Federal Act
on Controlling Communicable Human Diseases
(Epidemics Act, EpidA)

¹ The FOPH shall op­er­ate the fol­low­ing sys­tems to no­ti­fy per­sons who have po­ten­tially been ex­posed to the Sars-CoV-2 coronavir­us (PT Sys­tem):

a.

a sys­tem that re­cords en­coun­ters between mo­bile tele­phones of per­sons that par­ti­cip­ate in the sys­tem (Prox­im­ity Tra­cing Sys­tem);

b.

a sys­tem that vis­it­ors to events and fa­cil­it­ies may use to re­cord their pres­ence without dis­clos­ing any per­son­al data (Pres­ence Tra­cing Sys­tem).

² The sys­tems and the data pro­cessed may only be used to no­ti­fy per­sons who have been ex­posed to the Sars-CoV-2 coronavir­us and to pro­duce re­lated stat­ist­ics. The sys­tems must not be used for oth­er pur­poses, in par­tic­u­lar by can­ton­al au­thor­it­ies to or­der or en­force meas­ures un­der Art­icles 33–38 or by the po­lice or the pro­sec­u­tion or in­tel­li­gence ser­vices.

³ Par­ti­cip­a­tion in the sys­tems is vol­un­tary for every­one. Au­thor­it­ies, busi­nesses and in­di­vidu­als may not give pref­er­ence to or dis­crim­in­ate against any per­son based on their par­ti­cip­a­tion or non-par­ti­cip­a­tion; any agree­ments to the con­trary shall be in­val­id.

⁴ Any per­son who has been no­ti­fied by either of the sys­tems that they have po­ten­tially been ex­posed to the Sars-CoV-2 coronavir­us shall be en­titled, on provid­ing proof of no­ti­fic­a­tion, to be tested free of charge for in­fec­tion with the coronavir­us.

⁵ The sys­tems shall be de­signed ac­cord­ing to the fol­low­ing prin­ciples:

a.

All ap­pro­pri­ate tech­nic­al and or­gan­isa­tion­al meas­ures shall be taken in re­la­tion to data pro­cessing to make it im­possible to identi­fy the par­ti­cipants.

b.

The data shall as far as pos­sible be pro­cessed on de­cent­ral­ised com­pon­ents in­stalled by the par­ti­cipants on their mo­bile tele­phones. In par­tic­u­lar, data re­cor­ded on a par­ti­cipant's mo­bile tele­phone re­lat­ing to oth­er per­sons shall be pro­cessed and stored ex­clus­ively on that mo­bile tele­phone.

c.

The only data col­lec­ted or pro­cessed by the Prox­im­ity Tra­cing Sys­tem shall be data re­quired to de­term­ine the dis­tance and time of en­coun­ters and to is­sue the no­ti­fic­a­tions; in par­tic­u­lar, no loc­a­tion data shall be re­cor­ded.

d.

The data shall be des­troyed as soon as they are no longer re­quired for the no­ti­fic­a­tion.

e.

The source code and the tech­nic­al spe­cific­a­tions of all com­pon­ents of the sys­tems shall be made pub­lic. It must be evid­ent that the ma­chine-read­able pro­grammes were pro­duced us­ing this source code.

⁶ The fed­er­al le­gis­la­tion on data pro­tec­tion ap­plies.

⁷ The Fed­er­al Coun­cil shall reg­u­late the de­tails on or­gan­ising and op­er­at­ing the sys­tems and on pro­cessing the data.

⁸ The Fed­er­al Coun­cil shall provide for the sys­tems to be ter­min­ated, and in par­tic­u­lar for the de­ac­tiv­a­tion or dein­stall­a­tion of all com­pon­ents in­stalled on mo­bile tele­phones, as soon as the sys­tems are no longer re­quired to man­age the epi­dem­ic caused by the Sars-CoV-2 coronavir­us or if they prove to be in­suf­fi­ciently ef­fect­ive.