Visa Information System-Ordinance (VISO)
English is not an official language of the Swiss Confederation. This translation is provided for information purposes only and has no legal force.
Section 1 Data Processing
Art. 25 Processing principle
Only Swiss authorities may modify the data that they transmit to C-VIS.
Art. 26 Storing the data in ORBIS
1 The ORBIS data shall be stored for a maximum of five years. 2 This period begins: a. in the case of the issue of a visa: on the day that the term of validity expires; b. in the case of the extension of a visa: on the day that new term of validity expires; c. in the event of the withdrawal of the application or the termination or non-continuation of the assessment of an application: on the creation of the application data file in ORBIS; d. in the event that a visa is refused, annulled or revoked: with the corresponding decision of the visa authority.
Art. 27 Deletion of data
1 If a person acquires Swiss citizenship: a. the visa authorities shall immediately delete the application data files in ORBIS relating to the person concerned and if applicable the links with data records of his or her spouse, children or the group with which he or she travelled, provided the application data were recorded by the Swiss authorities; b. SEM shall give immediate notice of this to the Schengen states that recorded the visa data. 2 The citizenship authorities must notify SEM (Visa Principles Section) of the naturalisation. 3 If the decision to refuse a visa is overturned by the competent appellate authority, the data on the refusal of the visa in ORBIS shall be deleted by the authority that refused the visa as soon as the appeal decision is final.
Art. 28 Quality of data
1 If there are indications that C-VIS data or ORBIS data recorded by the Swiss authorities are incorrect or incomplete or have been processed unlawfully, SEM must be notified of this immediately in writing. 2 SEM shall take the required action immediately.
Art. 29 Storing the data from the C-VIS
1 In accordance with Article 30 EU VIS Regulation, C-VIS data may be stored in ZEMIS, in ORBIS, in the RUMACA information system of the Border Guard or in corresponding information systems of the cantonal and communal police authorities if storage is required in the specific case and for as long as the relevant case is being processed. 2 The authorities under Articles 17 and 18 must immediately destroy the data received from the fedpol OC unless they are required for the purposes of the EU VIS Decision. They must destroy the data as soon as they are no longer required. 3 Any use of data in contravention of paragraphs 1 and 2 constitutes an abuse as defined in Article 120d FNIA.
Para. 1 — See footnote to Art. 2 let. a. Para. 1 — Amended by No I of the O of 19 Feb. 2020, in force since 1 April 2020 (AS 2020 917). Para. 2 — See footnote to Art. 21 para. 1.
Art. 30 Disclosure of data to third countries or international organisations
1 The C-VIS data may neither be disclosed to third countries nor to international organisations. 2 The following C-VIS data about a person may be disclosed to third countries or international organisations in accordance with the Annex to the EU VIS Regulation in specific cases in order to prove the identity of a citizen of a third country, including for the purpose of repatriation, if the conditions under Article 31 the EU VIS Regulation are fulfilled: a. first name, surname, name at birth, sex, and date, place and country of birth; b. current nationality and nationality at birth; c. type and number of the travel documents, issuing authority, date of issue and expiry date; d. applicant's home address; e. for minors: first name and surname of the person holding custody or of the guardian. 3 The ORBIS data that are not transmitted to the C-VIS may be disclosed in the specific case in accordance with the conditions set out in Article 105 FNIA.
Para. 2 — See footnote to Art. 2 let. a.
Section 2 Rights of the Persons Concerned
Art. 31 Right to information or to correction or deletion of data
1 If a person asserts his or her right to information in relation to data in ORBIS or in the C-VIS, he or she must submit an application to SEM in the form required by Article 16 of the Data Protection Ordinance of 31 August 2022 (DPO). The assertion of other rights by the data subject is governed by Article 41 of the Data Protection Act of 25 September 2020. 2 SEM shall process the request for information in consultation with the authority that recorded the data in ORBIS, or with the state that transmitted the data to the C-VIS. 3 It shall register the request for information. 4 If a person asserts his or her right to the correction or deletion of C-VIS data that were not recorded by the Swiss authorities, SEM must contact the state that recorded the data within 14 days and must transmit the application to it. SEM shall notify the person concerned of the transmission of the application. 5 It shall process requests for information, correction or deletion immediately. 6 It shall immedia
Para. 1 — SR 235.11 Para. 1 — SR 235.1 Para. 1 — Amended by Annex 2 No II 7 of the Data Protection Ordinance of 31 Aug. 2022, in force since 1 Sept. 2023 (AS 2022 568).
Art. 32 Duty to provide information
1 When procuring personal data on the applicant, including biometric data, the applicant shall be notified in writing of the following: a. the identity and contact details of the data controller; b. the purpose of processing the data in ORBIS and in the C-VIS; c. the recipients or the categories of recipient to whom their personal data will be disclosed; d. the duration of the storage of data in ORBIS and in the C-VIS; e. that the recording of the data is required to assess the application; f. that he or she has a right to information, correction and deletion, the procedure for asserting these rights and how to contact the Federal Data Protection and Information Commissioner (FDPIC). 2 The natural person or legal entity that has invited the applicant or must bear the costs of subsistence during his or her stay shall also receive the information under paragraph 1.
Para. 1 — Amended by Annex 2 No II 7 of the Data Protection Ordinance of 31 Aug. 2022, in force since 1 Sept. 2023 (AS 2022 568). Para. 1 let. a — Amended by Annex 2 No II 7 of the Data Protection Ordinance of 31 Aug. 2022, in force since 1 Sept. 2023 (AS 2022 568). Para. 1 let. c — Amended by Annex 2 No II 7 of the Data Protection Ordinance of 31 Aug. 2022, in force since 1 Sept. 2023 (AS 2022 568).
Art. 33 Liability
Liability for loss or damage in connection with the operation of ORBIS is governed by the Government Liability Act of 14 March 1958, and in particular by its Articles 19a–19c, which apply mutatis mutandis.
SR 170.32
Section 3 Data Security, Advice on Data Protection
Art. 34 Data security
Data security is governed by: a. the DPO; b. the Information Security Ordinance of 8 November 2023; c. ...
let. a — Amended by Annex 2 No II 7 of the Data Protection Ordinance of 31 Aug. 2022, in force since 1 Sept. 2023 (AS 2022 568). let. a — SR 235.11 let. b — Amended by Annex 2 No II 5 of the Information Security Ordinance of 8 Nov. 2023, in force since 1 Jan. 2024 (AS 2023 735). let. b — SR 128.1 let. c — Repealed by Annex No 4 of the O of 24 Feb. 2021, with effect from 1 April 2021 (AS 2021 132).
Art. 35 Statistics
1 In order to fulfil its statutory duties, SEM shall periodically compile statistics based on the data recorded in ORBIS. 2 It shall publish the most important statistics. 3 On request, it may provide authorities, private individuals or organisations with additional statistics that they require. 4 In consultation with the Swiss Federal Statistical Office, it may also compile statistics on the C-VIS. The access rights for this purpose are specified in Annex 3 adopted. 5 The statistics may not permit conclusions to be drawn as to the persons concerned.
Art. 36 Advice on data protection
1 The data protection officer for the FDJP shall provide support to ensure compliance with the data protection regulations. He or she shall coordinate with the federal offices involved so that they fulfil their duties under paragraph 2. 2 The data protection officers for the federal offices involved shall in their particular field ensure: a. that the persons processing data are properly informed; b. that these persons are properly trained; c. that the required checks are carried out; d. that defects are rectified rapidly; e. that the FDJP data protection officer is notified of the need for coordination.
Para. 1 — Amended by No II of the O of 2 Sept. 2015, in force since 1 Oct. 2015 (AS 2015 3047).
Art. 37 Supervision of data processing
1 The cantonal data protection authorities and the FDPIC shall work together within the limits of their respective responsibilities and coordinate supervision of the processing of personal data. 2 The FDPIC shall work with the European Data Protection Commissioner in fulfilling his duties; it is the national contact point for such matters. 3 It is the national authority under Article 41 paragraph 1 EU VIS Regulation and Articles 8 paragraph 5 and 11 EU VIS Decision. It is responsible for fulfilling the duties set out in these articles.
Para. 3 — See footnote to Art. 2 let. a. Para. 3 — See footnote to Art. 21 para. 1.