Take-Aways (AI)
- Government Council has approved the total revision of the IDG and submitted the draft and report to the Cantonal Council.
- No comprehensive AI regulations in the IDG; risk-based approach, profiling regulation and list of algorithmic decision-making systems envisaged.
- The principle of publicity is strengthened, new commissioner function introduced; courts exempted from the principle of publicity, data protection still applies.
In its meeting of July 5, 2023, the Government Council of the Canton of Zurich submitted the proposal on the total revision of the Information and Data Protection Act (IDG) to the Cantonal Council. adopted. The annex contains the draft of the new IDG and the report of the government council, i.e., to a certain extent, the message.
The Government Council’s report highlights the following innovations, among others:
- Structure of the IDGThe common features of data protection and the principle of publicity are now regulated in a common section, while the special features are regulated in separate sections.
- A big topic was the issue of Artificial intelligence. The government council has incorporated corresponding concerns selectively, but has refrained from an overarching regulation, because AI applications are used more widely in the canton (cf. the RRB No. 1059/2021). “ ‘Artificial intelligence’ per se does not exist”; rather, this term encompasses a wide variety of processes, technologies and concepts. General principles of data protection and also data security requirements apply; at least the risk-based approach is emphasized more strongly. According to a study, comprehensive regulation would also require changes to the Administrative Justice Act (VRG), for example with regard to procedural guarantees. Profiling is also regulated, which requires a legal basis in a law. Thus, “AI applications in connection with the processing of personal data by public bodies are largely absorbed”; accordingly, there is no need to provide for new legal instruments in the IDG. Furthermore, to the extent that AI is used in the canton, the HERMES project specification already requires a corresponding legal review at a fairly early stage. However, there are selective regulations. For example, public bodies are required to make publicly available a list of the algorithmic decision-making systems they use that have an impact on the fundamental rights of individuals.
- Dishes will no longer be generally exempt from the application of data protection law because this would violate the Schengen Directive. However, they will be exempt from the application of the principle of public access.
- The principle of publicity is to be strengthened. Another new feature is the function of a Representative for the principle of publicity would be introduced, which would be performed by the data protection officer in addition to his or her own staff. This would require an estimated two additional full-time positions. The cost and fee regulations for access to information will also be adjusted.
- New are regulations on government data (Open Government Data) must be created. Open government data must first be identified, described with metadata, and cataloged.
- New is a regulation for Pilot testing analogous to the DSG.
- With the Legal basis it shall be sufficient under certain conditions if a law assigns a task for the fulfillment of which the processing of special personal data is indispensable. In addition, consent may be sufficient as a legal basis for the processing of special personal data, also under certain conditions.