not enacted their own data protection regulations or when such regulations are incomplete.

The processing of all personal data shall be aligned with the fulfillment of ecclesiastical tasks as described in state and ecclesiastical law.

From the resident registration offices, churches receive from members of their denomination the data required for membership recording

- Name, preferred name, additional first names, address, denomination, gender, date of birth, civil status, place of origin or nationality for foreigners, residency or settlement status, dates and places of moving in and moving out or death, guardianship/incapacitation including the name and address of the responsible representative, as well as the number of children under sixteen years of age, whose denomination is unknown.

If necessary, the data can be obtained in list form according to specific criteria maintained by the resident registration offices.

Those engaged in parish services may, in individual cases, obtain additional personal data necessary for the fulfillment of their duties from resident registration offices, school administrations, hospital administrations, or other official entities, either personally or through expressly designated auxiliaries (e.g., personnel in administrative, diaconal, or catechetical services). They must ensure the handling of these data under the protection of professional or pastoral confidentiality.

Furthermore, data should be collected directly from the individual concerned whenever possible.

In communication between church bodies and institutions, and in joint tasks also between church bodies of various publicly recognized churches, personal data may be disclosed to the extent that the data recipients are involved in the church community life or in the fulfillment of church tasks and require such information for that purpose. The data may only be used for the specified purpose and may not be further disclosed.

No fees should be charged for this data exchange.

Every affected individual may have their data blocked without providing a reason. In such cases, disclosure is only permissible if there is a legal obligation to do so or if the applicant credibly demonstrates a hindrance in pursuing legitimate claims against the affected person.

For each data collection, it must be determined who is authorized to process it and who is additionally allowed to have access. A responsible person must be designated for coordination.

All data collections (e.g., files, computer programs, as well as copies and backups on data carriers, etc.) shall only be accessible to the instructed responsible individuals.

All individuals who have access to a personal data file must, aside from the general duty of confidentiality (official or professional secrecy), be oriented about data protection.

For planned connections to the internet or other non-church networks, suitable technical measures must be implemented to prevent uncontrolled data retrieval by other connected parties. Such connections must be reported to the cantonal data protection officials of the churches (see § 9), and internet connections should, if possible, be established via existing cantonal systems or through systems that do not contain personal data.

The person appointed by the authority maintains a register of the collected data in accordance with the data protection law and regulations. This register also notes the types of restricted-access data, indicating the authority responsible for their processing.

The cantonal church authorities regulate, within the framework of the organization of administration and overall church activity areas, the instruction and handling of data protection in accordance with this regulation. They designate the responsible individuals for this purpose and determine the details regarding internal data exchange and the responsibility for the transfer of data to church and inter-church organizations.

In points of contact, the church officials coordinate with each other and, in conjunction with the cantonal data protection officer, take the necessary measures.

The church council coordinates with the local resident registration office, the school administration, and other regular data providers to make the necessary arrangements and designate a contact person responsible for data protection issues.

The church council determines the list of church newsletters, compilations, groups, and associations to which addresses can be provided in accordance with § 5.

The parishes decide how official acts such as funerals, baptisms, weddings, confirmations, and, with the consent of those involved, significant birthdays and anniversaries, as well as arrivals, departures, or address changes are publicly announced or communicated within the context of church events. Notifications according to the provisions of generally applicable church law, especially during church services, remain reserved.

The parish office holds the responsibility for additional personal data related to pastoral activities. In cases of doubt, the church council and parish office seek advice from the cantonal data protection officer.

Church councils may issue their own data protection regulations or supplementary provisions in an annex to these regulations, according to local needs. In the absence of local regulations, the cantonal church regulation shall apply directly.

This regulation shall enter into force on July 1, 2000. If a church authority (see § 1) decides to give its consent at a later date, it shall come into force for its church on the date of its decision.

In the event that revisions are needed later, the procedure shall be coordinated with the competent authorities.