FINMA shall process, in hard copy or in one or more information systems, the data on its employees and on job applicants necessary for performing the tasks in accordance with this Act. It may delegate the processing to a processor. The data processed relate in particular to:31
It may process the following data pertaining to its employees necessary for performing the tasks set out in paragraph 1, including sensitive personal data:34
personal details;
state of health details with regard to working ability;
performance and potential information, as well as data on personal and professional development;
data required within the framework of participation in the implementation of social security law;
case files and authorities' decisions associated with work.
It shall issue implementing regulations with regard to:
the architecture, organisation and operation of the information system(s);
the processing of data, particularly gathering, storage, archiving and destruction;
data processing authorisations;
the data categories under paragraph 2;
data protection and security.