The work of revision of the Council of Europe Convention 108 for the protection of individuals as regards the automatic processing of personal data

Abstract

Thirty years after the Convention 108 for the protection of individuals as regards the automatic processing of personal data was adopted, the Council of Europe launched a process of modernising this text in order to adapt it to the substantive technological revolutions that have occurred since its birth in 1981. After two years of work, the Committee of the Convention 108 (T-PD Committee) has adopted the proposal of a revised version of both the Convention 108 and its additional Protocol. This paper presents the main propositions of changes brought by the modernisation work. Major changes have been brought to certain definitions and to the scope of the Convention as well as to the basic principles and to the special regime for sensitive data. Important new rights have been added to the list of guarantees offered to data subjects. New duties appear now in the text. And the transborder data flow regime has been entirely rewritten.

Keywords:

• Convention 108
• modernisation work
• data protection

Notes

1. T refers to ‘Treaty’, PD refers to ‘Protection des données’.

2. See de Terwangne et al. (2010).

3. http://www.coe.int/t/dghl/standardsetting/dataprotection/Consultation_Modernisation_Convention_108_EN.pdf. For the results see de Terwangne and Moiny (2011).

4. The work of the Council of Europe is very transparent. Various papers showing the progression of modernisation work are available to the public. See http://www.coe.int/t/dghl/standardsetting/dataprotection/modernisation_en.asp

5. See in the same way Article 29 Working Group opinion 4/2007 on the concept of personal data, WP 136 adopted on 20 June 2007. The example 13, p. 17, presents the case of coded medical data transferred to a pharmaceutical company. The names of patients stay exclusively in possession of the doctors bound by medical secrecy. Article 29 Working Group concludes that in this situation coded data are not to be considered as personal data.

6. See in the same way the interesting position taken by the US Federal Trade Commission in its Recommendations for businesses and policymakers: ‘Protecting Consumer Privacy in an Era of Rapid Change’, FTC Report, March 2012.

7. Article 1 of the European Convention on Human Rights states that ‘The High Contracting Parties shall secure to everyone within their jurisdiction the rights and freedoms defined in Section I of this Convention’ (emphasis added).

8. See Korff (2010, 8).

9. C.J.E.C., 6 November 2003, (Lindqvist), C-101-01, Rec. p. I-12971, point 46 and 47.

10. C.J.E.C., 6 November 2003, (Lindqvist), C-101-01, Rec. p. I-12971, point 47.

11. C.J.E.C., 6 November 2003, (Lindqvist), C-101-01, Rec. p. I-12971, point 47.

12. As concerns the dimension of personal autonomy attached to the right to respect for private life enshrined in Article 8 ECHR, see ECtHR, Pretty v. UK, 29 April 2002, req. no. 2346/02; Van Kück v. Germany, 12 June 2003, req. no. 35968/97; K.A. and A.D. v. Belgium, 17 February 2005, req. no. 42758/98, 45558/99.

13. For the explicit recognition of a right to self-determination or to personal autonomy contained in the right to respect for private life under Article 8, see ECtHR, Evans v. UK, 7 March 2006, req. no. 6339/05 (confirmed by Grand Chamber on 10 April 2007); Tysiac v. Pologne, 20 March 2007, req. no. 5410/03; Daroczy v. Hongrie, 1 July 2008, req. no. 44378/05.

14. Resolution 1165 (1998) of the Parliamentary Assembly on the right to privacy adopted on 26 June 1998.

15. Article 5, § 3, a) of the new version.

16. Article 5, § 3, b) of the new version.

17. Article 5, § 3, a) of the new version.

18. Current article 5, c: ‘Personal data undergoing automatic processing shall be […] not excessive in relation to the purposes for which they are collected.’

19. ECtHR, S. and Marper v. UK, 4 December 2008, req. no. 30562/04, 30566/04.

20. In the S. and Marper case, § 75, the ECtHR states that genetic data raise particular concern with regard to the protection of privacy. DNA profiles contain a significant amount of unique and irrefutable personal data that allow authorities to go beyond a neutral identification (to search the genetic relationships between individuals, for instance). Moreover genetic data can reveal things the individual wishes not to know.

21. Cf. notably the intense debate surrounding the right to be forgotten introduced in the EU draft Data Protection Regulation.

22. ‘Each Party shall provide that the products and services intended for the data processing shall take into account the implications of the right to the protection of personal data from the stage of their design and facilitate the compliance of the processing with the applicable law.’

23. New article 12, § 1.

24. The term ‘appropriate’ has been preferred to ‘adequate’ to avoid any confusion with the vocabulary used in the EU context.

25. New article 12, § 2.

26. New article 12, § 3.

27. This duty to inform is not a duty to obtain the authorisation.

28. New article 12, § 4.

29. The Convention is open to signature of any State in the world. As an illustration of this open nature of the Convention, Uruguay is presently about to sign it.