The register census also makes use of the data in existing administrative registers. These data are processed and stored in the official statistics domain, which is completely separate from administration. All relevant legal rules are observed, such as the jurisdiction of the Federal Constitutional Court, the European General Data Protection Regulation (GDPR) and the Federal Statistics Act.
Compliance with statistical confidentiality as specified in Section 16 of the Federal Statistics Act is ensured: individual data provided for federal statistics are not disclosed. Furthermore, the 'purpose limitation' rule defined in Article 5 (1) second half-sentence of the GDPR applies, according to which data may only be used for statistical but not for administrative purposes. The prohibition on (re)transferring data (Federal Constitutional Court judgment, 65, 1) additionally ensures that individual data are not transferred back to the public agencies which originally provided the data or passed on to other administrative agencies.
The security measures in place for the register census are continuously improved to ensure that they are state of the art. As in the 2022 Census, the processing of all data meets stringent information security requirements. The project is supported by a regular exchange of opinions and views with the Federal Commissioner for Data Protection and Freedom of Information.
The register census is intended to only collect the data that are required for statistical purposes. The data are only transmitted between the authorities in encrypted format and via specially secured data portals. The relevant measures are described, assessed and planned in detail in security policies which are in line with IT baseline protection and comply with the standards of the Federal Office for Information Security. Comprehensive technical and organisational measures are in place to prevent data abuse. A detailed, restrictive rights and roles policy ensures that people may only access the data on a need-to-know basis and only if the data are absolutely necessary for their work. Compliance with these rules can be verified through comprehensive logging of activities. The Register Modernisation Act provides for a "data protection cockpit" to enable citizens to gain an overview of the data transmitted. Furthermore, an online procedure is available for individuals to execute their right of access as per Article 15 of the GDPR.
The results are only published after aggregation and anonymisation. It is therefore not possible to determine a person's identity from the data. Moreover, there are strict statutory deadlines for the deletion of data that are no longer required.