b. federal bodies.

b. deliberations of the Federal Assembly and in parliamentary committees;

h. federal bodies: federal authorities and services as well as persons who are entrusted with federal public tasks;

i. controller of the data file: private persons or federal bodies that decide on the purpose and content of a data file;

1. federal acts,

2. decrees of international organisations that are binding on Switzerland and international treaties containing legal rules that are approved by the Federal Assembly;

3 The Federal Data Protection and Information Commissioner (the Commissioner, Art. 26) must be informed of the safeguards under paragraph 2 letter a and the data protection rules under paragraph 2 letter g. The Federal Council regulates the details of this duty to provide information.

2 The Federal Council issues detailed provisions on the minimum standards for data security.

5 The information must normally be provided in writing, in the form of a printout or a photocopy, and is free of charge. The Federal Council regulates exceptions.

2 A federal body may further refuse, restrict or defer the provision of information where:

3 As soon as the reason for refusing, restricting or deferring the provision of information ceases to apply, the federal body must provide the information unless this is impossible or only possible with disproportionate inconvenience or expense.

1 In order to improve data protection and data security, the manufacturers of data processing systems or programs as well as private persons or federal bodies that process personal data may submit their systems, procedures and organisation for evaluation by recognised independent certification organisations.

2 The Federal Council shall issue regulations on the recognition of certification procedures and the introduction of a data protection quality label. In doing so, it shall take account of international law and the internationally recognised technical standards.

2 Federal bodies must declare all their data files to the Commissioner in order to have them registered.

b. the Federal Council has exempted the processing from the registration requirement because it does not prejudice the rights of the data subjects;

6 The Federal Council regulates the modalities for the declaration of data files for registration, the maintenance and the publication of the register, the appointment and duties of the data protection officer under paragraph 5 letter e and the publication of a list of controllers of data files that are relieved of the reporting obligation under paragraph 5 letters e and f.

1 The federal body that processes or arranges for the processing of personal data in fulfilment of its tasks is responsible for data protection.

2 If federal bodies process personal data together with other federal bodies, with cantonal bodies or with private persons, the Federal Council may specifically regulate the control of and responsibility for data protection.

1 Federal bodies may process personal data if there is a statutory basis for doing so.

b. the Federal Council authorises processing in an individual case because the rights of the data subject are not endangered; or

1 The Federal Council may, having consulted the Commissioner and before a formal enactment comes into force, approve the automated processing of sensitive personal data or personality profiles if:

b. the fulfilment of a task requires significant organisational or technical measures, the effectiveness of which must first be tested, in particular in the case of cooperation between federal and the cantonal bodies; or

3 The Federal Council shall regulate the modalities of automated data processing in an ordinance.

4 The competent federal body shall provide the Federal Council with an evaluation report at the latest within two years of the pilot system coming into operation. The report contains a proposal on whether the processing should be continued or terminated.

1 In the case of systematic surveys, in particular by means of questionnaires, the federal organ shall disclose the purpose of and the legal basis for the processing, and the categories of persons involved with the data file and of the data recipients.

1 Federal bodies are obliged to inform the data subject of the collection of personal data; this duty to provide information also applies where the data is collected from third parties.

5 If the duty to provide information would compromise the competitiveness of a federal body, the Federal Council may limit the application of the duty to the collection of sensitive personal data and personality profiles.

1 Federal bodies may refuse, restrict or defer the provision of information subject to the requirements of Article 9 paragraphs 1 and 2.

2 As soon as the reason for refusal, restriction or deferral ceases to apply, the federal bodies are bound by the duty to provide information unless compliance is not possible or possible only with disproportionate inconvenience or expense.

1 Federal bodies may disclose personal data if there is legal basis for doing so in accordance with Article 17 or if:

1bis Federal bodies may also disclose personal data within the terms of the official information disclosed to the general public, either ex officio or based on the Freedom of Information Act of 17 December 2004 if:

2 Federal bodies may on request also disclose the name, first name, address and date of birth of a person if the requirements of paragraph1 are not fulfilled.

3 Federal bodies may make personal data accessible online if this is expressly provided for. Sensitive personal data and personality profiles may be made accessible online only if this is expressly provided for in a formal enactment.

3bis Federal bodies may make personal data generally accessible by means of automated information and communication services if a legal basis is provided for the publication of such data or if they make information accessible to the general public on the basis of paragraph1bis. If there is no longer a public interest in the accessibility of such data, the data concerned must be removed from the automated information and communication service.

4 The federal body shall refuse or restrict disclosure, or make it subject to conditions if:

1 A data subject that credibly demonstrates a legitimate interest may request the federal body concerned to block the disclosure of certain personal data.

2 The federal body shall refuse to block disclosure or lift the block if:

1 In accordance with the Archiving Act of 26 June 1998, federal bodies shall offer the Federal Archives all personal data that is no longer in constant use.

2 The federal bodies shall destroy personal data designated by the Federal Archives as not being of archival value unless it:

1 Federal bodies may process personal data for purposes not related to specific persons, and in particular for research, planning and statistics, if:

b. the recipient only discloses the data with the consent of the federal body and

1 If a federal body acts under private law, the provisions for the processing of personal data by private persons apply.

2 Supervision is governed by the provisions on federal bodies.

1 Anyone with a legitimate interest may request the federal body concerned to:

2 If it is not possible to prove the accuracy or the inaccuracy of personal data, the federal body must mark the data correspondingly.

3 The applicant may in particular request that the federal body:

4 The procedure is governed by the Federal Act of 20 December 1968 on Administrative Procedure (Administrative Procedure Act). The exceptions contained in Articles 2 and 3 of the Administrative Procedure Act do not apply.

1 The Commissioner is appointed by the Federal Council for a term of office of four years. The appointment must be approved by the Federal Assembly.

1bis This term of office shall be extended automatically unless the Federal Council has issued an order no less than six months before its expiry based on materially adequate grounds that the term of office should not be extended.

2 The employment relationship is governed by the Federal Personnel Act of 24 March 2000, unless this Act provides otherwise.

3 The Commissioner shall exercise his duties independently, without receiving directives from any authority. He is assigned to the Federal Chancellery for administrative purposes.

5 The Commissioner is not subject to the system of assessment under Article 4 paragraph 3 of the Federal Personnel Act of 24 March 2000.

1bis This term of office shall be extended automatically unless the Federal Council has issued an order based on materially adequate grounds that the term of office should not be extended.

2 The Commissioner may request the Federal Council to be discharged from office at the end of any month subject to six months advance notice.

3 The Federal Council may dismiss the Commissioner from office before the expiry of his term of office if he:

2 The Federal Council may permit the Commissioner to carry on another occupation provided this does not compromise his independence and standing. The decision shall be published.

1 The Commissioner supervises compliance by federal bodies with this Act and other federal data protection regulations of the Confederation. The Federal Council is excluded from such supervision.

3 In investigating cases, he may request the production of files, obtain information and arrange for processed data to be shown to him. The federal bodies must assist in determining the facts of any case. The right to refuse to testify under Article 16 of the Administrative Procedure Act applies by analogy.

4 If the investigation reveals that data protection regulations are being breached, the Commissioner shall recommend that the federal body concerned change the method of processing or abandon the processing. He informs the department concerned or the Federal Chancellery of his recommendation.

5 If a recommendation is not complied with or is rejected, he may refer the matter to the department or to the Federal Chancellery for a decision. The decision is communicated to the data subjects in the form of a ruling.

4 If a recommendation made by the Commissioner is not complied with or is rejected, he may refer the matter to the Federal Administrative Court for a decision. He has the right to appeal against this decision.

1 The Commissioner shall submit a report to the Federal Assembly at regular intervals and as required. He shall provide the Federal Council with a copy of the report at the same time. The regular reports are published.

2 In cases of general interest, he informs the general public of his findings and recommendations. He may only publish personal data subject to official secrecy with consent of the authority responsible. If it refuses its consent, the President of the division of the Federal Administrative Court responsible for data protection makes the final decision.

a. he assists federal and cantonal bodies on data protection issues;

b. he provides an opinion on draft federal legislation and on other federal measures that are relevant to data protection;

2 He may also advise bodies of the Federal Administration even if, in accordance with Article 2 paragraph 2 letters c and d, this Act does not apply. The bodies of the Federal Administration may permit him to inspect their files.

1 Legal protection is governed by the general provisions on the administration of federal justice.

2 If the Commissioner establishes in a case investigation under Article 27 paragraph 2 or under Article 29 paragraph 1 that the data subjects are threatened with a disadvantage that cannot be easily remedied, he may apply to the President of the division of the Federal Administrative Court responsible for data protection for interim measures to be taken. The procedure is governed by analogy by Articles 79–84 of the Federal Act of 4 December 1947 on Federal Civil Procedure.

1 The Federal Council shall issue the implementing provisions.

b. the requirements under which a federal body may arrange for the processing of personal data by a third party or for a third party;

1 Unless there are cantonal data protection regulations that ensure an adequate level of protection, Articles 1–11a, 16, 17, 18–22 and 25 paragraphs 1–3 of this Act apply to the processing of personal data by cantonal bodies in the implementation of federal law.

3 Federal bodies may continue to use an existing data file with sensitive personal data or with personality profiles until 31 December 2000 without fulfilling the requirements of Article 17 paragraph 2.

4 In matters relating to asylum and foreign nationals, the period mentioned in paragraph 3 is extended until the commencement of the totally revised Asylum Act of 26 June 199883 and the amendments to the Federal Act of 26 March 193184 on the Residence and Permanent Settlement of Foreign Nationals.

2 The Federal Council determines the date on which this Act comes into force.