On-site recording

In accordance with Art. 13 and Art. 14 of the EU General Data Protection Regulation (GDPR), we, the Migration and Passport Office (APA), as the responsible body, inform you below about the manner and background to the processing of your personal data in connection with our activities. The following information applies equally to applicants and applicants, contractual partners and other persons affected by data processing.

The primary purpose of processing personal data is to fulfil the legal mandate to issue identity documents with biometric features: passports and special passports (service and diplomatic passports, travel documents for foreigners), identity cards (ID) and biometric residence permits for third-country nationals (BRP).

We primarily carry out the following processing activities:

• Identification of the applicant by means of an identity document
• Acceptance of the application for the issue of an identity document with biometric features
• Checking the existing data and confirmation by the applicant
• Self-enrolment of biometric data: Facial image, fingerprints and signature

The legal basis for the processing activities is set out in the following laws and regulations:

• Heimatschriftengesetz (HSchG) Art. 16, Art. 16a, Art. 26, Art. 29, Art. 30, Art. 31, Art. 33b, Art. 33c, Art. 33d, Art. 38
• Heimatschriftenverordnung (HSchV) Art. 4 – Art. 8, Art. 15, Art. 19, Art. 20
• Gesetz über Ausländer (Ausländergesetz; AuG) Art. 31, Art. 70b, Art. 75 und Art. 76
• Verordnung über die Zulassung und den Aufenthalt von Ausländern (ZAV) Art. 24, Art. 24a, Art. 24b, Art. 24c, Art. 24d
• DSGVO Art. 6 Abs. 1 öffentlicher/gesetzlicher Auftrag und Art. 9 DSGVO
• Datenschutz: Art. 28 - Art. 31 HSchV, Art. 33, 33a – d HSchG, Art. 70, Art. 70a und 70b AuG

 The following personal data is collected, recorded and processed in the course of our activities:

• Self-registration by the applicant:

Colour photograph (facial image), fingerprints, signature

Check of existing data:

• PEID, surname, first name(s), date of birth, place of birth (only for ID and BRP), gender, height (only for passport), home address, place of residence, nationality

We only transfer your data to other public bodies in cases prescribed and authorised by law. The possible recipients of your personal data are:

• Liechtenstein National Police, Liechtenstein National Treasury.

The storage period for data processing is based on special legal requirements for retention periods or the Archive Act. If the purpose of the data processing has been achieved and there are no legal retention periods preventing the deletion of your data, the personal data will generally be forwarded to the respective deletion concept. The deletion concepts are as follows: The photo, signature and fingerprints are captured again when a passport or card is created. The captured photo and signature are stored in the APA specialised application and in the central master data (ZSD). The last photo can be used for up to a maximum of 6 months for reissuing the identity document.  The fingerprints are stored in the APA specialised application for 30 days and then automatically deleted. They are only stored in the APA specialised application and the ZSD. No data is stored on the periphery for data capture and personalisation of identity documents.

Rights of the data subjects

When your personal data is processed, you have various rights under data protection law: information, rectification, erasure, restriction of processing, data portability, objection, complaint to the supervisory authority.

You can exercise your rights by submitting an informal application or request to the controller without giving reasons. However, it is recommended that the application or request be submitted in writing or in a secure electronic form.

Right to information:

With the right to information in accordance with Art. 15 GDPR, you as the data subject can request information from the data controller about which data about you is stored or processed by the data controller.

You will also receive additional information from the controller, e.g. about the purposes of processing, the origin of the data if it was not collected directly from you, or about recipients to whom your data is transmitted.

The right of access enables you to maintain an overview and thus control over which of your personal data is processed for what purpose and on what legal basis.

Right to rectification

If you discover that your personal data is incorrect, you can request that the controller rectify it without undue delay in accordance with Art. 16 GDPR. Immediately means a non-culpable delay on the part of the controller, i.e. a certain amount of time must be expected for processing the request.

Right to erasure

With the right to erasure in accordance with Art. 17 GDPR, you can in principle request the immediate erasure of your personal data from the controller if one of the reasons in Art. 17 para. 1 a) to f) applies, e.g. the data is no longer necessary for the purposes of processing, consent has been withdrawn, a successful objection has been lodged, the processing was unlawful, etc.

However, there may be exceptions to the right to erasure, which are listed in Art. 17 para. 3 GDPR. The controller must regularly check whether statutory retention periods or the Archiving Act preclude erasure.

Right to restriction of processing

The right to restriction of processing in accordance with Art. 18 GDPR can only be asserted under certain conditions, which are listed in letters a) to d) of the article. For example, if you request the rectification of your incorrect data or have objected to the processing, the processing of your data must be restricted by the controller until its verification has been completed. Furthermore, processing must be restricted if you expressly request restriction instead of erasure due to unjustified processing. Processing must also be restricted if the controller no longer needs your data for its own purposes, but you still wish to use it to pursue your own claims.

Right to data portability

If you have provided your data to the controller, you can request that you receive this data in a commonly used, machine-readable format in accordance with Art. 20 GDPR. This is intended to make it easier for you to transfer your data to another controller. The right to data portability applies if the processing is based on consent or a contract and is carried out using automated procedures.

Right to object

Art. 21 para. 1 GDPR grants you the right to object, on grounds relating to your particular situation, to data processing which is lawful in itself, provided that the legal basis for the processing of your data is a weighing of interests on the part of the controller whose interests have prevailed in the weighing.

Right to lodge a complaint

If you, as the person affected by the data processing, are of the opinion that the data processing is unlawful, you can lodge a complaint with the competent supervisory authority at any time.

Right to lodge a complaint and contact details of the data protection supervisory authority

The competent supervisory authority for data protection in Liechtenstein is the Data Protection Authority with the contact details:

Data Protection Office Principality of Liechtenstein
Städtle 38
P.O. Box 684
FL-9490 Vaduz

Phone: +423 236 60 90
E-Mail: [email protected]

Website: www.datenschutzstelle.li

Further information on data protection and in particular on your rights as a data subject can be found in the data protection declaration on the website of the Liechtenstein National Administration.

Contact data:

Migration and Passport Office
Städtle 38
P.O. Box 684
9490 Vaduz
Phone: +423 236 61 41
E-Mail: [email protected] or [email protected]