Convention 108 and the EU framework: Differing while Converging Sophie Kwasny Hong Kong University, 27 September 2017

Council of Europe ≠ EU

Council of Europe (Strasbourg - France)

Data protection : an enabling right ECHR Article 1 – Obligation to respect human rights Article 8 – Right to private life Article 9 – Freedom of thought, conscience and religion Article 10 – Freedom of expression Article 11 – Freedom of assembly and association

Convention 108 (28/01/1981) UNIQUE (no other international legally binding instrument in the field) OPEN (any country in the world with a complying data protection legislation can request invitation to accede) INFLUENTIAL (its principles = data protection principles taken up in all regions of the world)

Convention 108 today currently 50 Parties (including Uruguay, Mauritius, Senegal) Pending: Morocco,Tunisia, Cape Verde Burkina-Faso, Argentina, Mexico + observers (USA, Canada, Australia, Korea, Indonesia, Japan and Philippines) = TOTAL OF OVER 60 COUNTRIES

Convention 108 Committee Standard setting body (latest documents : Guidelines on Big Data, Opinion on data protection implications of PNR). Open Forum of cooperation between 60 countries and non State actors.

Convention 108 today Based on ”Global Tables of Data Privacy Laws and Bills”, 5th Ed, compiled  by Graham Greenleaf, Privacy Laws & Business International Report, February 2017 www.privacylaws.com/Publications/special_reports/

Convention 108 - Modernisation Current modernisation to: reinforce the individuals’ protection Modernisation trends : promote as a universal standard preserve general, simple, flexible and pragmatic character ensure coherence with other relevant frameworks (EU, OECD, APEC)

Convention 108 and the EU 95/46 EU Directive Preamble, Recital 11: “Whereas the principles of the protection of the rights and freedoms of individuals, notably the right to privacy, which are contained in this Directive, give substance to and amplify those contained in the Council of Europe Convention”

Convention 108

Convention 108 and the EU GDPR Recital 105 the Commission should take account of obligations arising from the third country's […] participation in multilateral or regional systems […]. In particular, the third country's accession to Convention 108 should be taken into account.

Convention 108 and the EU

Convention 108 and the EU Section 3.3.1 (page 11) second paragraph : “In particular, the Commission encourages accession by third countries to Council of Europe Convention 108 and its additional Protocol. […] It is currently in the process of being revised and the Commission will actively promote the swift adoption of the modernised text with a view to the EU becoming a Party. standards.”

Convention 108 and the EU It will reflect the same principles as those enshrined in the new EU data protection rules and thus contribute to the convergence towards a set of high data protection standards.

Modernisation and the EU May 2013 – mandate adopted by the Council Decision authorising COM to negotiate on behalf of the EU and its member states: Negotiate the modernisation proposals Negotiate the conditions and modalities of accession of the EU to Convention 108 (see amending protocol of 1999)

Convention 108 modernised Transborder dataflows [Limitation to free flow between Parties where bound by harmonised rules of protection shared by States belonging to a regional international organisation.] Means to secure and approriate level of protection (ad hoc or approved standardised safeguards provided by legally binding instruments) Possibilities to transfer where consent, specific interests of the data subject, prevailing legitimate interests provided for by law and are necessary

Convention 108 modernised Definitions (personal data, processing…) Scope (public and private sector) Legitimacy and quality of data Sensitive data Security Transparency Rights of data subjects Additional obligations Exceptions Transborder data flows Supervisory authorities

Convention 108: From Regional to Global 47 + Uruguay Mauritius Senegal Tunisia Morocco Cabo Verde Burkina Faso Argentina Mexico ….

Thank you for your attention www.coe.int/dataprotection dataprotection@coe.int