Art. 11a

Register of data files

1 The Commissioner maintains a register of data files that is accessible online. Anyone may consult the register.
2 Federal bodies must declare all their data files to the Commissioner in order to have them registered.
3 Private persons must declare their data files if:
a. they regularly process sensitive personal data or personality profiles; or
b. they regularly disclose personal data to third parties.
4 The data files must be declared before they are opened.
5 In derogation from the provisions in paragraphs 2 and 3, the controller of data files is not required to declare his files if:
a. private persons are processing the data in terms of a statutory obligation;
b. the Federal Council has exempted the processing from the registration requirement because it does not prejudice the rights of the data subjects;
c. he uses the data exclusively for publication in the edited section of a periodically published medium and does not pass on any data to third parties without informing the data subjects;
d. the data is processed by journalists who use the data file exclusively as a personal work aid;
e. he has designated a data protection officer who independently monitors internal compliance with data protection regulations and maintains a list of the data files;
f. he has acquired a data protection quality mark under a certification procedure in accordance with Article 11 and has notified the Commissioner of the result of the evaluation.
6 The Federal Council regulates the modalities for the declaration of data files for registration, the maintenance and the publication of the register, the appointment and duties of the data protection officer under paragraph 5 letter e and the publication of a list of controllers of data files that are relieved of the reporting obligation under paragraph 5 letters e and f.