Ordinance
on Data Protection
(Data Protection Ordinance, DPO)

¹ In or­der to guar­an­tee an ad­equate level of data se­cur­ity, the con­trol­ler and the pro­cessor must de­term­ine the ex­tent to which per­son­al data re­quires to be pro­tec­ted and ad­opt the tech­nic­al and or­gan­isa­tion­al meas­ures that are ap­pro­pri­ate to the risk.

² The ex­tent to which per­son­al data re­quires to be pro­tec­ted shall be as­sessed ac­cord­ing to the fol­low­ing cri­ter­ia:

a.

the type of the data be­ing pro­cessed;

b.

the pur­pose, nature, ex­tent and cir­cum­stances of the pro­cessing.

³ The risk for the per­son­al­ity or fun­da­ment­al rights of the data sub­ject shall be as­sessed ac­cord­ing to the fol­low­ing cri­ter­ia:

a.

the causes of the risk;

b.

the main threats;

c.

meas­ures taken or planned to re­duce the risk;

d.

the prob­ab­il­ity and ser­i­ous­ness of a breach of data se­cur­ity des­pite the meas­ures taken or planned.

⁴ When de­term­in­ing the tech­nic­al and or­gan­isa­tion­al meas­ures, the fol­low­ing cri­ter­ia shall also be con­sidered:

a.

the state of the art;

b.

the im­ple­ment­a­tion costs.

⁵ The ex­tent to which per­son­al data re­quires to be pro­tec­ted, the risk and the tech­nic­al and or­gan­isa­tion­al meas­ures shall be re­viewed throughout the peri­od of pro­cessing. The meas­ures shall be ad­jus­ted if ne­ces­sary.

The con­trol­ler and the pro­cessor must take tech­nic­al and or­gan­isa­tion­al meas­ures in or­der to en­sure, de­pend­ing on the level of pro­tec­tion re­quired, that the data be­ing pro­cessed:

a.

are only ac­cess­ible to au­thor­ised per­sons (con­fid­en­ti­al­ity);

b.

are avail­able when they are re­quired (avail­ab­il­ity);

c.

are not altered without au­thor­isa­tion or un­in­ten­tion­ally (in­teg­rity);

d.

are pro­cessed in a trace­able man­ner (trace­ab­il­ity).

¹ In or­der to guar­an­tee con­fid­en­ti­al­ity, the con­trol­ler and the pro­cessor must take ap­pro­pri­ate meas­ures to en­sure that:

a.

au­thor­ised per­sons only have ac­cess to those per­son­al data that they re­quire to ful­fil their tasks (data ac­cess con­trol);

b.

only au­thor­ised per­sons have ac­cess to the premises and fa­cil­it­ies in which per­son­al data are pro­cessed (premises and fa­cil­it­ies ac­cess con­trol);

c.

un­au­thor­ised per­sons are un­able to use auto­mated data pro­cessing sys­tems by means of data trans­mis­sion devices (user con­trol).

² In or­der to guar­an­tee avail­ab­il­ity and in­teg­rity, the con­trol­ler and the pro­cessor must take ap­pro­pri­ate meas­ures to en­sure that:

a.

un­au­thor­ised per­sons are un­able to read, copy, al­ter, move, de­lete or des­troy data car­ri­ers (data car­ri­er con­trol);

b.

un­au­thor­ised per­sons are un­able to save, read, al­ter, de­lete or des­troy stored per­son­al data (stor­age con­trol);

c.

un­au­thor­ised per­sons are un­able to read, copy, al­ter, de­lete or des­troy per­son­al data in the event of the dis­clos­ure of per­son­al data or when data car­ri­ers are be­ing trans­por­ted (trans­port con­trol);

d.

the avail­ab­il­ity of per­son­al data and ac­cess to them can be rap­idly re­stored in the event of a phys­ic­al or tech­nic­al in­cid­ent (res­tor­a­tion);

e.

all func­tions of the auto­mated data pro­cessing sys­tem are avail­able (avail­ab­il­ity), mal­func­tions are re­por­ted (re­li­ab­il­ity) and stored per­son­al data can­not be dam­aged by sys­tem mal­func­tions (data in­teg­rity);

f.

op­er­at­ing sys­tems and ap­plic­a­tion soft­ware al­ways meet the latest se­cur­ity stand­ards and known crit­ic­al vul­ner­ab­il­it­ies are re­solved (sys­tem se­cur­ity).

³ In or­der to guar­an­tee trace­ab­il­ity, the con­trol­ler and the pro­cessor must take ap­pro­pri­ate meas­ures to en­sure that:

a.

it can be veri­fied what per­son­al data were entered or altered in the auto­mated data pro­cessing sys­tem at what time and by which per­son (entry con­trol);

b.

it can be veri­fied to whom per­son­al data are dis­closed with the aid of data trans­mis­sion devices (dis­clos­ure con­trol);

c.

breaches of data se­cur­ity are re­cog­nised rap­idly (re­cog­ni­tion) and meas­ures are taken to mit­ig­ate or elim­in­ate the con­sequences (elim­in­a­tion).

¹ If a large volume of sens­it­ive per­son­al data is pro­cessed by auto­mated means or if high-risk pro­fil­ing is car­ried out and if pre­vent­ive meas­ures are un­able to guar­an­tee data pro­tec­tion, the private con­trol­ler and its private pro­cessor must as a min­im­um / log the stor­age, al­ter­a­tion, read­ing, dis­clos­ure, de­le­tion and de­struc­tion of the data. A log file must in par­tic­u­lar be kept if oth­er­wise it would not be pos­sible to es­tab­lish wheth­er the data has been pro­cessed for the pur­poses for which it was col­lec­ted or dis­closed.

² The re­spons­ible fed­er­al body and its pro­cessor shall in the case of auto­mated pro­cessing of per­son­al data log as a min­im­um the stor­age, al­ter­a­tion, read­ing, dis­clos­ure, de­le­tion and de­struc­tion of the data.

³ In the case of per­son­al data that are gen­er­ally ac­cess­ible to the pub­lic, logs shall be kept as a min­im­um of the stor­age, al­ter­a­tion, de­le­tion and de­struc­tion of the data.

⁴ The log file must provide in­form­a­tion about the iden­tity of the per­son that car­ried out the pro­cessing, the form, date and time of pro­cessing, and, if ap­plic­able, the iden­tity of the re­cip­i­ent of the data.

⁵ The log files must be re­tained for at least one year and kept sep­ar­ate from the sys­tem in which the per­son­al data are pro­cessed. They may only be made ac­cess­ible to the bod­ies and per­sons that are re­quired to re­view the ap­plic­a­tion of the data pro­tec­tion reg­u­la­tions or to safe­guard or re­store the con­fid­en­ti­al­ity, in­teg­rity, avail­ab­il­ity and trace­ab­il­ity of the data, and may only be used for this pur­pose.

¹ The private con­trol­ler and its private pro­cessor must is­sue reg­u­la­tions on auto­mated pro­cessing if they:

a.

pro­cess a large volume of sens­it­ive per­son­al data; or

b.

carry out high-risk pro­fil­ing.

² The reg­u­la­tions must in par­tic­u­lar in­clude de­tails of the in­tern­al or­gan­isa­tion­al struc­ture, data pro­cessing and con­trol pro­ced­ures and the meas­ures that guar­an­tee data se­cur­ity.

³ The private con­trol­ler and its private pro­cessor must up­date the reg­u­la­tions reg­u­larly. If a data pro­tec­tion of­ficer has been ap­poin­ted, the reg­u­la­tions must be made avail­able to the of­ficer.

¹ The re­spons­ible fed­er­al body and its pro­cessor must is­sue pro­cessing reg­u­la­tions for auto­mated pro­cessing if they:

a.

pro­cess sens­it­ive per­son­al data;

b.

carry out pro­fil­ing;

c.

pro­cess per­son­al data in ac­cord­ance with Art­icle 34 para­graph 2 let­ter c FADP;

d.

al­low can­tons, for­eign au­thor­it­ies, in­ter­na­tion­al or­gan­isa­tions or private per­sons ac­cess to per­son­al data;

e.

link data col­lec­tions with each oth­er; or

f.

op­er­ate an in­form­a­tion sys­tem or man­age data col­lec­tions with oth­er fed­er­al au­thor­it­ies.

² The reg­u­la­tions must in par­tic­u­lar in­clude de­tails of the in­tern­al or­gan­isa­tion­al struc­ture, data pro­cessing and con­trol pro­ced­ures, and the meas­ures that guar­an­tee data se­cur­ity.

³ The re­spons­ible fed­er­al body and its pro­cessor must up­date the reg­u­la­tions reg­u­larly and make them avail­able to the data pro­tec­tion of­ficer.

¹ The pri­or ap­prov­al from the con­trol­ler that al­lows the pro­cessor to as­sign the data pro­cessing to a third party may be spe­cif­ic or gen­er­al in its scope.

² In the case of gen­er­al ap­prov­al, the pro­cessor shall in­form the con­trol­ler of any plan to en­gage ad­di­tion­al or re­place ex­ist­ing third parties. The con­trol­ler may ob­ject to such changes.

¹ The States, ter­rit­or­ies, spe­cified sec­tors in a State and in­ter­na­tion­al bod­ies that guar­an­tee an ad­equate level of data pro­tec­tion are lis­ted in An­nex 1.

² When as­sess­ing wheth­er a State, a ter­rit­ory, a spe­cified sec­tor in a State or an in­ter­na­tion­al body guar­an­tees an ad­equate level of data pro­tec­tion, the fol­low­ing cri­ter­ia in par­tic­u­lar shall be con­sidered:

a.

the in­ter­na­tion­al ob­lig­a­tions of the State or in­ter­na­tion­al body, in par­tic­u­lar in re­la­tion to data pro­tec­tion;

b.

wheth­er it re­spects the rule of law and hu­man rights;

c.

the le­gis­la­tion ap­plic­able, in par­tic­u­lar to data pro­tec­tion, its im­ple­ment­a­tion and the rel­ev­ant case law;

d.

that data sub­jects’ rights and re­dress are ef­fect­ively guar­an­teed;

e.

the ef­fect­ive func­tion­ing of one or more in­de­pend­ent au­thor­it­ies in the State con­cerned that are re­spons­ible for data pro­tec­tion or to which an in­ter­na­tion­al body is ac­count­able and that have suf­fi­cient powers and re­spons­ib­il­it­ies.

³ The Fed­er­al Data Pro­tec­tion and In­form­a­tion Com­mis­sion­er (FD­PIC) shall be con­sul­ted in the course of each as­sess­ment. The as­sess­ments of in­ter­na­tion­al bod­ies or for­eign au­thor­it­ies re­spons­ible for data pro­tec­tion may be taken in­to ac­count.

⁴ The ad­equacy of the data pro­tec­tion shall be re­as­sessed peri­od­ic­ally.

⁵ The as­sess­ments shall be made pub­lic.

⁶ If the as­sess­ment un­der para­graph 4 or oth­er in­form­a­tion show that an ad­equate level of data pro­tec­tion is no longer guar­an­teed, An­nex 1 shall be amended; this shall have no ef­fect on dis­clos­ures of data already car­ried out.

¹ The data pro­tec­tion clauses in an agree­ment un­der Art­icle 16 para­graph 2 let­ter b FADP and the spe­cif­ic guar­an­tees un­der Art­icle 16 para­graph 2 let­ter c FADP must in­clude at least the fol­low­ing points:

a.

the re­quire­ment to ap­ply the prin­ciples of leg­al­ity, good faith, pro­por­tion­al­ity, trans­par­ency, pur­pose lim­it­a­tion and ac­cur­acy;

b.

the cat­egor­ies of per­son­al data dis­closed and of data sub­jects;

c.

the man­ner and pur­pose of the dis­clos­ure of per­son­al data;

d.

if ap­plic­able, the names of the coun­tries or in­ter­na­tion­al or­gan­isa­tions, in which per­son­al data is to be dis­closed and the re­quire­ments for dis­clos­ure;

e.

the re­quire­ments for safe­guard­ing, de­let­ing and des­troy­ing per­son­al data;

f.

the re­cip­i­ents or the cat­egor­ies of re­cip­i­ents;

g.

the meas­ures to guar­an­tee data se­cur­ity;

h.

the re­quire­ment to re­port breaches of data se­cur­ity;

i.

if the re­cip­i­ents are con­trol­lers: the re­quire­ment to in­form the data sub­jects about the pro­cessing;

j.

the rights of data sub­jects, and in par­tic­u­lar:

1.

the right of ac­cess and the right to the data port­ab­il­ity,

2.

the right to ob­ject to the dis­clos­ure of per­son­al data,

3.

the right to the cor­rec­tion, de­le­tion or de­struc­tion of their data,

4.

the right to re­quest an in­de­pend­ent au­thor­ity for ju­di­cial pro­tec­tion.

² The con­trol­ler and, in the case of data pro­tec­tion clauses in an agree­ment, the pro­cessor must take ap­pro­pri­ate meas­ures to en­sure that the re­cip­i­ent com­plies with these clauses or the spe­cif­ic guar­an­tees.

³ If the FD­PIC is in­formed about the data pro­tec­tion clauses in an agree­ment or the spe­cif­ic guar­an­tees, the duty to provide in­form­a­tion is deemed ful­filled for all fur­ther dis­clos­ures that:

a.

are made in ac­cord­ance with the same data pro­tec­tion clauses or guar­an­tees, provided the cat­egor­ies of re­cip­i­ents, pur­pose of pro­cessing and data cat­egor­ies es­sen­tially re­main un­changed; or

b.

take place with­in the same leg­al en­tity or com­pany or between com­pany that be­long to the same group of com­pan­ies.

¹ If the con­trol­ler or the pro­cessor dis­closes per­son­al data abroad based on stand­ard data pro­tec­tion clauses in ac­cord­ance with Art­icle 16 para­graph 2 let­ter d FADP, it shall take ap­pro­pri­ate meas­ures to en­sure that the re­cip­i­ent com­plies there­with.

² The FD­PIC shall pub­lish a list of stand­ard data pro­tec­tion clauses that it has ap­proved, is­sued or re­cog­nised. It shall give no­tice of the res­ult of its as­sess­ment of stand­ard data pro­tec­tion clauses that it has been sub­mit­ted with­in 90 days.

¹ Bind­ing cor­por­ate rules in ac­cord­ance with Art­icle 16 para­graph 2 let­ter e FADP ap­ply to all un­der­tak­ings that be­long to the same group of un­der­tak­ings.

² They shall in­clude as a min­im­um the points men­tioned in Art­icle 9 para­graph 1 as well as the fol­low­ing in­form­a­tion:

a.

de­tails of the or­gan­isa­tion­al struc­ture and the con­tact de­tails for the group of un­der­tak­ings and its mem­bers;

b.

de­tails of the meas­ures taken with­in the group of un­der­tak­ings to com­ply with the bind­ing cor­por­ate rules.

³ The FD­PIC shall give no­tice of the res­ult of its as­sess­ment of the bind­ing cor­por­ate rules that it has been sub­mit­ted with­in 90 days.

¹ Per­son­al data may be dis­closed abroad if a code of con­duct or cer­ti­fic­a­tion guar­an­tees an ap­pro­pri­ate level of data pro­tec­tion.

² The code of con­duct must be sub­mit­ted be­fore­hand to the FD­PIC for ap­prov­al.

³ The code of con­duct or cer­ti­fic­a­tion must be com­bined with a bind­ing and en­force­able ob­lig­a­tion for the con­trol­ler or the pro­cessor in the third State to ap­ply the meas­ures con­tained therein.

The con­trol­ler must provide the data sub­ject with in­form­a­tion on the col­lec­tion of per­son­al data in a pre­cise, trans­par­ent, com­pre­hens­ible and eas­ily ac­cess­ible form.

The con­trol­ler must re­tain the data pro­tec­tion im­pact as­sess­ment after con­clud­ing the data pro­cessing for a min­im­um of two years.

¹ The re­port to the FD­PIC of a breach of data se­cur­ity must in­clude the fol­low­ing in­form­a­tion:

a.

the form of breach;

b.

the time and dur­a­tion, if pos­sible;

c.

the cat­egor­ies and ap­prox­im­ate amount of per­son­al data con­cerned, if pos­sible;

d.

the cat­egor­ies and the ap­prox­im­ate num­ber of data sub­jects, if pos­sible;

e.

the con­sequences, in­clud­ing any risks, for the data sub­jects;

f.

the meas­ures that have been taken or are planned in or­der to rem­edy the breach and mit­ig­ate the con­sequences, in­clud­ing any risks;

g.

the name and the con­tact de­tails of a con­tact per­son.

² If the con­trol­ler is un­able to re­port all the de­tails at one time, it shall sup­ply the miss­ing de­tails as quickly as pos­sible.

³ If the con­trol­ler is re­quired to in­form the data sub­ject, it shall provide the data sub­ject with the de­tails spe­cified in para­graph 1 let­ters a and e–g in simple and com­pre­hens­ible lan­guage.

⁴ The con­trol­ler must doc­u­ment the breaches. The doc­u­ment­a­tion must con­tain a sum­mary of the cir­cum­stances of the in­cid­ents, their ef­fects and the meas­ures taken. It shall be re­tained from the time of the re­port un­der para­graph 1 for a min­im­um of two years.

¹ Any per­son who re­quests in­form­a­tion from the con­trol­ler as to wheth­er per­son­al data re­lat­ing to him or her are be­ing pro­cessed must do so in writ­ing. If the con­trol­ler agrees, the re­quest may also be made verbally.

² The in­form­a­tion shall be provided in writ­ing or in the form in which the data is avail­able. By agree­ment with the con­trol­ler, the data sub­ject may in­spect his or her data on site. The in­form­a­tion may be provided verbally if the data sub­ject agrees.

³ In­form­a­tion may be re­ques­ted and provided elec­tron­ic­ally.

⁴ The in­form­a­tion must be giv­en to the data sub­ject in a com­pre­hens­ible form.

⁵ The con­trol­ler must take ap­pro­pri­ate meas­ures to identi­fy the data sub­ject. The data sub­ject is ob­liged to co­oper­ate in the iden­ti­fic­a­tion pro­cess.

¹ Where two or more con­trol­lers are pro­cessing per­son­al data jointly, the data sub­ject may ex­er­cise his or her right of ac­cess in re­la­tion to any one of them.

² If the re­quest relates to data that is be­ing pro­cessed by one pro­cessor, the pro­cessor shall as­sist the con­trol­ler in provid­ing the in­form­a­tion where it does not an­swer the re­quest on be­half of the con­trol­ler.

¹ The in­form­a­tion must be provided with­in 30 days of re­ceipt of the re­quest.

² If it is not pos­sible to provide the in­form­a­tion with­in 30 days, the con­trol­ler must no­ti­fy the data sub­ject of this and of how long it will take to provide the in­form­a­tion.

³ If the con­trol­ler de­cides to re­fuse, re­strict or de­fer the right of ac­cess, it must no­ti­fy the data sub­ject of this with­in the same dead­line.

¹ If provid­ing the in­form­a­tion in­volves a dis­pro­por­tion­ate cost, the con­trol­ler may re­quire the data sub­ject to con­trib­ute to the costs in an ap­pro­pri­ate man­ner.

² The con­tri­bu­tion may not ex­ceed 300 francs.

³ The con­trol­ler must no­ti­fy the data sub­ject of the amount of the con­tri­bu­tion be­fore provid­ing the in­form­a­tion. If the data sub­ject does not con­firm the re­quest with­in ten days, the re­quest is deemed to have been with­drawn with no costs in­curred. The peri­od re­ferred to in Art­icle 18 para­graph 1 shall be­gin on ex­piry of the ten-day re­flec­tion peri­od.

¹ Per­son­al data that the data sub­ject has dis­closed to the con­trol­ler are:

a.

data that the data sub­ject has know­ingly and vol­un­tar­ily made avail­able;

b.

data that the con­trol­ler has ob­tained re­lat­ing to the data sub­ject and his or her be­ha­viour while the data sub­ject was us­ing a ser­vice or device.

² Per­son­al data that the con­trol­ler has it­self gen­er­ated from its own eval­u­ation of the per­son­al data provided or ob­served are not deemed to be per­son­al data that the data sub­ject has dis­closed to the con­trol­ler.

¹ A con­ven­tion­al elec­tron­ic format is any format that al­lows the per­son­al data to be trans­mit­ted and re­used by the data sub­ject or an­oth­er con­trol­ler at a pro­por­tion­ate cost.

² The right to data port­ab­il­ity does not cre­ate any re­quire­ment for the data con­trol­ler to ad­opt or main­tain tech­nic­ally com­pat­ible data pro­cessing sys­tems.

³ The cost of trans­fer­ring per­son­al data to an­oth­er con­trol­ler is dis­pro­por­tion­ate if the trans­fer is tech­nic­ally im­possible.

Art­icles 16 para­graphs 1 and 5 and 17–19 ap­ply mu­tatis mutandis to the right to data port­ab­il­ity.

The con­trol­ler must grant the data pro­tec­tion of­ficer:

a.

ac­cess to the re­quired re­sources;

b.

ac­cess to all in­form­a­tion, doc­u­ments, re­cords of pro­cessing activ­it­ies and per­son­al data that the of­ficer re­quires to ful­fil his or her tasks;

c.

the right to no­ti­fy the highest man­age­ment or gov­ern­ing body in im­port­ant cases.

Un­der­tak­ings and oth­er private or­gan­isa­tions em­ploy­ing few­er than 250 em­ploy­ees on 1 Janu­ary of any year and nat­ur­al per­sons are ex­empt from the ob­lig­a­tion to keep a re­cord of pro­cessing activ­it­ies un­less any one of the fol­low­ing re­quire­ments is met:

a.

a large volume of sens­it­ive per­son­al data is be­ing pro­cessed;

b.

high-risk pro­fil­ing is be­ing car­ried out.

Every fed­er­al body shall ap­point a data pro­tec­tion of­ficer. Two or more fed­er­al au­thor­it­ies may ap­point a joint data pro­tec­tion of­ficer.

¹ The data pro­tec­tion of­ficer must meet the fol­low­ing re­quire­ments:

a.

He or she has the re­quired spe­cial­ist know­ledge.

b.

He or she car­ries out his or her work in re­la­tion to the fed­er­al body in a pro­fes­sion­ally in­de­pend­ent man­ner and is not bound by in­struc­tions.

² He or she must carry out the fol­low­ing tasks:

a.

He or she par­ti­cip­ates in ap­ply­ing the data pro­tec­tion reg­u­la­tions, in par­tic­u­lar in that he or she:

1.

ex­am­ines the pro­cessing of per­son­al data and re­com­mends cor­rect­ive meas­ures if a breach of the data pro­tec­tion reg­u­la­tions is es­tab­lished;

2.

ad­vises the con­trol­ler on pre­par­ing the data pro­tec­tion im­pact as­sess­ment and re­views its im­ple­ment­a­tion.

b.

He or she serves as a con­tact point for data sub­jects.

c.

He or she trains and ad­vises em­ploy­ees of the fed­er­al body on data pro­tec­tion mat­ters.

¹ The fed­er­al body has the fol­low­ing ob­lig­a­tions in re­la­tion to the data pro­tec­tion of­ficer:

a.

It shall grant him or her ac­cess to all in­form­a­tion, doc­u­ments, re­cords of pro­cessing activ­it­ies and per­son­al data that he or she re­quires to ful­fil his or her tasks.

b.

It shall en­sure that he or she is no­ti­fied of any breach of data se­cur­ity.

² It shall pub­lish con­tact de­tails for the data pro­tec­tion of­ficer on­line and no­ti­fy the FD­PIC of these de­tails.

The data pro­tec­tion of­ficer serves as the FD­PIC’s con­tact point for any ques­tions in con­nec­tion with the pro­cessing of per­son­al data by the fed­er­al body con­cerned.

The fed­er­al body shall in­form the re­cip­i­ent about the up-to-date­ness, re­li­ab­il­ity and com­plete­ness of the per­son­al data that it has dis­closed, un­less this in­form­a­tion is evid­ent from the data them­selves or from the cir­cum­stances.

If the data sub­ject is not un­der any ob­lig­a­tion to provide in­form­a­tion, the re­spons­ible fed­er­al body shall in­form him or her of this fact in re­la­tion to any sys­tem­at­ic col­lec­tion of per­son­al data.

¹ The re­spons­ible fed­er­al body shall no­ti­fy the FD­PIC of any planned auto­mated pro­cessing activ­it­ies at the time that the de­cision is taken to de­vel­op or ap­prove the pro­ject.

² No­ti­fic­a­tion must in­clude the de­tails in Art­icle 12 para­graph 2 let­ters a–d FADP and the an­ti­cip­ated date on which the pro­cessing activ­it­ies will be­gin.

³ The FD­PIC shall re­cord the no­ti­fic­a­tion in the re­gister of pro­cessing activ­it­ies.

⁴ The re­spons­ible fed­er­al body shall up­date the no­ti­fic­a­tion on trans­ition to pro­duct­ive op­er­a­tions or ter­min­a­tion of the pro­ject.

A pi­lot tri­al is man­dat­ory if any one of the fol­low­ing con­di­tions is sat­is­fied:

a.

Ful­filling a task re­quires tech­nic­al in­nov­a­tions, the ef­fects of which must first be eval­u­ated.

b.

Ful­filling a task re­quires sig­ni­fic­ant or­gan­isa­tion­al or tech­nic­al meas­ures, the ef­fect­ive­ness of which must first be tested, in par­tic­u­lar in the case of the co­oper­a­tion between fed­er­al and can­ton­al au­thor­it­ies.

c.

Ful­filling a task re­quires per­son­al data to be made ac­cess­ible in the on­line search pro­cess.

¹ Be­fore con­sult­ing the ad­min­is­trat­ive units with an in­terest, the fed­er­al body re­spons­ible for the pi­lot tri­al shall ex­plain how it planned to com­ply with the re­quire­ments un­der Art­icle 35 FADP, and in­vite the FD­PIC to provide its opin­ion.

² The FD­PIC shall provide its opin­ion on wheth­er the au­thor­isa­tion re­quire­ments un­der Art­icle 35 FADP are met. The fed­er­al body shall provide it with all the doc­u­ments re­quired to do this, and in par­tic­u­lar:

a.

a gen­er­al de­scrip­tion of the pi­lot tri­al;

b.

a re­port that demon­strates that ful­filling the stat­utory tasks re­quires pro­cessing un­der Art­icle 34 para­graph 2 FADP and that a test phase be­fore the act form­ally comes in­to force is es­sen­tial;

c.

a de­scrip­tion of the in­tern­al or­gan­isa­tion­al struc­ture and the data pro­cessing and con­trol pro­ced­ures;

d.

a de­scrip­tion of the se­cur­ity and data pro­tec­tion meas­ures;

e.

the draft of an or­din­ance that reg­u­lates the de­tails of the pro­cessing, or the plan for an or­din­ance;

f.

the plans for the vari­ous phases of the pi­lot tri­al.

³ The FD­PIC may re­quest fur­ther doc­u­ments and con­duct ad­di­tion­al en­quir­ies.

⁴ The fed­er­al body shall in­form the FD­PIC of any sig­ni­fic­ant change that af­fects com­pli­ance the re­quire­ments of Art­icle 35 FADP. The FD­PIC shall again provide its opin­ion if re­quired.

⁵ The FD­PIC’s opin­ion shall be in­cluded with the ap­plic­a­tion to the Fed­er­al Coun­cil.

⁶ Auto­mated data pro­cessing shall be reg­u­lated in an or­din­ance.

¹ The com­pet­ent fed­er­al body shall sub­mit the draft of the eval­u­ation re­port for the Fed­er­al Coun­cil to the FD­PIC for the FD­PIC to provide an opin­ion.

² The com­pet­ent fed­er­al body shall sub­mit the eval­u­ation re­port to the Fed­er­al Coun­cil with the FD­PIC’s opin­ion.

If per­son­al data are pro­cessed for pur­poses not re­lated to spe­cif­ic per­sons, in par­tic­u­lar re­search, plan­ning and stat­ist­ics, but at the same time are pro­cessed for a dif­fer­ent pur­pose, the ex­cep­tions un­der Art­icle 39 para­graph 2 FADP only ap­ply to the pro­cessing for pur­poses not re­lated to spe­cif­ic per­sons.

¹ The seat of the FD­PIC is in Bern.

² The fed­er­al le­gis­la­tion on per­son­nel gov­erns the em­ploy­ment con­tracts of the em­ploy­ees of the FD­PIC’s per­man­ent sec­ret­ari­at. The em­ploy­ees shall be in­sured with the Fed­er­al Pen­sion Fund.

¹ The FD­PIC shall com­mu­nic­ate with the Fed­er­al Coun­cil via the Fed­er­al Chan­cel­lor. The Fed­er­al Chan­cel­lor shall pass on the FCPIC’s pro­pos­als, opin­ions and re­ports un­ed­ited the Fed­er­al Coun­cil.

² The FD­PIC shall sub­mit re­ports to the Fed­er­al As­sembly via the Par­lia­ment­ary Ser­vices.

¹ The de­part­ments and the Fed­er­al Chan­cellery shall no­ti­fy the FD­PIC of their de­cisions in an­onymised form and of their guidelines re­lat­ing to data pro­tec­tion.

² The fed­er­al au­thor­it­ies shall sub­mit all le­gis­lat­ive drafts to the FD­PIC that re­late to the pro­cessing of per­son­al data, data pro­tec­tion and ac­cess to of­fi­cial doc­u­ments.

The FD­PIC may pro­cess per­son­al data, in­clud­ing sens­it­ive per­son­al data, for the fol­low­ing pur­poses in par­tic­u­lar:

a.

in or­der to carry out its su­per­vis­ory activ­it­ies;

b.

in or­der to carry out its ad­vis­ory activ­it­ies;

c.

in or­der to co­oper­ate with fed­er­al, can­ton­al and for­eign au­thor­it­ies;

d.

in or­der to ful­fil tasks in terms of the crim­in­al pro­vi­sions in the FADP;

e.

in or­der to con­duct me­di­ation pro­ceed­ings and to is­sue re­com­mend­a­tions un­der the Free­dom of In­form­a­tion Act of 17 Decem­ber 2004² (FoIA);

f.

in or­der to con­duct eval­u­ations un­der the FoIA;

g.

in or­der to con­duct pro­ceed­ings for ac­cess to of­fi­cial doc­u­ments un­der the FoIA;

h.

in or­der to provide in­form­a­tion to the par­lia­ment­ary su­per­vis­ory au­thor­it­ies;

i.

in or­der to provide in­form­a­tion to the pub­lic;

j.

in or­der to carry out its train­ing activ­it­ies.

The FD­PIC shall is­sue pro­cessing reg­u­la­tions for all auto­mated pro­cessing; Art­icle 6 para­graph 1 does not ap­ply.

¹ The FD­PIC may, with the con­sent of the con­trol­ler con­cerned, for­ward the re­port of a breach of data se­cur­ity to the Na­tion­al Cy­ber­se­cur­ity Centre (NC­SC) for the pur­pose of ana­lys­ing the in­cid­ent. The re­port may con­tain per­son­al data.

² The FD­PIC shall in­vite the NC­SC to com­ment be­fore it or­ders the fed­er­al body to take meas­ures un­der Art­icle 8 FADP.

¹ The re­gister of the pro­cessing activ­it­ies by fed­er­al au­thor­it­ies shall con­tain the de­tails provided by the fed­er­al au­thor­it­ies in ac­cord­ance with Art­icle 12 para­graph 2 FADP and Art­icle 31 para­graph 2 this Or­din­ance.

² It shall be pub­lished on­line. The re­gister entries on planned auto­mated pro­cessing activ­it­ies un­der Art­icle 31 shall not be pub­lished.

If a code of con­duct is sub­mit­ted to the FD­PIC, the FD­PIC shall con­firm in its opin­ion wheth­er the code of con­duct meets the re­quire­ments of Art­icle 22 para­graph 5 let­ters a and b FADP.

¹ The fees charged by the FD­PIC shall be cal­cu­lated on the basis of the time taken.

² An hourly rate of 150 to 250 francs ap­plies, de­pend­ing on the seni­or­ity of the mem­bers of staff car­ry­ing out the work.

³ In the case of ser­vices that are ex­cep­tion­ally ex­tens­ive, com­plex or ur­gent, a sur­charge of up to 50 per cent of the fee un­der para­graph 2 may be ad­ded.

⁴ If the ser­vice provided by the FD­PIC can be com­mer­cially ex­ploited by the per­son li­able to pay the fee, a sur­charge of up to 100 per cent of the fee un­der para­graph 2 may be ad­ded.

⁵ The Gen­er­al Fees Or­din­ance of 8 Septem­ber 2004⁴ also ap­plies.

The re­peal and the amend­ment of oth­er le­gis­la­tion are reg­u­lated in An­nex 2.

¹ For data pro­cessing that does not fall with­in the scope of Dir­ect­ive (EU) 2016/680⁵, Art­icle 4 para­graph 2 starts to ap­ply at the latest three years after this Or­din­ance comes in­to force or at the latest at the end of the sys­tem’s li­fe­cycle. In the in­ter­ven­ing peri­od, pro­cessing is gov­erned by Art­icle 4 para­graph 1.

² Art­icle 8 para­graph 5 does not ap­ply to as­sess­ments car­ried out be­fore this Or­din­ance comes in­to force.

³ Art­icle 31 does not ap­ply to planned auto­mated pro­cessing activ­it­ies in re­spect of which the de­cision to de­vel­op or ap­prove the pro­ject has already been taken when this Or­din­ance comes in­to force.

This Or­din­ance comes in­to force on 1 Septem­ber 2023.