¹ In order to guarantee an adequate level of data security, the controller and the processor must determine the extent to which personal data requires to be protected and adopt the technical and organisational measures that are appropriate to the risk.

² The extent to which personal data requires to be protected shall be assessed according to the following criteria:

a.

the type of the data being processed;

b.

the purpose, nature, extent and circumstances of the processing.

³ The risk for the personality or fundamental rights of the data subject shall be assessed according to the following criteria:

a.

the causes of the risk;

b.

the main threats;

c.

measures taken or planned to reduce the risk;

d.

the probability and seriousness of a breach of data security despite the measures taken or planned.

⁴ When determining the technical and organisational measures, the following criteria shall also be considered:

a.

the state of the art;

b.

the implementation costs.

⁵ The extent to which personal data requires to be protected, the risk and the technical and organisational measures shall be reviewed throughout the period of processing. The measures shall be adjusted if necessary.

The controller and the processor must take technical and organisational measures in order to ensure, depending on the level of protection required, that the data being processed:

a.

are only accessible to authorised persons (confidentiality);

b.

are available when they are required (availability);

c.

are not altered without authorisation or unintentionally (integrity);

d.

are processed in a traceable manner (traceability).

¹ In order to guarantee confidentiality, the controller and the processor must take appropriate measures to ensure that:

a.

authorised persons only have access to those personal data that they require to fulfil their tasks (data access control);

b.

only authorised persons have access to the premises and facilities in which personal data are processed (premises and facilities access control);

c.

unauthorised persons are unable to use automated data processing systems by means of data transmission devices (user control).

² In order to guarantee availability and integrity, the controller and the processor must take appropriate measures to ensure that:

a.

unauthorised persons are unable to read, copy, alter, move, delete or destroy data carriers (data carrier control);

b.

unauthorised persons are unable to save, read, alter, delete or destroy stored personal data (storage control);

c.

unauthorised persons are unable to read, copy, alter, delete or destroy personal data in the event of the disclosure of personal data or when data carriers are being transported (transport control);

d.

the availability of personal data and access to them can be rapidly restored in the event of a physical or technical incident (restoration);

e.

all functions of the automated data processing system are available (availability), malfunctions are reported (reliability) and stored personal data cannot be damaged by system malfunctions (data integrity);

f.

operating systems and application software always meet the latest security standards and known critical vulnerabilities are resolved (system security).

³ In order to guarantee traceability, the controller and the processor must take appropriate measures to ensure that:

a.

it can be verified what personal data were entered or altered in the automated data processing system at what time and by which person (entry control);

b.

it can be verified to whom personal data are disclosed with the aid of data transmission devices (disclosure control);

c.

breaches of data security are recognised rapidly (recognition) and measures are taken to mitigate or eliminate the consequences (elimination).

¹ If a large volume of sensitive personal data is processed by automated means or if high-risk profiling is carried out and if preventive measures are unable to guarantee data protection, the private controller and its private processor must as a minimum / log the storage, alteration, disclosure, deletion and destruction of the data and any access to the data. A log file must in particular be kept if otherwise it would not be possible to establish whether the data has been processed for the purposes for which it was collected or disclosed.²

² The responsible federal body and its processor shall when carrying out automated processing of sensitive personal data, profiling and automated processing that falls within the scope of Directive (EU) 2016/680³, log as a minimum the storage, alteration, disclosure, deletion and destruction of the data, as well as any access to the data. For other forms of automated data processing, they shall assess in advance the risk to the fundamental rights of the data subjects. On this basis, and taking account of the state of the art and the costs of implementation, they shall determine whether and to what extent they log the aforementioned forms of processing. When assessing the risk, they shall take particular account of the nature of the data processed and the purpose, nature, scope and circumstances of the processing.⁴

^2bis The assessment of the need for logging referred to in paragraph 2 shall be recorded in writing. The results and content of the assessment shall be communicated to the Federal Data Protection and Information Commissioner (FDPIC) on request.⁵

³ In the case of personal data that are generally accessible, logs shall in the case of paragraphs 1 and 2 first sentence as a minimum be kept of the storage, alteration, deletion and destruction of the data.⁶

⁴ The log file must provide information about the identity of the person that carried out the processing, the form, date and time of processing, and, if applicable, the identity of the recipient of the data.

⁵ The log files must be retained for at least one year and kept separate from the system in which the personal data are processed. They may only be made accessible to the bodies and persons that are required to review the application of the data protection regulations or to safeguard or restore the confidentiality, integrity, availability and traceability of the data, and may only be used for this purpose.

¹ The private controller and its private processor must issue regulations on automated processing if they:

a.

process a large volume of sensitive personal data; or

b.

carry out high-risk profiling.

² The regulations must in particular include details of the internal organisational structure, data processing and control procedures and the measures that guarantee data security.

³ The private controller and its private processor must update the regulations regularly. If a data protection officer has been appointed, the regulations must be made available to the officer.

¹ The responsible federal body and its processor must issue processing regulations for automated processing if they:

a.

process sensitive personal data;

b.

carry out profiling;

c.

process personal data in accordance with Article 34 paragraph 2 letter c FADP;

d.

allow cantons, foreign authorities, international organisations or private persons access to personal data;

e.

link data collections with each other; or

f.

operate an information system or manage data collections with other federal authorities.

² The regulations must in particular include details of the internal organisational structure, data processing and control procedures, and the measures that guarantee data security.

³ The responsible federal body and its processor must update the regulations regularly and make them available to the data protection officer.

¹ The prior approval from the controller that allows the processor to assign the data processing to a third party may be specific or general in its scope.

² In the case of general approval, the processor shall inform the controller of any plan to engage additional or replace existing third parties. The controller may object to such changes.

¹ The States, territories, specified sectors in a State and international bodies that guarantee an adequate level of data protection are listed in Annex 1.

² When assessing whether a State, a territory, a specified sector in a State or an international body guarantees an adequate level of data protection, the following criteria in particular shall be considered:

a.

the international obligations of the State or international body, in particular in relation to data protection;

b.

whether it respects the rule of law and human rights;

c.

the legislation applicable, in particular to data protection, its implementation and the relevant case law;

d.

that data subjects' rights and redress are effectively guaranteed;

e.

the effective functioning of one or more independent authorities in the State concerned that are responsible for data protection or to which an international body is accountable and that have sufficient powers and responsibilities.

³ The FDPIC shall be consulted in the course of each assessment. The assessments of international bodies or foreign authorities responsible for data protection may be taken into account.⁷

⁴ The adequacy of the data protection shall be reassessed periodically.

⁵ The assessments shall be made public.

⁶ If the assessment under paragraph 4 or other information show that an adequate level of data protection is no longer guaranteed, Annex 1 shall be amended; this shall have no effect on disclosures of data already carried out.

¹ The data protection clauses in an agreement under Article 16 paragraph 2 letter b FADP and the specific guarantees under Article 16 paragraph 2 letter c FADP must include at least the following points:

a.

the requirement to apply the principles of legality, good faith, proportionality, transparency, purpose limitation and accuracy;

b.

the categories of personal data disclosed and of data subjects;

c.

the manner and purpose of the disclosure of personal data;

d.

if applicable, the names of the countries or international organisations, in which personal data is to be disclosed and the requirements for disclosure;

e.

the requirements for safeguarding, deleting and destroying personal data;

f.

the recipients or the categories of recipients;

g.

the measures to guarantee data security;

h.

the requirement to report breaches of data security;

i.

if the recipients are controllers: the requirement to inform the data subjects about the processing;

j.

the rights of data subjects, and in particular:

1.

the right of access and the right to the data portability,

2.

the right to object to the disclosure of personal data,

3.

the right to the correction, deletion or destruction of their data,

4.

the right to request an independent authority for judicial protection.

² The controller and, in the case of data protection clauses in an agreement, the processor must take appropriate measures to ensure that the recipient complies with these clauses or the specific guarantees.

³ If the FDPIC is informed about the data protection clauses in an agreement or the specific guarantees, the duty to provide information is deemed fulfilled for all further disclosures that:

a.

are made in accordance with the same data protection clauses or guarantees, provided the categories of recipients, purpose of processing and data categories essentially remain unchanged; or

b.

take place within the same legal entity or company or between company that belong to the same group of companies.

¹ If the controller or the processor discloses personal data abroad based on standard data protection clauses in accordance with Article 16 paragraph 2 letter d FADP, it shall take appropriate measures to ensure that the recipient complies therewith.

² The FDPIC shall publish a list of standard data protection clauses that it has approved, issued or recognised. It shall give notice of the result of its assessment of standard data protection clauses that it has been submitted within 90 days.

¹ Binding corporate rules in accordance with Article 16 paragraph 2 letter e FADP apply to all undertakings that belong to the same group of undertakings.

² They shall include as a minimum the points mentioned in Article 9 paragraph 1 as well as the following information:

a.

details of the organisational structure and the contact details for the group of undertakings and its members;

b.

details of the measures taken within the group of undertakings to comply with the binding corporate rules.

³ The FDPIC shall give notice of the result of its assessment of the binding corporate rules that it has been submitted within 90 days.

¹ Personal data may be disclosed abroad if a code of conduct or certification guarantees an appropriate level of data protection.

² The code of conduct must be submitted beforehand to the FDPIC for approval.

³ The code of conduct or certification must be combined with a binding and enforceable obligation for the controller or the processor in the third State to apply the measures contained therein.

¹ Any person who requests information from the controller as to whether personal data relating to him or her are being processed must do so in writing. If the controller agrees, the request may also be made verbally.

² The information shall be provided in writing or in the form in which the data is available. By agreement with the controller, the data subject may inspect his or her data on site. The information may be provided verbally if the data subject agrees.

³ Information may be requested and provided electronically.

⁴ The information must be given to the data subject in a comprehensible form.

⁵ The controller must take appropriate measures to identify the data subject. The data subject is obliged to cooperate in the identification process.

¹ Where two or more controllers are processing personal data jointly, the data subject may exercise his or her right of access in relation to any one of them.

² If the request relates to data that is being processed by one processor, the processor shall assist the controller in providing the information where it does not answer the request on behalf of the controller.

¹ The information must be provided within 30 days of receipt of the request.

² If it is not possible to provide the information within 30 days, the controller must notify the data subject of this and of how long it will take to provide the information.

³ If the controller decides to refuse, restrict or defer the right of access, it must notify the data subject of this within the same deadline.

¹ If providing the information involves a disproportionate cost, the controller may require the data subject to contribute to the costs in an appropriate manner.

² The contribution may not exceed 300 francs.

³ The controller must notify the data subject of the amount of the contribution before providing the information. If the data subject does not confirm the request within ten days, the request is deemed to have been withdrawn with no costs incurred. The period referred to in Article 18 paragraph 1 shall begin on expiry of the ten-day reflection period.

¹ Personal data that the data subject has disclosed to the controller are:

a.

data that the data subject has knowingly and voluntarily made available;

b.

data that the controller has obtained relating to the data subject and his or her behaviour while the data subject was using a service or device.

² Personal data that the controller has itself generated from its own evaluation of the personal data provided or observed are not deemed to be personal data that the data subject has disclosed to the controller.

¹ A conventional electronic format is any format that allows the personal data to be transmitted and reused by the data subject or another controller at a proportionate cost.

² The right to data portability does not create any requirement for the data controller to adopt or maintain technically compatible data processing systems.

³ The cost of transferring personal data to another controller is disproportionate if the transfer is technically impossible.

Articles 16 paragraphs 1 and 5 and 17-19 apply mutatis mutandis to the right to data portability.

Every federal body shall appoint a data protection officer. Two or more federal authorities may appoint a joint data protection officer.

¹ The data protection officer must meet the following requirements:

a.

He or she has the required specialist knowledge.

b.

He or she carries out his or her work in relation to the federal body in a professionally independent manner and is not bound by instructions.

² He or she must carry out the following tasks:

a.

He or she participates in applying the data protection regulations, in particular in that he or she:

1.

examines the processing of personal data and recommends corrective measures if a breach of the data protection regulations is established;

2.

advises the controller on preparing the data protection impact assessment and reviews its implementation.

b.

He or she serves as a contact point for data subjects.

c.

He or she trains and advises employees of the federal body on data protection matters.

¹ The federal body has the following obligations in relation to the data protection officer:

a.

It shall grant him or her access to all information, documents, records of processing activities and personal data that he or she requires to fulfil his or her tasks.

b.

It shall ensure that he or she is notified of any breach of data security.

² It shall publish contact details for the data protection officer online and notify the FDPIC of these details.

The data protection officer serves as the FDPIC's contact point for any questions in connection with the processing of personal data by the federal body concerned.

The federal body shall inform the recipient about the up-to-dateness, reliability and completeness of the personal data that it has disclosed, unless this information is evident from the data themselves or from the circumstances.

If the data subject is not under any obligation to provide information, the responsible federal body shall inform him or her of this fact in relation to any systematic collection of personal data.

¹ The responsible federal body shall notify the FDPIC of any planned automated processing activities at the time that the decision is taken to develop or approve the project.

² Notification must include the details in Article 12 paragraph 2 letters a-d FADP and the anticipated date on which the processing activities will begin.

³ The FDPIC shall record the notification in the register of processing activities.

⁴ The responsible federal body shall update the notification on transition to productive operations or termination of the project.

A pilot trial is mandatory if any one of the following conditions is satisfied:

a.

Fulfilling a task requires technical innovations, the effects of which must first be evaluated.

b.

Fulfilling a task requires significant organisational or technical measures, the effectiveness of which must first be tested, in particular in the case of the cooperation between federal and cantonal authorities.

c.

Fulfilling a task requires personal data to be made accessible in the online search process.

¹ Before consulting the administrative units with an interest, the federal body responsible for the pilot trial shall explain how it planned to comply with the requirements under Article 35 FADP, and invite the FDPIC to provide its opinion.

² The FDPIC shall provide its opinion on whether the authorisation requirements under Article 35 FADP are met. The federal body shall provide it with all the documents required to do this, and in particular:

a.

a general description of the pilot trial;

b.

a report that demonstrates that fulfilling the statutory tasks requires processing under Article 34 paragraph 2 FADP and that a test phase before the act formally comes into force is essential;

c.

a description of the internal organisational structure and the data processing and control procedures;

d.

a description of the security and data protection measures;

e.

the draft of an ordinance that regulates the details of the processing, or the plan for an ordinance;

f.

the plans for the various phases of the pilot trial.

³ The FDPIC may request further documents and conduct additional enquiries.

⁴ The federal body shall inform the FDPIC of any significant change that affects compliance the requirements of Article 35 FADP. The FDPIC shall again provide its opinion if required.

⁵ The FDPIC's opinion shall be included with the application to the Federal Council.

⁶ Automated data processing shall be regulated in an ordinance.

¹ The competent federal body shall submit the draft of the evaluation report for the Federal Council to the FDPIC for the FDPIC to provide an opinion.

² The competent federal body shall submit the evaluation report to the Federal Council with the FDPIC's opinion.

If personal data are processed for purposes not related to specific persons, in particular research, planning and statistics, but at the same time are processed for a different purpose, the exceptions under Article 39 paragraph 2 FADP only apply to the processing for purposes not related to specific persons.