Sovereignty, law and cost

Assignment

Beat Kläy follows up. "Our members could simply go with one of the big providers. Write me one page on the legal reasons for a cloud of our own and what it costs us. I don't want to claim anything that isn't true."

Learning goals

After this chapter you can:

• Say which data protection law applies to the members of Wolkenwerk Bern
• Recognize sensitive personal data
• Explain the duties around processing on behalf and data abroad
• Judge what professional secrecy means for a medical practice in the cloud
• Roughly classify the protection needs of the members
• Divide the cost of a cloud of your own into investments and operating costs

Not legal advice

This chapter explains the legal situation for a case study and is not legal advice. The articles of law are linked, and a real case needs a specialist. The information reflects the state of November 2026.

The Data Protection Act

Since September 1, 2023, Switzerland has had a revised Federal Act on Data Protection (FADP, SR 235.1, in German DSG). It applies to private persons and organizations and to federal bodies. Cantons and municipalities are subject to the data protection law of their canton. At Wolkenwerk Bern the FADP therefore covers the cooperative, the practice, the fiduciary office and the bike shop, while Gemeinde Hinterbüel falls under the data protection law of the canton of Bern.

The FADP defines sensitive personal data (Art. 5 let. c). They include data on health, on religious, philosophical or political views, genetic and biometric data, data on criminal proceedings and on social assistance measures. Praxis Rosenweg processes health data every day, and the municipality handles data on social assistance.

Data security and processing on behalf

Whoever processes personal data must protect it with technical and organizational measures appropriate to the risk (Art. 8 FADP). The minimum requirements are set out in the Data Protection Ordinance (DPO, in German DSV).

When Wolkenwerk Bern stores a member's data on its platform, the cooperative acts as a processor on behalf of that member (Art. 9 FADP). The member stays responsible and has to make sure Wolkenwerk can guarantee data security. Wolkenwerk may process the data only as the member itself could and may bring in further service providers only with the member's prior approval. A contract on processing on behalf usually covers this.

Data abroad

Personal data may go abroad if the Federal Council has found that the destination offers adequate protection (Art. 16 FADP). The list of these countries is in Annex 1 of the DPO. The United States has been on it since September 15, 2024, but only for companies certified under the Swiss-U.S. Data Privacy Framework. Other countries and uncertified companies need other safeguards, such as standard contractual clauses, or one of the exceptions in Art. 17 FADP, like the express consent of the person concerned.

Regardless of where data is stored, the US CLOUD Act of 2018 obliges US providers to disclose data in their possession, custody or control upon an order by the authorities, even when it sits in a data center in Switzerland.

Professional secrecy

Doctors and their auxiliary persons are bound by professional secrecy under Art. 321 of the Swiss Criminal Code. Disclosing such a secret can be punished with up to three years of imprisonment or a fine. The article lists the professions one by one, and fiduciaries are not among them. For Treuhand Aaregg, the contracts with its clients and the FADP apply.

Whether a cloud provider can count as an auxiliary person of a practice is a matter of interpretation. A page of the canton of Zurich names two ways. Either the provider is bound to the same secrecy, works under instructions and is integrated into the practice by contract and organization, or it has no access to the keys that encrypt the data. For public bodies, the conference of Swiss data protection commissioners privatim stated in 2025 that international cloud services are an option for sensitive data only if the body encrypts the data itself and the provider has no access to the key.

A community cloud like Wolkenwerk Bern has advantages here. The data stays in Switzerland, the cooperative is not subject to foreign law such as the CLOUD Act, and the members decide what happens to it.

Protection needs

The protection need states how much damage it would cause if data became known, was altered or became unavailable. It is usually assessed for three security goals, confidentiality, integrity and availability, in levels such as normal, high and very high. It determines the measures, such as encryption, separation of tenants, backups or a second site. Where processing poses a high risk to the people concerned, the FADP requires a data protection impact assessment in advance (Art. 22 FADP), for example when sensitive personal data is processed on a large scale.

Cost

A cloud of your own first requires investments and then causes ongoing operating costs. Investments (CapEx) are expenses that create an asset, at Wolkenwerk the servers, the network equipment and the setup. Operating costs (OpEx) arise in every period, for example for power, cooling, space in the data center, the internet connection, maintenance and above all the working time of the platform team. OpenNebula, Kubernetes and the other tools of the course cost no license fees because they are free software. With a public cloud almost all costs are operating costs, billed by usage.

The total cost over several years is called the total cost of ownership. Knowing it lets you compare your own cloud with an offer from a public cloud. So that members see their share, Wolkenwerk measures usage per member. If the cooperative shows members their usage for information only, that is called showback. If it bills them for it, that is chargeback. The FinOps Foundation notes that showback is needed in every organization, while chargeback depends on its accounting rules. In chapter 3.3 you set up showback in OpenNebula.

Exercise Protection needs

Rate the protection need of every member for confidentiality, integrity and availability as normal, high or very high, and justify each rating in one sentence.

Solution

One possible rating:

Member	Confidentiality	Integrity	Availability
Praxis Rosenweg	very high, health data under professional secrecy	high, wrong findings put patients at risk	high, no consultations without data
Treuhand Aaregg	high, financial data of clients	high, accounts have to be correct	high at the end of the month, otherwise normal
Veloatelier Matte	normal, mainly orders and addresses	normal	high on spring Saturdays
Gemeinde Hinterbüel	high, data on residents, partly on social assistance	high, official records	high during counter hours

Exercise Briefing

Write one page for Beat Kläy with the legal reasons for a cloud of your own and a breakdown of the costs. Use only statements you can support with an article of law or a source from this chapter.

Solution

A good page names the FADP and, for the municipality, cantonal law, the practice's health data as sensitive, the role of Wolkenwerk as a processor on behalf with a contract, the rules for data abroad, the CLOUD Act as a risk with US providers and the professional secrecy of the practice. On cost it separates investments and operating costs, names the working time of the platform team as the largest ongoing item and explains showback.