Swisstransplant: Results of investigation into the National Organ Donation Register
Bern, 20.10.2022 - The Swisstransplant foundation has accepted most of the recommendations set out in the FDPIC's investigation report of 13 October 2022. This would have significantly reduced the risks associated with the Foundation’s original plan to continue with provisional operation of the national register for organ donation. However, the Foundation informed the FDPIC on 18 October 2022 that it will cease operation of the register. This means that the remaining risk identified in the report is no longer relevant.
On the basis of Art. 29 of the Data Protection Act (FADP), the Federal Data Protection and Information Commissioner (FDPIC) opened a formal fact-finding procedure on 13 January 2022 in response to a notification by the SRF programme Kassensturz concerning the National Organ Donation Register’s (NODR) electronic registration process. The NODR, operated by the Swisstransplant foundation, is an online register where people can enter their will for or against organ donation in the event of their death. The results of the FDPIC’s investigation are published in its final report from 17 June 2022, completed and finalised on 13 October 2022.
SRF had indicated that it was possible to register in the NODR under another person’s name. This was confirmed at the start of the investigation. Swisstransplant responded by discontinuing registration with the intention of later replacing it with a more secure online process.
New registrations and changes to remain blocked
Swisstransplant decided not to resume online registration as it had originally planned, in light of the federal register that will be created as part of the referendum on organ donation that was approved on 15 May 2022. This new register will replace the NODR by 2024. In this scenario, the NODR would still have been available to hospitals, but people registered would no longer have had the possibility to change their expression of will. They would only have been able to delete their account.
Operational risks significantly reduced
The FDPIC's final report had already been written and sent to Swisstransplant in connection with a legal hearing when the Foundation decided it would not accept any more new registrations. This made some of the recommendations in the FDPIC report obsolete. With the exception of two, SWT accepted the remaining recommendations, which would have significantly reduced the operational risks associated with the NODR.
Two recommendations to improve technical security were rejected by Swisstransplant. These recommendations primarily referred to the online registration process as it was planned at the time the FDPIC compiled its report. Their non-acceptance implied a residual risk in relation to the account deletion process, which could have led to the possibility of clandestine account deletions by unauthorized third parties. However, the Foundation informed the FDPIC on 18 October 2022 that it will permanently cease operation of the register. This means that the remaining risk identified in the report is no longer relevant.
Address for enquiries
Federal Data Protection and Information Commissioner (FDPIC), Tel. +41 58 464 94 10, info@edoeb.admin.ch
Publisher
Federal Data Protection and Information Commissioner
https://www.edoeb.admin.ch/edoeb/en/home.html
