Inserted by Annex No 2 of the FA of 14 Dec. 2012, in force since 1 July 2013 (AS 2013 1493; BBl 2011 6703).
English is not an official language of the Swiss Confederation. This translation is provided for information purposes only and has no legal force.
Section 1 Personnel Information and Study Administ
Inserted by No I of the FA of 30 Sept. 2016, in force since 1 May 2017 (AS 2017 151; BBl 2016 3089).
Art. 36a Personnel information systems
1 The ETH Board, the two federal institutes of technology and the four research institutes within the ETH Domain shall each maintain a personnel information system in which sensitive personal data may also be processed. Article 27 FPA applies to the personnel information systems and by analogy to private law terms of employment. 2 The ETH Board may delegate the processing of the data on its personnel to the ETHZ, the EPFL or one of the four research institutes within the ETH Domain. 3 Procedures and processes for the systematic evaluation of data in electronic form may be used in the personnel information systems. 4 The ETH Board shall issue implementing provisions and submit these to the Federal Council for approval.
Art. 36a — Amended by No I of the FA of 19 March 2021, in force since 1 Nov. 2021 (AS 2021 603; BBl 2020 715). Para. 1 — Amended by Annex 1 No II 32 of the Data Protection Act of 25 Sept. 2020, in force since 1 Sept. 2023 (AS 2022 491; BBl 2017 6941). Para. 1 — SR 172.220.1
Art. 36b Study administration systems
1 Both the ETHZ and EPFL shall each administer an information system on prospective students, undergraduate and graduate students, doctoral students and auditors in which sensitive personal data may be processed. 2 These information systems shall be used for: a. admission of prospective students to study programmes and enrolment; b. identifying students and monitoring progress in their studies; c. certifying the obtaining of credits, the issuance of qualifications and the awarding of academic titles; d. providing services relating to studies; e. planning and generating statistics. 3 The following data in particular shall be processed in the information systems: personal data, enrolment data, field of study, course of studies, examination results, credits, qualifications and academic titles, scholarships/grants and fees paid as well as disciplinary and other administrative procedures. 4 Data may be administered exclusively in electronic form. In this case, documents in hardcopy form are
Para. 1 — Amended by Annex 1 No II 32 of the Data Protection Act of 25 Sept. 2020, in force since 1 Sept. 2023 (AS 2022 491; BBl 2017 6941). Para. 5 — Second sentence amended by Annex 1 No II 32 of the Data Protection Act of 25 Sept. 2020, in force since 1 Sept. 2023 (AS 2022 491; BBl 2017 6941).
Section 2 Handling of Personal Data in Research Pr
Inserted by No I of the FA of 30 Sept. 2016, in force since 1 May 2017 (AS 2017 151; BBl 2016 3089).
Art. 36c Data processing
1 Within the scope of research projects, the two federal institutes of technology and the four research institutes within the ETH Domain may process personal data, including sensitive personal data, insofar as this is required for the given project. 2 In doing so, they shall ensure compliance with the provisions of the Data Protection Act of 25 September 2023.
Art. 36c — Amended by Annex 1 No II 32 of the Data Protection Act of 25 Sept. 2020, in force since 1 Sept. 2023 (AS 2022 491; BBl 2017 6941). Para. 2 — SR 235.1
Art. 36d Anonymisation, storage and destruction of data
1 The two federal institutes of technology and four research institutes within the ETH Domain shall ensure that personal data is made anonymous as soon as the purpose of data processing permits and stored for the periods specified by them. 2 If anonymisation is not possible due to the purpose of the research project, personal data used in research may be stored for a maximum of 20 years. 3 After expiry of the maximum storage period, the data must be destroyed; the provisions of the Federal Act of 26 June 1998 on Archiving shall remain reserved.
Para. 3 — SR 152.1
Art. 36e Obligation to inform
1 The two federal institutes of technology and four research institutes within the ETH Domain are required to inform the persons affected regarding the collection and processing of personal data in connection with a specific research project. 2 The obligation to inform shall also apply if the personal data are obtained from third parties. In this case, the two federal institutes of technology and four research institutes within the ETH Domain shall ensure that the third parties fulfil their obligation to inform. If this cannot be guaranteed, the two federal institutes of technology and four research institutes within the ETH Domain shall immediately inform the persons concerned directly.
Section 3 Handling Personal Data for Teaching
Inserted by No I of the FA of 19 March 2021, in force since 1 Nov. 2021 (AS 2021 603; BBl 2020 715).
Art. 36f
1 The two federal institutes of technology and the research institutes may process personal data, including sensitive personal data, in order to develop, use and evaluate teaching methods that use information technologies. 2 They shall ensure compliance with the provisions of the Federal Act of 19 June 1992 on Data Protection.
Para. 2 — SR 235.1