Council of Europe updates its ‘Convention 108’ on data protection

The Committee of Ministers of the Council of Europe on the occasion of its 128th Session, adopted an Amending Protocol which updates its Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, also known as ‘Convention 108’. As the only existing legally binding international treaty with global relevance in this field, it addresses the challenges to privacy resulting from the use of new information and communication technologies, and strengthens the convention’s mechanism to ensure its effective implementation. It is seen as, ‘a bridge between regions and normative frameworks around the world’, including the new European Union’s legislation, Directive 95/46/EC, the General Data Protection Regulation (GDPR), that will become applicable on 25 May 2018, and which refers to ‘Convention 108’ in the content of transborder data flows. In relation to the ‘Convention 108’ update, the Secretary General of the Council of Europe, Thorbjørn Jagland, stated in a press release: ‘Frequent violations of the right to data protection have become a major concern in our societies. The modernised convention will provide a strong legal framework to prevent abuses. States should join the treaty swiftly and ensure that data protection rules are respected and applied in practice.’ The updated convention requires personal data processing to apply the ‘privacy by design’ principle and ‘it introduces safeguards for individuals concerned in an algorithmic decision-making context, such as the right to obtain knowledge of the logic underlying the data processing and the right to object’. The treaty opens for signature on 10 October 2018 in Strasbourg.