Data protection is becoming a topic with highlighted importance for the Council of Europe Member States with the modernization of the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, or Convention 108. A Protocol was recently opened for signature and was discussed at a two-day Forum in Mexico City where local authorities were joined by international speakers from Europe, Africa, Australia and Latin America. It aims to help Member States to meet the high data protection standards and to facilitate data flows in support of their growing digital economies.

If you think that data protection regulations started with the GDPR implementation, you are wrong. The Convention was signed in 1981 in order to protect the right to privacy of individuals, taking account of the increasing flow across frontiers of personal data undergoing automatic processing. However, the treaty needs to be updated so that it better addresses the challenges which result from the use of new information and communication technologies. Protection of personal data will be enhanced with taking into account genetic and biometric data for example.

A plenary meeting took place in Strasbourg last month where the Committee discussed in detail draft Guidelines on Artificial Intelligence (AI) and a draft Recommendation on the protection of health-related data. These are some of the new elements of the modernised Convention. The other new perspective around the Convention is that it can become a global instrument since there is an increased interest from countries outside the Council of Europe towards it.

Photo: Pexels

Deputy Commissioner Steve Wood said at the Forum in Mexico City that he is optimistic for Convention 108’s potential to provide a strong bridge between many Data Protection systems around the world (since it is open to any country that meets the required data protection standards).

“Both GDPR and the modernised Convention 108 tackle the key challenges for data protection in the 21st century – the growth of online services with personal data as the core business model and digital public services. The risks associated with the growth of big data and AI have to be addressed by legislation that requires effective transparency, control and accountability”, he added.

The proposed modernisation is the result of long work which started with a public consultation in 2011. A report was produced which aimed to identify areas where Convention 108 would need to be modernised to address new challenges. Proposals were suggested and were subsequently examined in 2013 and 2014 by an intergovernmental committee (ad hoc committee on data protection – CAHDATA) and its work was finalised at a last meeting on 15-16 June 2016. Lastly, the CAHDATA proposals were reviewed and the amended protocol was adopted on 18 May 2018.

One of the new aspects of the modernised Convention 108 is that all states parties commit to periodic reviews by the Convention Committee of how individual parties are implementing and enforcing the Convention provisions.

The updates to Article 7 of the Convention contain the requirement any breaches to be announced without delay. This requirement is  limited to cases which may seriously interfere with  the rights and fundamental freedoms of data subjects, which  should be notified, at least, to the supervisory authorities.

Article 17 concerns updates of the possible forms of cooperation. The supervisory authorities have to “coordinate their investigations, to conduct joint actions  and to provide to each other information and documentation  on their law and administrative practices relating to data protection”.

Importantly, the Committee is no longer limited to a “consultative” role but also has assessment and monitoring powers. It will provide an opinion on the level of data protection provided by a state or international organisation before accession to the Convention.

To date, 22 countries have signed the modernising Protocol. In order a ratification to take place, at least five Member States must bring the modernised Convention into force.

You can find a summary of the novelties in Convention 108 in this document.