fold out | fold
I. General provisions
§ 1 Object and purpose
1 This law regulates the handling of information by public bodies.
2 It aims to,
a. to make the actions of public bodies transparent and thus promote the free formation of opinion and the exercise of democratic rights as well as facilitate the control of government action,
b. to protect the fundamental rights of persons about whom the public bodies process data.
§ 2 Scope of application
This law applies to public bodies.
§ 2a Exceptions: a. Cantonal Council
1 This Act does not apply to the relationship between the Cantonal Council and its standing committees and the authorities and institutions that are subject to its ultimate supervision.
2 Insofar as the Cantonal Council is subject to this Act, the data protection officer shall not have the powers set out in § 10 paragraph 2, § 12a paragraphs 1 and 2, § 34 letters c, d and f and §§ 35 – 36a.
§ 2b Exceptions: b. Courts and law enforcement authorities
1 In court proceedings and proceedings by criminal prosecution authorities pursuant to section 86 paragraph 1 letters b and c of the Act on the Organization of Courts and Authorities in Civil and Criminal Proceedings of 10 May 2010, the rights of the persons concerned and the rights of third parties to inspect the documents are governed by the special statutory provisions.
2 This Act applies to the processing of personal data unless special laws contain provisions to the contrary.
3 Insofar as the courts are subject to this Act, the data protection officer shall not have the powers set out in § 10 paragraph 2, § 12a paragraphs 1 and 2, § 34 letters c, d and f and §§ 35 – 36a.
§ 2c Exceptions: c. Participation in economic competition
1 This Act shall not apply insofar as public bodies participate in economic competition and do not act in a sovereign capacity.
2 The Federal Act on Data Protection shall apply mutatis mutandis to the processing of personal data. Supervision is exercised by the data protection officer in accordance with §§ 30 ff.
§ 3 Terms
1 Public bodies are:
a. the Cantonal Council, the municipal parliaments and the municipal assemblies,
b. Authorities and administrative units of the canton and the municipalities,
c. Organizations and persons under public and private law, insofar as they are entrusted with the performance of public tasks.
2 Information is all records relating to the fulfillment of a public task, regardless of their form of presentation and their information carrier. Records that have not been completed or that are intended exclusively for personal use are excluded.
3 Personal data is information that relates to an identified or identifiable person.
4 Special personal data are:
a. Information which, due to its importance, the nature of its processing or the possibility of its combination with other information, poses a particular risk of personal injury, such as information about
_1._ religious, ideological, political or trade union views or activities,
_2._ health, privacy, ethnic origin and genetic and biometric data,
_3._ Social assistance measures,
_4._ administrative or criminal prosecutions or sanctions.
b. Compilations of information that allow an assessment of essential aspects of the personality of natural persons.
c. automated evaluations of information in order to analyze key personal characteristics or predict personal developments (profiling).
5 Processing is any handling of information such as obtaining, storing, using, reworking, disclosing or destroying.
6 Disclosure is the making available of information such as granting access, passing on or publishing.
II. principles in handling information
1. in general
§ 4 Transparency principle
The public body shall organize the handling of information in such a way that it can provide information quickly, comprehensively and factually.
§ 5 Information management
1 The public body manages its information in such a way that administrative action is comprehensible and accountability is guaranteed. If several public bodies process a joint stock of information, they regulate the responsibilities.
2 If the public body no longer needs information and finding aids for its administrative activities, it shall retain them for a maximum of ten years.
3 At the end of the retention period, the public body shall offer the information and finding aids to the relevant archive. Information that is not archived must be destroyed.
4 For the cantonal administration, the cantonal government regulates the details in an ordinance.
§ 6 Processing on behalf of
1 The public body may delegate the processing of information to third parties, provided there is no legal provision or contractual agreement to the contrary.
2 It remains responsible for the handling of information in accordance with this Act.
§ 7 Information security
1 The public body shall protect information through appropriate organizational and technical measures.
2 The measures are based on the following protection goals:
a. Information must not be disclosed unlawfully,
b. Information must be correct and complete,
c. Information must be available when required,
d. Information processing must be attributable to a person,
e. Changes to information must be recognizable and traceable.
3 The measures to be taken depend on the type of information, the type and purpose of use and the current state of the art.
2. special principles in handling personal data
§ 8 Legality
1 The public body may process personal data insofar as this is appropriate and necessary for the fulfillment of its legally defined tasks.
2 The processing of special personal data requires a sufficiently specific regulation in a formal law.
§ 9 Earmarking
1 The public body may only process personal data for the purpose for which it was collected, unless a legal provision expressly provides for further use or the data subject consents in individual cases.
2 The public body may process personal data for a non-personal purpose if they are anonymized and no conclusions can be drawn about the data subjects from the evaluations.
§ 10 Data protection impact assessment and prior checking
1 The public body assesses the risks to the fundamental rights of the data subjects when processing personal data (data protection impact assessment).
2 It submits any intended processing of personal data with particular risks for the fundamental rights of the data subjects in advance to the data protection officer for review (prior check).
§ 11 Avoidance of personal reference
1 The public body shall design data processing systems and programs in such a way that as little personal data as possible is generated that is not necessary for the fulfillment of tasks.
2 It deletes, anonymizes or pseudonymizes such personal data as soon as and insofar as this is possible.
§ 12 Information on procurement
1 The public body shall inform the data subjects about the procurement of personal data. This also applies to procurement from third parties.
2 The information contains details about
a. the responsible public body,
b. the data obtained or their categories,
c. the legal basis and the purpose of the processing,
d. the data recipients or the categories of data recipients if the data is disclosed to third parties,
e. the rights of the data subject.
3 The obligation to provide information does not apply,
a. if the person concerned already has the information specified in paragraph 2,
b. if the procurement of personal data is provided for by law,
c. if the information is not possible or would require a disproportionate effort,
d. in the cases pursuant to § 23.
§ 12a Obligation to report
1 The responsible public body shall immediately notify the data protection officer of any unauthorized processing or loss of personal data if the fundamental rights of the data subject are at risk.
2 It shall inform the data subject if the circumstances so require or if the data protection officer so requests.
3 It may restrict the information of the data subject in whole or in part if there is an overriding public or private interest to the contrary.
§ 13 Compliance with data protection regulations and quality assurance
1 The public body shall ensure compliance with data protection provisions, in particular through organizational regulations.
2 To ensure the quality of information processing, it may have its procedures, organization and technical facilities audited and evaluated by an independent and recognized body.
3 The Government Council shall regulate the details in an ordinance.
III. disclosure of information
§ 14 Information activities ex officio
1 The public body provides information about its activities of general interest on its own initiative.
2 It provides information on its structure, responsibilities and contact persons.
3 The public body may only provide information on pending proceedings if this is necessary to correct or avoid false reports or if immediate information is required in a particularly serious or sensational case.
4 It shall make a list of its information holdings and their purposes publicly accessible. It identifies information assets that contain personal data.
§ 15 Media
1 The public body shall take the needs of the media into account as far as possible in its information activities.
2 It may provide for the accreditation of media representatives.
§ Section 16 Disclosure of personal data: a. General
1 The public body discloses personal data if
a. authorized to do so by a legal provision,
b. the data subject has consented in the individual case or
c. it is indispensable in the individual case to avert an imminent danger to life and limb or the necessary protection of other essential legal interests is to be given higher priority.
2 It shall also disclose personal data to another public body and to the bodies of other cantons or the Confederation in individual cases if the body requesting the personal data requires it to fulfill its statutory duties.
§ 17 Disclosure of personal data: b. Special personal data
1 The public body shall disclose specific personal data if
a. a sufficiently specific provision in a formal law authorizes this,
b. the data subject has expressly consented to the disclosure of special personal data in individual cases, or
c. it is indispensable in the individual case to avert an imminent danger to life and limb or the necessary protection of other essential legal interests is to be given higher priority.
2 It shall also disclose special personal data to another public body and to the bodies of other cantons or the Confederation in individual cases if the body requesting special personal data requires it to fulfill its statutory duties.
§ 18 Disclosure of personal data: c. For non-personal purposes
1 The public body may disclose personal data for processing for non-personal purposes, unless this is excluded by a legal provision.
2 The recipient must prove that the personal data is anonymized, that no conclusions can be drawn about the data subjects from the evaluations and that the original personal data is destroyed after the evaluation.
§ 19 Disclosure of personal data: d. Cross-border
To recipients not subject to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, the public body shall disclose personal data if
a. adequate protection for the data transfer is guaranteed in the recipient state,
b. a legal basis permits this in order to protect certain interests of the data subject or overriding public interests, or
c. appropriate contractual safeguards are put in place by the public body.
IV. Right of access to information and other legal claims
§ 20 Access to information
1 Every person has the right to access information held by a public body.
2 Every person has the right to access their own personal data.
3 In administrative and administrative justice proceedings that have not been legally concluded, the right of access to information is governed by the applicable procedural law.
§ 21 Protection of personal data
1 The data subject may request the public body to
a. corrects or destroys incorrect personal data,
b. refrains from the unlawful processing of personal data,
c. eliminates the consequences of unlawful processing,
d. establishes the unlawfulness of the processing.
2 If the correction or deletion of personal data is requested and neither its accuracy nor inaccuracy can be established, the public body shall add a note stating that the personal data is disputed. It restricts the processing.
§ 22 Blocking of personal data
1 The data subject may have the disclosure of their personal data to private parties blocked if the public body can disclose personal data without preconditions on the basis of a special statutory provision.
2 The public body shall disclose personal data despite blocking if the requesting person proves that the blocking prevents them from pursuing their own rights against the data subject.
V. Restrictions in individual cases
§ Section 23 Balancing of interests
1 The public body shall refuse to disclose information in whole or in part or postpone it if this is contrary to a legal provision or an overriding public or private interest.
2 A public interest exists in particular if
a. information positions in contract negotiations,
b. the disclosure of the information impairs the opinion-forming process of the public body,
c. the disclosure of the information jeopardizes the effectiveness of investigative, safety or supervisory measures,
d. the disclosure of the information affects relations between the communes, with another canton, with the Confederation or with other countries,
e. the disclosure impairs the targeted implementation of specific official measures.
3 A private interest exists in particular if the privacy of third parties is impaired by the disclosure of the information.
VI. procedure for access to information
§ 24 Application
1 Anyone who wants access to information in accordance with § 20 paragraph 1 must submit a written request.
2 The public body may provide information verbally in response to oral inquiries.
§ 25 Examination of the application
1 The public body may reject a request if it relates to information that is already in the public domain and is available in an appropriate manner. This source must be indicated.
2 If the processing of the request causes the public body a disproportionate effort, it may make access to the information dependent on proof of a legitimate interest on the part of the person making the request.
§ 26 Consultation of affected third parties
1 If the public body wishes to grant access to the information and the request concerns personal data or information classified as confidential, the public body shall give the third parties concerned the opportunity to comment within a reasonable period of time.
2 If the request concerns special personal data, the public body shall reject the request if the third parties concerned do not expressly consent to access.
§ 27 Disposition
1 The public body issues an order if it wishes to refuse, restrict or postpone access to the requested information.
2 If it wishes to grant access to information contrary to the wishes of third parties, it shall inform the third parties concerned of this by means of an order.
§ 28 Time limits
1 The public body shall grant access to the information within 30 days of receipt of the request or issue an order restricting the right of access.
2 If the public body is unable to meet this deadline, it shall inform the applicant before the deadline expires, stating the reasons, when the decision on the application will be available.
§ 29 Fees and charges
1 The public body charges a fee for processing applications from private individuals.
2 No fee is charged
a. when access to information requires little effort,
b. for the processing of applications relating to your own personal data,
c. if the application serves scientific purposes and the results of the processing are expected to be of benefit to the public.
3 If the processing of the application involves considerable costs, the public body shall inform the applicant accordingly. In this case, it may demand an appropriate advance payment.
4 If information is suitable for commercial use, a fee may be charged depending on the market.
VII. Data Protection Officer or Representative
§ 30 Position and salary
1 The Cantonal Council elects a data protection officer for a term of office of four years.
2 The salary of the data protection officer corresponds to 83% of the maximum amount of the highest salary class of cantonal employees.
3 The data protection officer is independent. He or she is administratively assigned to the management of the Cantonal Council.
§ 31 Personnel
1 The personnel law of the canton shall apply to the appointee and his or her staff. The provisions of this Act remain reserved.
2 The Commissioner is responsible for the recruitment and promotion of his or her staff within the framework of the budget approved by the Cantonal Council.
3 *Cancelled.
§ Section 32 Budgeting, controlling and accounting
1 The Officer is subject to the Controlling and Accounting Act (CRG) and the implementing decrees of the Government Council to this Act.
2 He or she has the same spending powers as the Government Council. §§ Sections 19 – 25 CRG apply by analogy.
3 The commissioner shall keep his or her own accounts. He or she submits an annual overview of the development of services and finances, a draft budget and the accounts to the Cantonal Council.
§ 33 Representatives in municipalities and organizations
1 The municipalities and the organizations pursuant to § 3 may appoint their own representatives. The cantonal government may oblige municipalities with at least 50,000 inhabitants to do so.
2 The municipalities and the organizations pursuant to § 3 shall regulate the election and organization independently. They shall ensure that the commissioners have the necessary professional qualifications and are independent in the exercise of their duties and powers. The cantonal commissioner shall exercise overall supervision.
§ 34 Tasks
The commissioner or the commissioner
a. supports and advises public bodies on data protection issues,
b. advises private individuals on their rights,
c. monitors the application of data protection regulations,
d. mediates between data subjects and public bodies in disputes concerning data protection,
e. informs the public about data protection issues,
f. assesses decrees and projects relating to data protection,
g. offers training and further education in data protection issues.
§ Section 35 Control powers
1 Irrespective of any confidentiality obligation, the authorized representative may obtain information about the processing of data from public bodies and commissioned third parties in accordance with § 6, inspect the data and have processing carried out, insofar as this is necessary for his or her activities.
2 The public bodies and authorized third parties shall cooperate in establishing the facts of the case.
§ 36 Recommendations
1 If the Commissioner identifies a breach of data protection provisions, he or she shall make a recommendation to the public body as to what measures should be taken.
2 If the public body does not follow a recommendation, it shall inform the data protection officer, stating the reasons.
§ Section 36a Administrative measures
1 If the public body does not follow a recommendation in the event of a significant breach of data protection provisions, the Commissioner may order the processing to be adapted, interrupted or discontinued in whole or in part and the personal data to be deleted or destroyed in whole or in part.
2 The public body concerned may appeal against rulings by the appointee(s) to the Administrative Court. The parties are the appointee and the public body concerned.
§ Section 37 Cooperation
The commissioner shall cooperate with the bodies of the other cantons, the Confederation and foreign countries that perform the same tasks in order to fulfill the control task pursuant to § 35.
§ 38 Duty of confidentiality
The commissioner and the employees are obliged to maintain the same confidentiality with regard to information of which they become aware in the course of their work as the public body handling the matter.
§ Section 39 Reporting
The commissioner shall periodically report to the electoral body on the scope and focus of activities, on important findings and assessments, and on the effect of the law. The report shall be published.
§ Section 39a Legal protection
1 Appeals may be lodged with the Administrative Delegation of the Executive Board of the Cantonal Council against orders issued by the Commissioner in personnel or administrative matters.
2 The duty of confidentiality pursuant to § 38 also applies to the appeal bodies.
3 In all other respects, legal protection is governed by the Administration of Justice Act of May 24, 1959.
VIII Penal provisions
§ 40 Processing of personal data in breach of contract
1 Anyone who uses personal data for themselves or others or discloses such data to others as an authorized person in accordance with Article 6 without the express authorization of the commissioning public body shall be liable to a fine.
2 The investigation and assessment of infringements is the responsibility of the governor’s offices.
IX. Final and transitional provisions
§ Section 41 Transitional law
The public body may process or disclose information containing special personal data that exists when this Act comes into force for five years after this Act comes into force without the requirements of section 8 paragraph 2 or section 17 paragraph 1 letter a being met.
§ Section 42 Adaptation of designations
1 In the following laws, the term «Data Protection Act» or «Act on the Protection of Personal Data» is replaced by the term «Act on Information and Data Protection»:
a. Law on the outsourcing of IT services: Section 3 (1) and (2),
b. Tax Act: § 122 paragraph 2.
2 In the following laws, the term «particularly sensitive personal data» or «particularly sensitive data» is replaced by the term «special personal data»:
a. Law on the outsourcing of IT services: § 3 para. 1,
b. Financial Control Act: § 25 paragraph 2.
§ Section 43 Repeal of previous law
Upon entry into force of this Act, the Data Protection Act of June 6, 1993 shall be repealed.
§ Section 44 Adaptation of other decrees
The following laws are amended as follows:
a. Law on the Municipal System (Municipalities Act) of June 6, 1926: …
b. Act on the Organization and Rules of Procedure of the Cantonal Council (Cantonal Council Act) of 5 April 1981: …
c. Law on Legal Protection in Administrative Matters (Administrative Jurisdiction Act) of May 24, 1959: …
d. Law on the Employment Relationship of State Personnel (Personnel Act) of September 27, 1998: …
e. Law on the Insurance Fund for State Personnel of June 6, 1993: …
f. Archives Act of September 24, 1995: …
g. Law on public passenger transport of March 6, 1988: …
h. Controlling and Accounting Act (CRG) of January 9, 2006: …