datenrecht.ch

Fede­ral Act on the Use of Elec­tro­nic Means for the Per­for­mance of Offi­ci­al Duties (EMBAG): adopted in final vote

The Fede­ral Law on the Use of Elec­tro­nic Means for the Per­for­mance of Govern­ment Tasks (EMBAG) is inten­ded to Legal foun­da­ti­ons for a digi­tal trans­for­ma­ti­on in the fede­ral admi­ni­stra­ti­on and coope­ra­ti­on bet­ween aut­ho­ri­ties in the area of e‑government – but for the time being wit­hout digi­tal pro­ce­s­ses being bin­ding (a sepa­ra­te con­sti­tu­tio­nal basis for this is under discussion).

It applies in prin­ci­ple to the cen­tral fede­ral admi­ni­stra­ti­onif the Fede­ral Coun­cil does not extend the scope of appli­ca­ti­on to units of the decen­tra­li­zed fede­ral admi­ni­stra­ti­on by ordi­nan­ce. On March 4, 2022, the Fede­ral Coun­cil had adopted the dis­patch on the EMBAG (on this here).

During the deli­be­ra­ti­ons, a detail­ed que­sti­on regar­ding the com­pe­tence of the Fede­ral Coun­cil to con­clude agree­ments and trea­ties under inter­na­tio­nal law in this area was still con­tro­ver­si­al. After the Natio­nal Coun­cil had third round of the adjust­ment of dif­fe­ren­ces had joi­n­ed the Coun­cil of Sta­tes on March 13, the Coun­cils pas­sed the law in the Final vote of March 17, 2023 appro­ved with lar­ge majo­ri­ties.

The main pur­po­se of EMBAG for the fede­ral govern­ment as a who­le is to crea­te “suf­fi­ci­ent legal bases for the use of elec­tro­nic means in the per­for­mance of its tasks,” and here, abo­ve all, for the Coope­ra­ti­on of the Con­fe­de­ra­ti­on with other com­mu­ni­ties, other sta­tes and natio­nal and inter­na­tio­nal orga­nizati­ons. For exam­p­le, the Con­fe­de­ra­ti­on should be able to con­clude agree­ments with the can­tons and par­ti­ci­pa­te in organizations.

Also regu­la­ted is the dele­ga­ti­on of tasks in the field of admi­ni­stra­ti­ve sup­port acti­vi­ties in the use of elec­tro­nic means. Accor­ding to Art. 8 para. 1 EMBAG, which was adopted in par­lia­ment wit­hout dis­cus­sion, the Fede­ral Coun­cil is com­pe­tent and aut­ho­ri­zed to trans­fer tasks by ordi­nan­ce or trea­ty – accor­ding to the dis­patch: trea­ties under admi­ni­stra­ti­ve law. The dis­patch fur­ther refers here to Art. 178 para. 3 BV (“Admi­ni­stra­ti­ve tasks may be trans­fer­red by law to orga­nizati­ons and per­sons under public or pri­va­te law that are out­side the fede­ral admi­ni­stra­ti­on”). What is requi­red, the­r­e­fo­re, is a for­mal legal basis, which Art. 8 EMBAG seeks to create.

Howe­ver, this requi­re­ment does not neces­s­a­ri­ly refer to the invol­vement of third par­ties in the con­text of the admi­ni­stra­ti­on of needs, at least if the legal posi­ti­on of the per­sons con­cer­ned is not affec­ted by this – such invol­vement should be pos­si­ble wit­hout its own basis. This is also the view of the Fede­ral Chan­cel­lery, which in the Public Cloud Report August 31, 2022 has recorded,

In prin­ci­ple, the use of cloud ser­vices is regard­ed as a admi­ni­stra­ti­ve sup­port acti­vi­ty (demand manage­ment). Admi­ni­stra­ti­ve sup­port acti­vi­ty means the pro­cu­re­ment of tho­se neces­sa­ry mate­ri­al goods or ser­vices that the admi­ni­stra­ti­on needs to ful­fill its public task. Examp­les of this are the pro­cu­re­ment of office sup­plies, the con­clu­si­on of work con­tracts for the cons­truc­tion of a public buil­ding, or even the invol­vement of an ICT ser­vice pro­vi­der. In prin­ci­ple, the admi­ni­stra­ti­ve unit con­clu­des con­tracts under pri­va­te law. The legal basis is deri­ved direct­ly from the legal basis of the respec­ti­ve public task. Howe­ver, depen­ding on the sub­ject mat­ter or natu­re of the data pro­ce­s­sed, the fol­lo­wing app­ly more spe­ci­fic requi­re­ments to the legal basis. This applies in gene­ral name­ly when per­so­nal data is the sub­ject of a cloud sourcing are.

It remain­ed unclear what mea­ning the refe­rence to per­so­nal data in cloud sourcing should have here. In the Report of the BK “Legal basis – Cloud-enab­ling office auto­ma­ti­on” of Febru­ary 15, 2023 the BK has repea­ted its view, but now expli­ci­t­ly also when per­so­nal data is involved:

The pre­sent pro­ject con­cerns the fur­ther deve­lo­p­ment of office auto­ma­ti­on (OA), which sup­ports the ful­fill­ment of fede­ral tasks and is neces­sa­ry for eco­no­mic­al and com­pre­hen­si­ble admi­ni­stra­ti­ve acti­vi­ties. The ope­ra­ti­on of the BA does not invol­ve any inter­fe­rence with the rights of indi­vi­du­als. Under the­se cir­cum­stances, the ope­ra­ti­on of the BA can be based direct­ly on the trans­fer of the cor­re­spon­ding admi­ni­stra­ti­ve tasks. A Expli­cit legal basis is thus not neces­sa­ry; this also applies to the out­sour­cing of the BA to the public cloud. When out­sour­cing pro­ce­s­sing to the public cloud it is a mat­ter of order data pro­ce­s­sing (Micro­soft is an order pro­ces­sor) within the mea­ning of data pro­tec­tion legis­la­ti­on. Accor­din­gly, the data pro­tec­tion pro­vi­si­ons must be com­plied with. The legal basis for the pro­ce­s­sing of data by the fede­ral admi­ni­stra­ti­on is deri­ved from RVOG 57h. The data pro­tec­tion pro­vi­si­ons are ful­fil­led with the sup­ple­ments to SCC and reco­gni­ti­on of the CH DSG.

This is cor­rect becau­se the out­sour­cing of elec­tro­nic data pro­ce­s­sing to a ser­vice pro­vi­der does not in prin­ci­ple requi­re its own legal basis even if per­so­nal data are invol­ved. This fol­lows from the inter­ac­tion, or rather the dif­fe­rence, bet­ween Art. 10a FADP (new Art. 9; here refer­ring to fede­ral bodies) and Art. 19 FADP (new Art. 36): Sub­ject to the excep­ti­ons, the “dis­clo­sure” of per­so­nal data requi­res a legal basis, but order pro­ce­s­sing must be distin­gu­is­hed from this. It is worth recal­ling the rela­ted distinc­tion bet­ween con­tracts under admi­ni­stra­ti­ve law and con­tracts under pri­va­te law (e.g. in BGE 134 II 297):

A con­tract under admi­ni­stra­ti­ve law direct­ly con­cerns the per­for­mance of a public task or rela­tes to an object gover­ned by public law, for exam­p­le a deve­lo­p­ment, expro­pria­ti­on or sub­s­idy […]. In con­trast, an agree­ment under pri­va­te law exists if the sta­te mere­ly pro­cu­res the resour­ces it needs to ful­fill its public duties by means of a purcha­se, a con­tract for work or an order.

This unders­cores the fact that Art. 8 EMBAG can­not actual­ly be about the pro­cu­re­ment of elec­tro­nic aids for the per­for­mance of sta­te tasks, becau­se the legal basis that Art. 8 EMBAG seeks to crea­te is not requi­red here in accordance with Art. 178 BV and the dis­patch under­stands the expres­si­on “agree­ment” in Art. 8 EMBAG as an agree­ment under admi­ni­stra­ti­ve law, but when a cloud ser­vice, for exam­p­le, is pro­cu­red, a con­tract under pri­va­te law is con­clu­ded. It is not exclu­ded that the Fede­ral Admi­ni­stra­ti­ve Court will deal with this que­sti­on (cf. here).

Other key are­as of regu­la­ti­on are

  • the con­clu­si­on of Agree­ments by the fede­ral govern­ment inclu­ding, whe­re appro­pria­te, the crea­ti­on of or par­ti­ci­pa­ti­on in joint orga­nizati­ons e.g. with the can­tons (so could the Digi­tal Manage­ment Switz­er­land beco­me a sepa­ra­te legal entity),
  • the use of Open Source Soft­ware - to the ext­ent pos­si­ble, the fede­ral govern­ment should dis­c­lo­se the source code of soft­ware that it deve­lo­ps or has deve­lo­ped for free reuse,
  • The gra­du­al public pro­vi­si­on of data obtai­ned or gene­ra­ted for the ful­fill­ment of sta­tu­to­ry tasks (Open Govern­ment Data),
  • the pro­vi­si­on or purcha­se of Shared Ser­vices by the fede­ral aut­ho­ri­ties, and
  • the imple­men­ta­ti­on of Pilot test­ing.

Aut­ho­ri­ty

Area

Topics

Rela­ted articles

Sub­scri­be