Postu­la­te Alle­man (16.3789): Digi­tizati­on in public trans­port. Chal­lenges in the area of data protection
Rejec­tion of the postu­la­te requested.

Sub­mit­ted text

The Fede­ral Coun­cil is ins­truc­ted to exami­ne and report on the chal­lenges that digi­tizati­on in public trans­port (ÖV), in par­ti­cu­lar in digi­tal ÖV ticke­ting, poses for the hand­ling of data and data pro­tec­tion. In par­ti­cu­lar, it is to be exami­ned what new regu­la­ti­ons are to be made in the fol­lo­wing cases: in which cases per­so­nal data may be recor­ded, how long this data may be retai­ned, for what pur­po­se the data may be used, who is gran­ted access to the data, when data must be anony­mi­zed and deleted.

Justi­fi­ca­ti­on

Digi­tal ticke­ting systems sim­pli­fy the use of public trans­por­ta­ti­on. While other count­ries are alre­a­dy well advan­ced, Switz­er­land is only at the begin­ning of this deve­lo­p­ment. The Swiss Pass is a first step toward nati­on­wi­de digi­tal ticke­ting. But mobi­le pho­ne appli­ca­ti­ons for sol­ving e‑tickets are also beco­ming more wide­spread and allow signi­fi­cant steps to be taken toward incre­a­sing the cus­to­mer-fri­end­li­ness of public transport.

Digi­tizati­on also pres­ents us with new chal­lenges in the area of data pro­tec­tion, among other things. Today, public trans­port com­pa­nies have rela­tively gre­at free­dom in this regard. At the same time, they have a respon­si­bi­li­ty to pre­vent misu­se of the data and to com­ply with data pro­tec­tion regu­la­ti­ons that were crea­ted befo­re digi­tal ticke­ting systems existed.

The Fede­ral Coun­cil is the­r­e­fo­re ins­truc­ted to exami­ne what new chal­lenges digi­tizati­on in public trans­port poses in the area of data pro­tec­tion. In par­ti­cu­lar, it must be exami­ned whe­ther the exi­sting regu­la­ti­ons are suf­fi­ci­ent to take into account the inte­rests of con­su­mers in the pro­tec­tion of their per­so­nal data, or whe­ther addi­tio­nal regu­la­ti­ons are neces­sa­ry. At the same time, howe­ver, it must also be ensu­red that any new regu­la­ti­ons per­mit fur­ther deve­lo­p­ment of digi­tal ticke­ting systems and thus do not block tech­ni­cal developments.

State­ment of the Fede­ral Coun­cil of Novem­ber 16, 2016

The Fede­ral Coun­cil atta­ches gre­at importance to digi­tizati­on. It belie­ves that it opens up major oppor­tu­ni­ties for the deve­lo­p­ment of public trans­port that are in the inte­rests of socie­ty as a who­le. Various issues are being addres­sed, such as how the tech­ni­cal pos­si­bi­li­ties can be opti­mal­ly exploi­ted while at the same time con­tai­ning the risks of misu­se. This is one of the issues addres­sed by the Fede­ral Council’s Digi­tal Switz­er­land Stra­tegy of April 2016, which aims to achie­ve a coher­ent and for­ward-loo­king data poli­cy in the medi­um to long term. Work began in spring 2016, and initi­al results are expec­ted in the second half of 2017.

The legal frame­work for digi­tizati­on in public trans­port can be found in the Data Pro­tec­tion Act and in Artic­le 54 of the Pas­sen­ger Trans­por­ta­ti­on Act.

This Artic­le 54 was alre­a­dy enac­ted with regard to the intro­duc­tion of an elec­tro­nic ticke­ting system. It pro­vi­des a legal basis for pro­ce­s­sing per­so­nal data requi­ring spe­cial pro­tec­tion, inso­far as this is neces­sa­ry for pas­sen­ger trans­por­ta­ti­on. Artic­le 4 of the Data Pro­tec­tion Act also sta­tes that no more data than neces­sa­ry may be pro­ce­s­sed. The­se must be anony­mi­zed or dele­ted after pro­ce­s­sing. Fur­ther­mo­re, the data may only be used for the inten­ded pur­po­ses. The pur­po­ses must be reco­gnizable to the per­sons concerned.

The Asso­cia­ti­on of Public Trans­port (VöV) and SBB are curr­ent­ly exami­ning which data may be pro­ce­s­sed by whom within the frame­work of future fare and ticket models, describ­ing the pre­cise pur­po­ses, and whe­ther a legal basis needs to be crea­ted for this. In this way, the prin­ci­ple of “data pro­tec­tion through tech­no­lo­gy design” is to be taken into account from the out­set. The pro­ject ana­ly­sis pro­du­ced will enable the Fede­ral Data Pro­tec­tion Com­mis­sio­ner (Edöb) to assess whe­ther the plan­ned data pro­ce­s­sing ope­ra­ti­ons com­ply with data pro­tec­tion requirements.

Should the pre­sen­ta­ti­ons of VöV and SBB show that addi­tio­nal legal bases would be requi­red, the pre­pa­ra­ti­on of a dis­patch or the adap­t­ati­on of cor­re­spon­ding ordi­nan­ces would have to be examined.

The con­cern of the postu­la­te to exami­ne whe­ther addi­tio­nal regu­la­ti­ons are neces­sa­ry is the­r­e­fo­re achie­ved. An addi­tio­nal report can be dis­pen­sed with. The Fede­ral Coun­cil will be hap­py to inform the rele­vant par­lia­men­ta­ry com­mit­tees about the results in due course.