Aiming to strengthen personal data protection at global scale, the Council of Europe today adopted an Amending Protocol which updates its data protection convention, known as “Convention 108”.
The modernisation of the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, the only existing legally binding international treaty with global relevance in this field, addresses the challenges to privacy resulting from the use of new information and communication technologies, and strengthens the convention’s mechanism to ensure its effective implementation.
The protocol provides a robust and flexible multilateral legal framework to facilitate the flow of data across borders while providing effective safeguards when personal data are being used. It constitutes a bridge between different regions of the world and different normative frameworks, including the new European Union’s legislation that will become fully applicable on 25 May 2018 and which refers to Convention 108 in the context of transborder data flows.
Secretary General Thorbjørn Jagland said: “Frequent violations of the right to data protection have become a major concern in our societies. The modernised convention will provide a strong legal framework to prevent abuses. States should join the treaty swiftly and ensure that data protection rules are respected and applied in practice”.
The modernised treaty has been adopted by the Committee of Ministers of the Council of Europe on the occasion of its 128th session held in Elsinore. Building up from “Convention 108”, which has more than fifty States Parties, the modernised convention will continue to be open to any country in the world as a unique global standard.
The modernised treaty keeps its provisions at principle-level and remains technologically neutral allowing Parties a margin of discretion when implementing them through their legislation.
The protocol contains relevant innovations such as the obligation to declare data breaches and reinforcing the requirement that data processing is carried out in a proportional way and applying the data minimisation principle. It also strengthens the accountability of data controllers and the transparency of data processing, which is essential to maintaining trust in the digital environment.
The modernised convention requires that personal data processing applies the “privacy by design” principle and introduces additional safeguards for the persons concerned in an algorithmic decision-making context, such as the right to obtain knowledge of the logic underlying the data processing and the right to object. Furthermore, the protocol strengthens the role of the convention committee, which will evaluate compliance by Parties to the convention, and opens the treaty for accession by the European Union and international organisations.
The treaty will be opened for signature on 25 June 2018 in Strasbourg, on the first day of Council of Europe’s Parliamentary Assembly’s summer session.
Explanatory report of the Amending Protocol
***
“Convention 108”
In 1981 the Council of Europe adopted the first – and still sole - international treaty to address the right of individuals to the protection of their personal data: the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, known as “Convention 108”.
An additional protocol required each party to establish an independent authority to ensure compliance with data protection principles, and laid down rules on trans-border data flows.
The 47 member states of the Council of Europe and Mauritius, Senegal, Tunisia, Uruguay are Parties to “Convention 108”, while Argentina, Burkina Faso, Cap Verde, Mexico and Morocco have been invited to accede to the treaty. Many other countries have used it as a model for new data protection legislation.
With the 2018 amending protocol, “Convention 108” is significantly uplifted to continue properly addressing and responding to challenges of the digital era, notably by confirming its global aspirations.
