1. The Modernisation of Convention108
Alessandra Pierucci
27 April 2017

2. Convention 108 today
50 Parties (including Uruguay, Mauritius, Senegal)
Pending: Morocco,Tunisia, Cape Verde,
Burkina-Faso
+ observers (USA, Canada, Australia, South Korea, Mexico, Indonesia –
requests by Japan and Philippines)
= TOTAL OF OVER 60 COUNTRIES

3. Convention 108 and the EU
1992
study containing a “model contract to ensure equivalent data protection in the context of transborder data flows”
jointly prepared with the Commission of the European Communities and the International Chamber of Commerce.

4. Convention 108 - Modernisation
Modernisation started in 2011 to:
reinforce the individuals’ protection
strengthen the follow-up mechanism
Modernisation trends :
promote as a universal standard
preserve general, simple and flexible character
ensure coherence with other relevant frameworks (EU, OECD, APEC)

5. Convention 108 modernised
Article 4 – Duties of the Parties
« 3. Each Party undertakes:
a. to allow the Convention Committee provided for in Chapter V to evaluate the effectiveness of the measures it has taken in its law to give effect to the provisions of this Convention; and
b. to contribute actively to this evaluation process.

6. Convention 108 modernised
Article 9.1 – Exceptions
“provided for by law, respects the
essence of the fundamental rights and freedoms and constitutes a necessary and proportionate measure in a democratic society for:
the protection of national security, defence, public safety, important economic and financial interests of the State, the impartiality and independence of the judiciary or the prevention, investigation and prosecution of criminal offences and the execution of criminal penalties, and other essential objectives of general public interest.

7. Convention 108 modernised
9.3 “In addition to the exceptions allowed for in paragraph 1, with reference to processing activities for national security and defence purposes, each Party may provide, by law and only to the extent that it constitutes a necessary and proportionate measure in a democratic society to fulfill such aim, exceptions to Article 12 paragraphs 5 and 6 and Article 12bis paragraph 2, a, b, c and d.
This is without prejudice to the requirement that processing activities for national security and defence purposes are subject to independent and effective review and supervision.

8. Convention 108 modernised
Transborder dataflows
Limitation to free flow between Parties where bound by harmonised rules of protection shared by States belonging to a regional international organisation.
Means to secure an appropriate Level of Protection (ad hoc or approved standardised safeguards provided by legally binding instruments)
Possibilities to transfer where consent, specific interests of the data subject, prevailing legitimate interests provided for by law and necessary in a democratic society

9. Convention 108 modernised
Convention Committee:
“e. shall prepare, before any new accession to the Convention, an opinion for the Committee of Ministers relating to the level of personal data protection… ;
h. shall review the implementation of this Convention by the Parties and recommend measures to take where a Party is not in compliance with this Convention;”

10. Convention 108 - Modernisation
Legal form of the instrument: Amending Protocol (specific entry into force provisions)
Committee of Ministers
Group of Rapporteurs on Legal
Co-operation (GR-J) meetings of 13/09/2016, 2/11/2016, 1/12/2016, 31/01/2017,16/03/2017, 4/04/2017 … 4/05/2017

11. Convention 108 - Outstanding points
National security
Transborder data flows
Voting rights

12. Convention 108 and the EU GDPR Recital 105
the Commission should take account of obligations arising from the third country's […] participation in multilateral or regional systems […]. In particular, the third country's accession to Convention 108 should be taken into account.

13. Convention 108 and the EU

14. Convention 108 and the EU Section 3.3.1 (page 11) second paragraph :
“In particular, the Commission encourages accession by third countries to Council of Europe Convention 108 and its additional Protocol. […]
The Commission will actively promote the swift adoption of the modernised text with a view to the EU becoming a Party.”

15. Convention 108 and the EU
“It will reflect the same principles as those enshrined in the new EU data protection rules and thus contribute to the convergence towards a set of high data protection standards.”

16. Other standard-setting work
Committee of Convention 108
Guidelines on Big data
34th Plenary: June 2017
Health-related data
Practical Guide on the use of data in the police sector

17. Thank you for your attention