Regulations on the Use of Information and Communication Technology (ICT Usage Regulations) (TIC)

1 This regulation governs the use of electronic infrastructures and the

use of the Internet with the organization's IT resources, as well as the

use of email and social media, for all employees and the purpose

members of the Synodal Council of the Roman Catholic Corporation of the

Canton of Zurich.

2 The Corporation's interest lies in ensuring

data security and data protection, in an operational IT infrastructure that is

burdened as little as possible (storage space, network

bandwidth), as well as in financial (the employee owes the

employer their working time) and non-material interests (protection against

reputational damage). Opposing these are the employees' information and

communication interests, and the protection of their personality.

3 For third parties who use the Corporation's IT resources,

this regulation is declared binding on a contractual basis.

1.4.21-112

1

182.42

II. Usage Regulations

ICT Usage Regulations

Work

Instruments

and Work

Results

Security

Measures

1. Business Data (documents, emails)

must be processed using the hardware and software provided by the corporation and

stored within the operational IT structure (server, cloud).

2. Platforms and collaboration tools not expressly approved are prohibited.

3. Unencrypted USB sticks or unencrypted external hard drives are not permitted.

4. The installation of hardware and software as well as communication devices by employees other than the ICT managers is prohibited.

5. IT systems connected to the network may not simultaneously be connected to a network or system outside the internal network.

ICT Usage Regulations

**182.42**

1 Passwords are personal and may not be disclosed. Passwords must consist of at least eight characters and should include a combination of lowercase and uppercase letters, numbers, and special characters. Easily guessable passwords and those that relate to one's own person (e.g., name, name of relatives, date of birth, etc.) are not permitted. Passwords used for business purposes may not be used privately. Passwords should be changed regularly. They must be changed immediately if there is any suspicion that they have become known to third parties. A password previously used may not be used again.

2 Employees may only use their personal user IDs or the functional IDs assigned to them. They are responsible for the accesses made with their IDs. Access to data not required for task fulfillment is prohibited.

3 When leaving the workstation for an extended period, the workstation must be locked, or the user must log out of the system. Laptops and smartphones must be secured accordingly, and sensitive documents protected from access.

4 Measures must be taken to ensure that no unauthorized persons have access to the work premises. If external persons are present in the office premises, measures must be taken to prevent unauthorized access to information.

5 USB sticks and external hard drives from third parties must be checked by antivirus software before opening. Only devices from known sources may be used.

6 Employees may not disable, block, or alter the configuration of security software (antivirus, firewall, etc.). Emails from unknown senders, with suspicious subjects, or unusual content must be handled with caution, as they may contain viruses not detected by the antivirus software. Their attachments and links to websites should under no circumstances be opened. Any suspicion of a virus infection must be reported immediately to the ICT المسؤولين.

To Maintain Data and Application Security (Availability, Integrity, Confidentiality)

Only programs approved by the ICT managers of the corporation may be installed to maintain data and application security (availability, integrity, and confidentiality).

1 Personal data and confidential factual data may only be stored outside the corporation's own network or the iKath cloud in encrypted form. They may not be mentioned online, i.e., not on the internet, not on social media, in unencrypted emails, or other unencrypted communication methods.

2 They may only be transmitted unencrypted within the corporation's own network or within the iKath cloud.

Personal Data and Confidential Factual Data

1. Business data must not be stored or kept on private PCs, laptops, and tablets.

2. Exceptions may be granted by the Secretary-General after consultation with ICT Management.

3. Approval for private devices will only be granted if it is unreasonable to use a business device and if the security measures according to workplace specifications are met.

4. If smartphones are used for business purposes, they must be secured with a six-digit password, fingerprint, or facial recognition. Documents with confidential or protectable content must not be stored. If the devices contain protectable data, they must not be left unattended or handed over to third parties for use.

**Use of Private Devices**

1 Private use of the internet, email, and social media during working hours must be limited to a minimum and should generally only take place during breaks.

2 Downloading and/or saving large quantities of private files or files causing significant network load (photo, video, and music files) to the server is not permitted.

3 Access to the internet with private devices is only permitted in the guest area of the Wi-Fi.

1.4.21-112

3

182.42

ICT Use Regulations

Unlawful

Documents, videos and images, as well as emails, websites and

other web content with racist, pornographic, sexist, glorifying violence or generally illegal content may neither be consumed, downloaded nor further distributed. Generally speaking, actions punishable under Swiss criminal law are to be refrained from.

Private Emails

and Forwarding

of Emails

1 The sending and receiving of private emails via the organization's

email account is permitted. Such emails must be stored in a folder

designated as "private". During the automatic backup of employees'

emails, private emails will also be backed up.

2 Private emails that are not marked as such are considered business

emails.

3 It is not permitted to publish the official email address on websites

for private purposes.

4 The automatic forwarding of emails to private as well as other

external email addresses requires the approval of the Secretary-General.

5 In the event of a prolonged absence (accident, illness, or other

extraordinary events) of an employee, the supervisor is entitled, after

consultation or attempted consultation with the employee, to access

their email account. This access shall be carried out with the involvement

of the Head of Human Resources and the Data Protection Officer.

Respect

Social Media

All employees of the corporation must at all times show respect towards their communication partners. This also applies to those about whom they may write online, such as friends, colleagues, clients, critics, etc., but also the Catholic Church as such.

The online presence of employees also influences the image of the Catholic Church in the Canton of Zurich. In personal blogs or entries and profiles in social networks such as Facebook, it must be clearly evident from the circumstances that the private individual is expressing their own opinion. If this is not already clearly recognizable from the circumstances, employees must include a disclaimer stating that the opinions expressed are solely those of the author and do not represent the views of the Catholic Church in the Canton of Zurich.

4

ICT Use Regulations

III. Organization

1 ICT responsibility lies with the Synodal Council.

182.42

ICT Responsibility

2 Operational responsibility lies with the Secretary General, with the ICT Staff Unit being technically responsible.

3 The Administration, the Vicariate General, the Specialist and Service Departments, and the Missions each have a contact person for Information and Communication Technology (ICT). If no one is designated, this will be the head of the respective department.

4 The ICT Staff Unit of the Administration supports the contact persons and has an overview of the use of hardware and software within the corporation. The Synodal Council regulates the details in an ICT concept.

1. **Operating Units**

Operating units are defined as the IT services responsible for the operation of the electronic infrastructure and services of the corporation.

2. A contract or directive shall ensure that the operating units enable the legally compliant and secure use of the electronic infrastructure and services of the corporation.

Competence

**1** The ICT Department of the Administration is responsible for the operation of the corporation's own server, the corporation's own network infrastructure in the departments, services and missions, as well as all clients (desktop PCs and laptops) of the corporation.

**2** With the assistance of the operating unit, it is particularly responsible for

a. the installation of a spam filter and the deletion of data recognized as spam,

b. the storage of all e-mails in the e-mail journal,

c. the authorization of software in accordance with §§ 2 and 4,

d. the blocking and unblocking of internet pages in agreement with the Secretary General,

e. anonymous evaluations as required in accordance with § 16,

f. personal data evaluations as required in accordance with § 21.

**3** In the event of extraordinary occurrences (such as technical malfunctions or network overload), the ICT Staff Unit may temporarily restrict data traffic. Such a measure will be communicated on the intranet.

1.4.21-112

5

182.42

ICT Usage Regulations

Access to

business

data during

absences

Anonymized

reports

Monitoring

measures

Definition

Decision

on personal

reports

1 The superior authority is entitled, in the event of an employee's prolonged absence (accident, illness, or other extraordinary events), to access their business data after consultation or attempted consultation. This shall be done with the involvement of the Head of Human Resources and the Data Protection Officer.

**2 Business data shall be handed over to the superior authority; private files shall remain in the data storage of the affected person. The confidentiality and protection of private files cannot be guaranteed.**

1 The operating units shall, upon request by the Secretary-General,

prepare anonymized reports providing information about the accessed

internet addresses and, where possible, about the time and number of

accesses and the volume of data transferred.

2 The reports must not allow for conclusions to be drawn about individual

employees. In particular, they must not reveal individual employees or

individual workstations.

IV. Misuse of the Corporation's Electronic Infrastructures and Services

To prevent abuse and technical damage, the corporation implements technical protective measures (e.g., blocking certain web services, installing anti-virus software, etc.). Anonymous technical monitoring of internet traffic is also permissible under § 16. If there is a well-founded suspicion that this regulation is being violated despite technical protective measures, personalized monitoring and analysis of internet and email logs will occur. The use of spyware is prohibited in this context.

An abuse within the meaning of these Regulations exists upon a violation of Sections 2–8.

1 The Secretary General is responsible for ordering a personalized

evaluation. They make the decision together with the Head of Human

Resources and the Data Protection Officer of the corporation.

6

ICT Usage Regulations

182.42

2 The conditions for ordering a personalized evaluation are met if

abuses of significant impact exist for internet access or

there is a concrete suspicion of abuse in email traffic.

The Secretary-General informs the affected employees that for a specified period, Internet access or email traffic will be personally logged and evaluated.

1. Upon prior announcement, the Secretary-General may instruct the operating units to generate personal reports concerning internet access or email traffic.

2. Personal reports may be generated for a maximum period of three months. No personal reports may be generated or evaluated for the period prior to the announcement by the Secretary-General.

3. The operating unit shall provide the reports, declared as confidential, to the Secretary-General.

1. **Personalised Reports on Internet Access – Content**

Personalised reports on Internet access contain

* the name of the internet user;

* the selected internet addresses;

* where possible, the time and number of accesses, as well as the amount of data transferred.

2. **Personalised Reports on Email Traffic**

Personalised reports on email traffic contain

* the name of the email user;

* the selected addresses;

* the time of dispatch;

* the data volume of outgoing emails.

1 The Secretary General decides, together with the Head of Human Introduction

Resources and the Data Protection Officer of the corporation, of Measures

based on the personal reports, whether the Staff Committee will be

requested to conduct an administrative investigation against the person

concerned, or whether other measures are to be taken.

2 The Secretary General communicates the decision to the person

concerned.

1.4.21-112

7

182.42 ICT Use Regulations

Examination and

Destruction

of Documents

If no administrative investigation is initiated, the personal reports and protocols will be destroyed after 30 days and the employees informed.

V. Final Provisions

Acknowledgement of the Regulations

Entry into Force

Every employee signs the Regulations as a declaration that they have read and understood the Regulations and will comply with the usage regulations.

8

¹ OJ 74, 488; for grounds see LJ 2019-06-14.

² S. 170.4.

³ S. 182.10.

⁴ S. 182.41.

⁵ Version in accordance with decision of 18 January 2021 (OJ 76, 65; LJ 2021-02-05). In force

since 18 January 2021.