The Federal Law on the Use of Electronic Means for the Performance of Government Tasks (EMBAG) is intended to Legal foundations for a digital transformation in the federal administration and cooperation between authorities in the area of e‑government – but for the time being without digital processes being binding (a separate constitutional basis for this is under discussion).
It applies in principle to the central federal administrationif the Federal Council does not extend the scope of application to units of the decentralized federal administration by ordinance. On March 4, 2022, the Federal Council had adopted the dispatch on the EMBAG (on this here).
During the deliberations, a detailed question regarding the competence of the Federal Council to conclude agreements and treaties under international law in this area was still controversial. After the National Council had third round of the adjustment of differences had joined the Council of States on March 13, the Councils passed the law in the Final vote of March 17, 2023 approved with large majorities.
The main purpose of EMBAG for the federal government as a whole is to create “sufficient legal bases for the use of electronic means in the performance of its tasks,” and here, above all, for the Cooperation of the Confederation with other communities, other states and national and international organizations. For example, the Confederation should be able to conclude agreements with the cantons and participate in organizations.
Also regulated is the delegation of tasks in the field of administrative support activities in the use of electronic means. According to Art. 8 para. 1 EMBAG, which was adopted in parliament without discussion, the Federal Council is competent and authorized to transfer tasks by ordinance or treaty – according to the dispatch: treaties under administrative law. The dispatch further refers here to Art. 178 para. 3 BV (“Administrative tasks may be transferred by law to organizations and persons under public or private law that are outside the federal administration”). What is required, therefore, is a formal legal basis, which Art. 8 EMBAG seeks to create.
However, this requirement does not necessarily refer to the involvement of third parties in the context of the administration of needs, at least if the legal position of the persons concerned is not affected by this – such involvement should be possible without its own basis. This is also the view of the Federal Chancellery, which in the Public Cloud Report August 31, 2022 has recorded,
In principle, the use of cloud services is regarded as a administrative support activity (demand management). Administrative support activity means the procurement of those necessary material goods or services that the administration needs to fulfill its public task. Examples of this are the procurement of office supplies, the conclusion of work contracts for the construction of a public building, or even the involvement of an ICT service provider. In principle, the administrative unit concludes contracts under private law. The legal basis is derived directly from the legal basis of the respective public task. However, depending on the subject matter or nature of the data processed, the following apply more specific requirements to the legal basis. This applies in general namely when personal data is the subject of a cloud sourcing are.
It remained unclear what meaning the reference to personal data in cloud sourcing should have here. In the Report of the BK “Legal basis – Cloud-enabling office automation” of February 15, 2023 the BK has repeated its view, but now explicitly also when personal data is involved:
The present project concerns the further development of office automation (OA), which supports the fulfillment of federal tasks and is necessary for economical and comprehensible administrative activities. The operation of the BA does not involve any interference with the rights of individuals. Under these circumstances, the operation of the BA can be based directly on the transfer of the corresponding administrative tasks. A Explicit legal basis is thus not necessary; this also applies to the outsourcing of the BA to the public cloud. When outsourcing processing to the public cloud it is a matter of order data processing (Microsoft is an order processor) within the meaning of data protection legislation. Accordingly, the data protection provisions must be complied with. The legal basis for the processing of data by the federal administration is derived from RVOG 57h. The data protection provisions are fulfilled with the supplements to SCC and recognition of the CH DSG.
This is correct because the outsourcing of electronic data processing to a service provider does not in principle require its own legal basis even if personal data are involved. This follows from the interaction, or rather the difference, between Art. 10a FADP (new Art. 9; here referring to federal bodies) and Art. 19 FADP (new Art. 36): Subject to the exceptions, the “disclosure” of personal data requires a legal basis, but order processing must be distinguished from this. It is worth recalling the related distinction between contracts under administrative law and contracts under private law (e.g. in BGE 134 II 297):
A contract under administrative law directly concerns the performance of a public task or relates to an object governed by public law, for example a development, expropriation or subsidy […]. In contrast, an agreement under private law exists if the state merely procures the resources it needs to fulfill its public duties by means of a purchase, a contract for work or an order.
This underscores the fact that Art. 8 EMBAG cannot actually be about the procurement of electronic aids for the performance of state tasks, because the legal basis that Art. 8 EMBAG seeks to create is not required here in accordance with Art. 178 BV and the dispatch understands the expression “agreement” in Art. 8 EMBAG as an agreement under administrative law, but when a cloud service, for example, is procured, a contract under private law is concluded. It is not excluded that the Federal Administrative Court will deal with this question (cf. here).
Other key areas of regulation are
- the conclusion of Agreements by the federal government including, where appropriate, the creation of or participation in joint organizations e.g. with the cantons (so could the Digital Management Switzerland become a separate legal entity),
- the use of Open Source Software - to the extent possible, the federal government should disclose the source code of software that it develops or has developed for free reuse,
- The gradual public provision of data obtained or generated for the fulfillment of statutory tasks (Open Government Data),
- the provision or purchase of Shared Services by the federal authorities, and
- the implementation of Pilot testing.