The European Parliament encourages Member States to ratify the Protocol amending the Convention 108
In the adopted document the European Parliament indicates that the changes proposed by the Council of Europe are fully coherent with EU regulations regarding personal data protection. It emphasises that the amendments take into account the challenges faced by data protection in the digital era, pertaining to the swift development of information technology. Practically speaking the amended Convention will inter alia simplify a secure data exchange between the signatory countries.
It is also worth reminding that the Convention of Council of Europe on the Protection of Individuals with regard to Automatic Processing of Personal Data (also known as the Convention No. 108) is the first international treaty that deals with the individuals’ right to protect the information that pertains to them.
The above mentioned Protocol amending the Convention No. 108 introduces multiple modifications. These amendments are of such significance that a new version of the treaty was given the name of „Convention 108+” by the experts. It improves the data protection standard on many levels by e.g.:
- increased requirements as to the principles of purpose limitation, minimisation, and lawfulness of data processing,
- extending the types of sensitive data which will now include genetic and biometric data, trade union membership and ethnic origin,
- the obligation of data breach notification,
- increased transparency of data processing,
- new rights for individuals in the context of algorithmic (automated) decision-making where such decisions are particularly important with regards to the development of artificial intelligence,
- increased responsibility of data controllers,
- the „privacy by design” principle as a prerequisite,
- applying data protection principles to all the activities related to processing, including national security, with occasional exceptions and limitations warranting the conditions determined by the Convention, and – in any event – with independent and effective control and supervisory measures,
- a transparent regime of transborder data flow,
- increased powers and independence of data protection authorities as well as improving legal bases for international cooperation.
An extremely important initiative of the European Parliament
The European Parliament gave the green light to a swift ratification of the Protocol amending the Convention No. 108. This should become an additional impetus for Polish authorities towards a fast implementation of the amended Convention into our legal order.
It is worth repeating that the document was signed during a ceremony held in Strasbourg on 10th of October, 2018, by the representatives of twenty Member States of the Council of Europe: Austria, Belgium, Bulgaria, Czech Republic, Estonia, Finland, France, Germany, Ireland, Latvia, Lithuania, Luxembourg, Monaco, the Netherlands, Norway, Portugal, Russia, Spain, Sweden, and Great Britain – as well as by Uruguay – one of six non-European countries which have by now joined the Convention No. 108.
What’s massively important, the Protocol amending the Convention No. 108 was also signed by Russia and Uruguay – countries where the GDPR is not applied. It is also possible that other members of the Council of Europe will sign the amended Convention in the future. A chance therefore exists that more effective data protection instruments will be in use in the countries where the EU law is not binding. This is just one of the undeniable advantages of the solution proposed. All the more, it is surprising that the Polish authorities delay signing and ratifying the amended Convention.
The President of the Personal Data Protection Office has consistently emphasised the necessity to implement the amendments to the Convention No. 108 into Polish legal order.