This Ordinance regulates the details of the organisation, operation and data processing of the Proximity Tracing System for the Sars-CoV-2 coronavirus under Article 60a EpidA (PT System).

¹ The PT System comprises the following components:

a.

a proximity data management system (the PDM System), consisting of a software application that users install on their smartphones (the SwissCovid app), and a back end (PDM back end);

b.

a system for managing codes for releasing the notifications (the code management system), consisting of a web-based front end and a back end.

² The PDM back end and the code management system are operated as a central server by the Federal Office of Public Health (FOPH).

¹ Installation and use of the SwissCovid app are voluntary.

² The express consent of the infected person is required before a notification is sent to app users who have potentially been exposed to the coronavirus.

The FOPH is the federal authority responsible for all components of the PT System under data protection law.

¹ During basic operations, the PDM back end makes its content available online to the SwissCovid apps. The content comprises a list with the following data:

a.

the private keys of infected app users which were effective in the period in which other app users were potentially exposed to the coronavirus (“the relevant period”);

b.

the date of each key.

² The SwissCovid app carries out the following functions via an interface to the mobile phone’s operating system:

a.

It generates a new private key at least every day that does not permit the SwissCovid app, the mobile telephone or the user to be traced.

b.

It exchanges a variable identification code at least every half-hour with all compatible apps within Bluetooth range; the identification code is derived from the current private key but may not be traced back to that key and does not permit the SwissCovid app, the mobile telephone or the user to be traced.

c.

It stores the identification codes received, details of the strength of the signal, the date and the estimated duration of the encounter.

d.

It periodically retrieves the list of private keys belonging to infected app users from the PDM back end and checks whether any of the identification codes it has stored locally were generated using a private key on the list.

e.²

If it establishes that any one of the locally stored identification codes was generated using a private key on the list, and if the encounter requirements set out in the Annex number I are met, the app issues a notification; the distance of the encounter is estimated based on the strength of the signal received.

³ The operating systems’ functions used via the interface must meet the requirements of Article 60a EpidA and this Ordinance; this does not apply to the rule relating to the source code under Article 60a paragraph 5 letter e EpidA. The FOPH shall ensure that these requirements are met, in particular by obtaining related assurances.

⁴ ...³

¹ If a user tests positive for the coronavirus, an authorised agency may with the consent of the infected person request a unique activation code with time-limited validity from the code management system; to do so, the agency sends the code management system the date on which the first symptoms occurred or, if the infected person has not displayed any symptoms, the date of the test.⁴

² The authorised agency gives the activation code to the infected person.⁵ The infected person may choose to enter the activation code into their SwissCovid app.

³ The code management back end sends confirmation to the SwissCovid app that the code entered is valid. It deducts the number of days specified in Annex number 2 from the recorded date.⁶ The resulting date is the start of the relevant period. The code management back end sends this date to the infected person’s SwissCovid app.

⁴ The infected person’s SwissCovid app sends the private keys that were effective in the relevant period to the PDM back end, together with their dates.

⁵ The PDM back end records the received private keys with their dates on its list.

⁶ After the private keys have been sent, the SwissCovid app generates a new private key. This key cannot be used to identify earlier private keys.

¹ The notification contains:

a.

the information that the app user has potentially been exposed to the coronavirus;

b.⁷

a note of the days on which exposure may have occurred;

c.

the information that the FOPH operates an infoline that provides advice free of charge;

d.

recommendations from the FOPH on what to do.

² The PT System does not issue any instructions to app users.

¹ The code management system contains the following data:

a.

the activation codes;

b.

the date on which the first symptoms occurred, or, if the infected person has not displayed any symptoms, the date of the test;

c.

the time when the data in accordance with letters a and b will be destroyed.

² These data cannot be used to identify app users.

The code management system may be accessed via:

a.

a specialist from the authorised agency via the front end; or

b.

an interface between the code management system and a system operated by the authorised agency.

¹ The following persons acting for the authorised agency may request the activation code via the front end:¹⁰

a.

cantonal medical officers;

b.

the Armed Forces Surgeon General;

c.

other staff of the cantonal medical services or of the Armed Forces medical services;

d.

third parties acting on behalf of the cantonal medical services or the Armed Forces medical services;

e.¹¹

staff at medical practices;

f.¹²

staff at laboratories with authorisation under Article 16 EpidA;

g.¹³

staff at the facilities specified in Article 24 paragraph 1 letter b of the COVID 19 Ordinance 3 of 19 June 2020¹⁴;

h.¹⁵

staff of the Infoline under Article 7 paragraph 1 letter c.

² The code management system is accessed via the Federal Administration’s Central Access and Permission System for web applications. The provisions of the Ordinance of 19 October 2016¹⁶ on Federal Identity Management Systems and Directory Services apply.

³ The FOPH assigns and manages access rights to the code management system. It may authorise cantonal medical officers and the Armed Forces Surgeon General or a specific member of their auxiliary personnel to grant access rights to auxiliary personnel.

The FOPH shall enable the authorised agencies under Article 9 paragraph 1 to connect their systems via the interface to the code management system, provided the systems concerned provide an appropriate level of security.

¹ The FOPH may instruct third parties to provide the SwissCovid app with online access to the list of data required for notifications.

² It may the assign the task of granting rights of access to the code management system to third parties. The third party concerned must guarantee that the authorisation of specialists is verified reliably and in accordance with the law.

³ The third parties must be contractually required to comply with the requirements of Article 60a EpidA and of this Ordinance; this does not apply to the regulation relating to the source code under Article 60a paragraph 5 letter e EpidA. The FOPH shall verify compliance with the requirements.

¹ Articles 57i–57q of the Government and Administration Organisation Act of 21 March 1997¹⁸ and the Ordinance of 22 February 2012¹⁹ on the Processing of Personal Data accumulated through the Use of the Confederation’s Electronic Infrastructure apply to the storing and the evaluation of the records of access to the PDM back end, the code management system and the list under Article 10 paragraph 1.

² Apart from these records and records of encounters, the PT System does not maintain any record of the activities of the front end of the code management system and the SwissCovid app.

The FOPH shall regularly provide the Swiss Federal Statistical Office (FSO) with the latest collection of data in the two back ends in a completely anonymised form for statistical assessment.

¹ The data in the PDM System shall be destroyed both on the smartphones and in the PDM back end 14 days after they are recorded.

² The data in the code management system shall be destroyed 24 hours after they are recorded.

³ The record data of third parties assigned tasks under Article 10 paragraph 1 shall be destroyed 7 days after they are recorded.

⁴ In addition, the destruction of record data is governed by Article 4 paragraph 1 letter b the Ordinance of 22 February 2012²⁰ on the Processing of Personal Data accumulated through the Use of the Confederations Electronic Infrastructure.

⁵ The data made available to the FSO shall also be destroyed in accordance with this Article.

¹ The FOPH shall publish the data that allows verification of whether the machine readable programmes of all components of the PT System have been produced using the published source code.

² It shall also verify this itself.

¹ When this Ordinance ceases to apply, the FOPH shall deactivate the SwissCovid app and instruct users of the SwissCovid app to remove the app from their mobile phones.

² The FOPH shall submit a report to the Federal Council within six months of this Ordinance ceasing to apply.

¹ The PT System may only be connected to a foreign system (Art. 62a EpidA) if that system meets the requirements of Article 60a paragraph 5 letters a–d EpidA.

² When connected, the VA backend and the foreign system are linked to an interconnection system for the mutual transmission of the private keys of infected app users.

³ The connection system is subject to the following rules:

a.

It is operated by the FOPH or the responsible foreign body.

b.

Article 60a paragraph 5 letter e EpidA and Article 14 of this Ordinance apply to the source code and the technical specifications of the connection system that the FOPH operates.

c.

The data processing purposes are governed by Article 60a paragraph 2 EpidA.

d.

The data in the system may be passed on to the FSO and the responsible foreign body in completely anonymised form for statistical purposes.

e.

The data shall be erased as soon as they are no longer required in order to notify app users, but at the latest 14 days after their transmission to the system.

⁴ If the PT System is connected to a foreign system, the following applies in relation to the PT System’s operating procedures in addition to Articles 5 and 6:

a.

During basic operations, the VA backend retrieves the private keys of infected users of the foreign system and the date of these keys from the connection system and places them on its list.

b.

Following an infection, the VA backend transmits the private keys of the infected persons with the relevant date to the foreign system via the connection system.

The COVID-19 Ordinance of 13 May 2020²² on the Proximity Tracing Pilot Trial is repealed.

The Federal Department of Home Affairs (FDHA) shall update the Annex to this Ordinance in accordance with the current state of the art.

This Ordinance comes into force on 25 June 2020 at 00.00 and applies until 30 June 2022.