Council of Europe Convention for the protection of individuals: automatic processing of personal data. Protocol: ratification by Member States

PURPOSE: to authorise Member States to ratify, in the interest of the European Union, the Protocol amending the Council of Europe Convention for the protection of individuals with regard to automatic processing of personal data (ETS No 108).

PROPOSED ACT: Council Decision.

ROLE OF THE EUROPEAN PARLIAMENT: the Council can adopt the act only if the European Parliament has approved it.

BACKGROUND: on 6 June 2013, the Council authorised the Commission to participate on behalf of the Union in the negotiations on the modernisation of the Council of Europe Convention for the protection of individuals with regard to automatic processing of personal data (ETS No 108) (‘Convention 108’) and the conditions and modalities of accession of the Union to the amended Convention 108.

The Protocol amending Convention 108 was adopted by the Committee of Ministers of the Council of Europe on 18 May 2018.

The provisions of the amended Convention 108, to the extent they apply to the processing of personal data in the context of activities falling within the scope of Union law, may affect common rules or alter their scope within the meaning of Article 3(2) of the Treaty, as these provisions are based on the same principles as those set out in Regulation (EU) 2016/679 (General Data Protection Regulation) and in Directive (EU) 2016/680 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data.

The Union cannot sign or ratify the amending Protocol, as under Convention 108 only States are Parties. Member States should therefore be authorised to ratify the amending Protocol, acting jointly in the interests of the Union, insofar as its provisions fall within the exclusive competence of the Union.

CONTENT: the draft Council decision aims to authorise Member States to ratify, in the interest of the European Union, the Protocol amending the Council of Europe Convention for the protection of individuals with regard to automatic processing of personal data (ETS No 108), insofar as its provisions fall within the exclusive competence of the Union.

The amending Protocol aims to widen the scope, increase the level and improve the effectiveness of data protection afforded under Convention 108.

The modernised Convention (i.e. Convention 108 modified by the amending Protocol) will cover all types of data processing under the jurisdiction of the Parties, in both the public and private sectors.

More specifically, the modernised Convention:

• further specifies the principle of  lawful processing (in particular with respect to the requirements for consent) and further strengthen the protection of special categories of data (while also expanding the categories to those recognised as special categories of personal data in Union law);
• provides for additional safeguards for individuals when their personal data are processed (in particular, obligations to examine the likely impact of an intended data processing operation and to implement relevant technical and organisational measures, and the obligation to report serious data breaches);
• strengthen data subjects’ rights (especially with regard to transparency and access to data);
• introduces new rights, such as the right not to be subject to a decision significantly affecting the data subject based solely on automated processing, the right to object to the processing and the right to have a remedy in case of violation of an individual's rights;
• includes revised provisions requiring the Parties to establish one or more independent authorities responsible for ensuring compliance with the provisions of Convention 108.

Overall, the modernised Convention ensures a high level of protection, while leaving a margin of flexibility to the Parties as regards the implementation of its provisions in domestic law, which would make accession to the modernised Convention 108 attractive to those countries, including those outside Europe, which are contemplating establishing or strengthening their data protection systems.