In accordance with Articles 13 and 14 of the EU General Data Protection Regulation (GDPR), we provide the information below about the manner and purpose of the processing of your personal data in connection with the activities of the Migration and Passport Office (APA). The following information applies equally to applicants, contracting parties, and other data subjects. Please note that only the German version is legally binding.

Controller
Migration and Passport Office
Giessenstrasse 3
9490 Vaduz
Liechtenstein
Phone: +423 236 61 41
Email: dsk.apa@llv.li / general enquiries: info.apa@llv.li

Questions about data protection may be addressed directly to the APA or to the Competence Center Data Protection of the Liechtenstein National Administration. Requests for access, rectification, erasure, etc. can be sent directly to the email address dsk.apa@llv.li.

Contact details of the Data Protection Officer
Competence Center Data Protection
Peter-Kaiser-Platz 1
9490 Vaduz 
Liechtenstein
Phone: +423 236 73 08
Email: datenschutz@regierung.li 
Website: https://www.llv.li/en/national-administration/specialized-unit-for-data-protection 

Purpose of the processing
The primary purpose of the processing of personal data is to fulfil our statutory mandate. This includes, in particular, the issuing of passports and identity cards, the granting and renewal of permits for foreign nationals and cross-border commuters, and the implementation of asylum and protection procedures.

Our main processing activities include the following:

• Issuing of passports and identity cards
• Permits for cross-border commuters, incl. renewals
• Employee reporting
• Permits for employees providing cross-border services
• Residence permits in Liechtenstein with and without gainful employment
• Granting of permanent residence and settlement permits
• Permits for family reunification
• Integration agreements, promotion of language courses, and civics tests
• Issuing of eID.li (the digital identity of the Principality of Liechtenstein)
• Visa affairs
• Implementation of asylum and protection procedures, enforcement, and return arrangements
• Processing of legal cases relating to migration, e.g. unlawful residence in the country or unauthorised employment
• Inspections and investigations relating to cross-border services
• Schengen/Dublin affairs
• Cooperation with other national, municipal, and foreign authorities in migration matters

Legal basis
The legal bases for the individual processing activities are set out in the special laws listed below and apply in conjunction with Article 6(1)(e) GDPR (performance of a task carried out in the exercise of official authority) and, in certain cases, also in conjunction with Article 9(2)(f) or (g) GDPR.

If personal data is not processed on the basis of the public mandate, the legal basis in individual cases may be Article 6(1)(c) GDPR (legal obligation) or Article 6(1)(a) GDPR (consent).

Accordingly, the processing of your personal data is primarily governed by the applicable legal provisions; the relevant legal bases are also listed on our website under the individual services:

• Foreigners Act (AuG), LGBl. 2008 No. 311; in particular Articles 23, 31-32, 33, 54a et seq., 69-79;
• Citizenship Documents Act (HSchG); LGBl. 1986 No. 27; in particular Articles 16, 16a, 33 et seq.;
• Law on the Free Movement of EEA and Swiss Citizens (PFZG); LGBl. 2009 No. 348; in particular Articles 13, 59;
• Ordinance on the Free Movement of EEA and Swiss Citizens (PFZV); LGBl. 2009 No. 350; in particular Articles 16 et seq., 21;
• Ordinance on the Admission and Residence of Foreigners (ZAV); LGBl. 2008 No. 350; in particular Articles 19, 24-24c;
• Ordinance on Proof of Language Proficiency and the Civics Examination for Admission to National Citizenship (BüNV); in particular Article 5;
• Ordinance on Entry and the Granting of Visas (VEV); LGBl. 2011 No. 572; LGBl. 2008 No. 308; in particular Articles 3, 11-12, 14 et seq., 23, 26;
• Visa Information System Ordinance (VISV); LGBl. 2011 No. 503; in particular Articles 7, 11-18, 21, Annex referred to in Article 7;
• Ordinance on the Schengen Information System (SIS) and the SIRENE Bureau (N-SIS-V); LGBl. 2011 No. 140; in particular Articles 10, 13 et seq., 17-18, 20, 36-46, Annex 2 referred to in Article 25(3), Annex 3 referred to in Article 20(5);
• Ordinance on the Enforcement of the Removal and Expulsion of Foreign Nationals (VVWA); LGBl. 2018 No. 31, in particular Article 1;
• Asylum Act (AsylG); LGBl. 2012 No. 29; in particular Articles 16a, 26a, 66-75, 84;
• Asylum Ordinance (AsylV); LGBl. 2012 No. 153; in particular Article 36;
• Central Register of Persons Act (ZPRG); LGBl. 2011 No. 574;
• Central Register of Persons Ordinance (ZPRV); LGBl. 2011 No. 602; in particular Annex 2 referred to in Article 5(4);
• Agreement between the Austrian Federal Government, the Swiss Federal Council, and the Government of the Principality of Liechtenstein on the Mutual Exchange of Data in Asylum Matters; LGBl. 2006 No. 58;
• Archives Act (ArchivG); LGBl. 1997 No. 215; in particular Articles 6, 10 et seq.;
• Framework Agreement between the Principality of Liechtenstein and the Swiss Confederation on Cooperation on Visa Procedures, Entry and Stay, and Police Cooperation in Border Areas; LGBl. 2009 No. 217, in particular Article 17;
• Agreement between the Principality of Liechtenstein, the Austrian Federal Government, and the Swiss Federal Council on the Readmission of Persons (Readmission Agreement); LGBl. 2000 No. 241.

Data processed
The following personal data is collected, recorded, and further processed in the course of the APA's activities:

• Personal details: first name, surname, date and place of birth, gender, marital status, place of citizenship, country of birth, nationality, employment status, residential address with full details in Liechtenstein and abroad, telephone number, email address, employer details (in particular duration of employment, occupation, level of employment, gross salary, working hours), details of parents, spouse or registered partner and children, as well as information on living arrangements such as rental agreements
• Recording, updating, and deletion of data in the Central Register of Persons (Central Master Data)
• Health insurance (name, insurance number, validity)
• Biometric data: photo, fingerprints, signature
• Copy of a valid foreign passport or identity card
• Copy of a Swiss or EEA permanent residence permit
• Personal and document data (type of document, country of issue, document number, expiry date, date of birth, surname, first name, gender, nationality, check digit, etc.)
• Maintenance and departure guarantees
• Language proficiency and diplomas
• Purpose of entry, records of entries and exits
• Extracts from the criminal and debt enforcement registers
• Particularly relating to asylum: religion, ethnicity, native language, education, children and other family relationships, copies of civil status documents, interview transcripts and data from foreign countries, medical records, forensic data, domestic and foreign criminal records, statements on DNA data, copies of identity documents, copies of travel documents, and declarations of assets
• Information specifically required for the performance of the contract or business relationship
• Correspondence with you

The list of data processed by the Migration and Passport Office is not exhaustive and is supplemented by the relevant special legislation.

Data sources
If the data is not collected directly from you, the personal data originates from the following sources:

• Central Master Data (ZSD);
• Schengen Information System (SIS);
• Visa Information System (VIS);
• Entry/Exit System (EES);[JH8]  
• Central Migration Information System (ZEMIS);
• European Dactyloscopy (Eurodac);
• Incoming or outgoing requests for administrative or legal assistance from domestic and foreign authorities, consulates, courts, or public prosecutors' offices;
• Service providers (outpatient and inpatient care facilities, physicians, Refugee Assistance, etc.);
• Other publicly accessible sources

Recipients
The APA transfers your data to other public authorities only in cases required or permitted by law.

Your personal data may be disclosed to other national and municipal authorities, in particular to: 

• Municipal residents' register offices
• Office of Economic Affairs
• Office of Social Services
• Office of Public Health
• Office of Statistics
• National Road Office
• Office of Finance
• Civil Registry Office
• Government and Secretariats General of the Ministries
• Office of the Public Prosecutor
• Liechtenstein Court of Justice, Court of Appeal, and Supreme Court
• Administrative Court (VGH)
• Constitutional Court (StGH)
• National Police
• Liechtenstein diplomatic representations abroad

On the basis of intergovernmental agreements or other legal provisions, the APA may also transmit your data to foreign authorities and organisations, in particular to:

• Police authorities
• Asylum and migration authorities in Schengen/Dublin countries
• Federal Office for Customs and Border Security (FOCBS), Bern
• European Border and Coast Guard Agency (FRONTEX), Warsaw
• Swiss embassies
• International Organization for Migration (IOM)

The APA may also transfer personal data to private entities and individuals in accordance with, and where required by, the relevant legal provisions, in particular to:

• Hospitals and physicians
• Therapeutic and social service providers
• Employers
• Service providers, in particular Refugee Assistance, aid organisation representatives, and interpreters/translators
• Legal advisors

Third countries
Personal data will be transferred to authorities or organisations in third countries only if expressly provided for in a bilateral agreement and if equivalent data protection requirements are ensured. Transfers to third countries are carried out on the basis of an adequacy decision (Article 45 GDPR) or subject to appropriate safeguards (Article 46 GDPR). A transfer of personal data to a third country may be made in accordance with a Commission decision if that country provides an adequate level of protection. According to Annex 1 of the Data Protection Ordinance (LGBl. 2018 No. 415, as amended), this applies to Switzerland in particular.

Storage period
The storage period for data processing is determined by specific legal provisions on retention periods or by the Archives Act. Once the purpose of data processing has been fulfilled and no statutory retention periods prevent deletion, the personal data is in principle handled in accordance with the applicable deletion policy.

For example, an applicant's fingerprints, photographs, and gender information are destroyed no later than ten years after the asylum application has been legally rejected, withdrawn, or closed, or after temporary protection has been revoked (Article 71(4)(c), Article 73(4) of the Asylum Act). Fingerprints collected in accordance with Article 26(5) of the Citizenship Documents Act are deleted 30 days after collection. 

Rights of the data subject
When your personal data is processed, you have various rights under data protection law: access, rectification, erasure, restriction of processing, data portability, objection, and the right to lodge a complaint with the supervisory authority.

You may exercise your rights by submitting an informal application or request to the controller without stating reasons. However, it is recommended that the application or request be submitted in writing or in a secure electronic form.

1. Right of access:
   Under the right of access pursuant to Article 15 GDPR, you as the data subject may request information from the controller about which data concerning you is stored or processed.
   You will also receive additional information from the controller, e.g. on the purposes of the processing, the source of the data if it was not collected directly from you, or the recipients to whom your data is disclosed.
   This right of access enables you to maintain an overview and thereby retain control over which of your personal data is processed, for what purpose, and on what legal basis.
2. Right to rectification
   If you discover that your personal data is incorrect, you may request its rectification by the controller without undue delay pursuant to Article 16 GDPR. "Without undue delay" means without culpable delay on the part of the controller; however, some processing time should be expected.
3. Right to erasure
   Under the right to erasure pursuant to Article 17 GDPR, you may in principle request the controller to erase your personal data without undue delay if one of the grounds set out in Article 17(1)(a)-(f) applies, e.g. the data is no longer necessary in relation to the purposes of processing, consent has been withdrawn, an objection has been successfully lodged, or the processing was unlawful.
   However, exceptions to the right to erasure may apply, as listed in Article 17(3) GDPR. The controller must regularly verify whether statutory retention periods or the Archives Act preclude deletion.
4. Right to restriction of processing
   The right to restriction of processing pursuant to Article 18 GDPR may be exercised only under certain conditions, which are set out in points (a) to (d) of the first paragraph of that article. For example, if you request the rectification of incorrect data or have objected to the processing, the controller must restrict the processing of your data until verification has been completed. Restriction must also take place if you expressly request it instead of erasure on the grounds of unlawful processing. In addition, processing must be restricted if the controller no longer requires your data for its own purposes, but you still need it to pursue your own claims.
5. Right to data portability
   If you have provided your data to the controller, you may request to receive this data in a commonly used, machine-readable format pursuant to Article 20 GDPR. This is intended to make it easier for you to transmit your data to another controller. The right to data portability applies if the processing is based on consent or a contract and is carried out by automated means.
6. Right to object
   Article 21(1) GDPR grants you the right to object, on an exceptional basis and on grounds relating to your particular situation, to data processing which is lawful in itself, provided that the legal basis for the processing of your data is a weighing of interests on the part of the controller whose interests have prevailed in the weighing process.
7. Right to complaint
   If you, as the data subject, believe that your data is being processed unlawfully, you may lodge a complaint with the competent supervisory authority at any time.

Contact details of the data protection supervisory authority
The competent supervisory authority for data protection is the Data Protection Office, with the following contact details:

Data Protection Office of the Principality of Liechtenstein
Kirchstrasse 8
PO Box 684
9490 Vaduz
Liechtenstein
Phone: +423 236 60 90
Email: info.dss@llv.li
Website: www.datenschutzstelle.li

Further information on data protection, in particular regarding the website of the Liechtenstein National Administration can be found in the privacy policy.