The Modernisation of Convention108 Alessandra Pierucci 27 April 2017

Convention 108 today 50 Parties (including Uruguay, Mauritius, Senegal) Pending: Morocco,Tunisia, Cape Verde, Burkina-Faso + observers (USA, Canada, Australia, South Korea, Mexico, Indonesia – requests by Japan and Philippines) = TOTAL OF OVER 60 COUNTRIES

Convention 108 and the EU 1992 study containing a “model contract to ensure equivalent data protection in the context of transborder data flows” jointly prepared with the Commission of the European Communities and the International Chamber of Commerce.

Convention 108 - Modernisation Modernisation started in 2011 to: reinforce the individuals’ protection strengthen the follow-up mechanism Modernisation trends : promote as a universal standard preserve general, simple and flexible character ensure coherence with other relevant frameworks (EU, OECD, APEC)

Convention 108 modernised Article 4 – Duties of the Parties « 3. Each Party undertakes: a. to allow the Convention Committee provided for in Chapter V to evaluate the effectiveness of the measures it has taken in its law to give effect to the provisions of this Convention; and b. to contribute actively to this evaluation process.

Convention 108 modernised Article 9.1 – Exceptions “provided for by law, respects the essence of the fundamental rights and freedoms and constitutes a necessary and proportionate measure in a democratic society for: the protection of national security, defence, public safety, important economic and financial interests of the State, the impartiality and independence of the judiciary or the prevention, investigation and prosecution of criminal offences and the execution of criminal penalties, and other essential objectives of general public interest.

Convention 108 modernised 9.3 “In addition to the exceptions allowed for in paragraph 1, with reference to processing activities for national security and defence purposes, each Party may provide, by law and only to the extent that it constitutes a necessary and proportionate measure in a democratic society to fulfill such aim, exceptions to Article 12 paragraphs 5 and 6 and Article 12bis paragraph 2, a, b, c and d. This is without prejudice to the requirement that processing activities for national security and defence purposes are subject to independent and effective review and supervision.

Convention 108 modernised Transborder dataflows Limitation to free flow between Parties where bound by harmonised rules of protection shared by States belonging to a regional international organisation. Means to secure an appropriate Level of Protection (ad hoc or approved standardised safeguards provided by legally binding instruments) Possibilities to transfer where consent, specific interests of the data subject, prevailing legitimate interests provided for by law and necessary in a democratic society

Convention 108 modernised Convention Committee: “e. shall prepare, before any new accession to the Convention, an opinion for the Committee of Ministers relating to the level of personal data protection… ; h. shall review the implementation of this Convention by the Parties and recommend measures to take where a Party is not in compliance with this Convention;”

Convention 108 - Modernisation Legal form of the instrument: Amending Protocol (specific entry into force provisions) Committee of Ministers Group of Rapporteurs on Legal Co-operation (GR-J) meetings of 13/09/2016, 2/11/2016, 1/12/2016, 31/01/2017,16/03/2017, 4/04/2017 … 4/05/2017

Convention 108 - Outstanding points National security Transborder data flows Voting rights

Convention 108 and the EU GDPR Recital 105 the Commission should take account of obligations arising from the third country's […] participation in multilateral or regional systems […]. In particular, the third country's accession to Convention 108 should be taken into account.

Convention 108 and the EU

Convention 108 and the EU Section 3.3.1 (page 11) second paragraph : “In particular, the Commission encourages accession by third countries to Council of Europe Convention 108 and its additional Protocol. […] The Commission will actively promote the swift adoption of the modernised text with a view to the EU becoming a Party.”

Convention 108 and the EU “It will reflect the same principles as those enshrined in the new EU data protection rules and thus contribute to the convergence towards a set of high data protection standards.”

Other standard-setting work Committee of Convention 108 Guidelines on Big data 34th Plenary: 19-21 June 2017 Health-related data Practical Guide on the use of data in the police sector

Thank you for your attention www.coe.int/dataprotection dataprotection@coe.int