In the 35 years that have elapsed since the Convention for the Protection of Individuals with regard to Automated Processing of Personal Data, also known as Convention 108 (hereafter also referred to as “the Convention”) was opened for signature, the Convention has served as the foundation for international data protection law in over 40 European countries. It has also influenced policy and legislation far beyond Europe’s shores. With new challenges to human rights and fundamental freedoms, notably to the right to private life, arising every day, it appeared clear that the Convention should be modernised in order to better address emerging privacy challenges resulting from the increasing use of new information and communication technologies (IT), the globalisation of processing operations and the ever greater flows of personal data, and, at the same time, to strengthen the Convention’s evaluation and follow-up mechanism.
The modernisation work was carried out in the broader context of various parallel reforms of international data protection instruments and taking due account of the 1980 (revised in 2013) Guidelines on the Protection of Privacy and Transborder Flows of Personal Data of the Organisation for Economic Co-operation and Development (OECD), the 1990 United Nations Guidelines for the Regulation of Computerized Personal Data Files, the European Union’s (EU) framework since 1995, the Asia-Pacific Economic Cooperation Privacy framework (2004) and the 2009 ”International Standards on the Protection of Privacy with regard to the processing of Personal Data”.
A major objective of the Convention is to put individuals in a position to know about, to understand and to control the processing of their personal data by others. Accordingly, the preamble expressly refers to the right to personal autonomy and the right to control one’s personal data, which stems in particular from the right to privacy, as well as to the dignity of individuals. Human dignity requires that safeguards be put in place when processing personal data, in order for individuals not to be treated as mere objects.
Taking into account the role of the right to protection of personal data in society, the preamble underlines the principle that the interests, rights and fundamental freedoms of individuals have, where necessary, to be reconciled with each other. It is in order to maintain a careful balance between the different interests, rights and fundamental freedoms that the Convention lays down certain conditions and restrictions with regard to the processing of information and the protection of personal data. The right to data protection is for instance to be considered alongside the right to ‘freedom of expression’ as laid down in Article 10 of the European Convention on Human Rights (ETS No. 5), which includes the freedom to hold opinions and to receive and impart information. Furthermore, the Convention confirms that the exercise of the right to data protection, which is not absolute, should notably not be used as a general means to prevent public access to official documents.
Convention 108, through the principles it lays down and the values it enshrines, protects the individual while providing a framework for international data flows. This is important as global information flows play an increasingly significant role in modern society, enabling the exercise of fundamental rights and freedoms while triggering innovation and fostering social and economic progress, while also playing a vital role in ensuring public safety. The flow of personal data in an information and communication society must respect the fundamental rights and freedoms of individuals. Furthermore, the development and use of innovative technologies should also respect those rights. This will help to build trust in innovation and new technologies and further enable their development.
As international co-operation between supervisory authorities is a key element for effective protection of individuals, the Convention aims to reinforce such co-operation, notably by requiring Parties to render mutual assistance, and providing the appropriate legal basis for a framework of co-operation and exchange of information for investigations and enforcement.
The guarantees set out in the Convention are extended to every individual regardless of nationality or residence. No discrimination between citizens and third country nationals in the application of these guarantees is allowed.(6) Clauses restricting data protection to a State’s own nationals or legally resident foreign nationals would be incompatible with the Convention.
