PURPOSE: to authorise Member States to ratify the Protocol of Amendment to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (ETS No. 108).

NON-LEGISLATIVE ACT: Council Decision (EU) 2019/682 authorising Member States to ratify, in the interest of the European Union, the Protocol of Amendment to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data.

CONTENT: this Council Decision authorises the Member States to ratify, in the interest of the Union, the Protocol of Amendment to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (ETS No. 108), insofar as its provisions fall within the exclusive competence of the Union.

The Protocol of Amendment to Convention 108 was adopted on 18 May 2018 by the Committee of Ministers of the Council of Europe. It aims to broaden the scope, increase the level and improve the effectiveness of data protection offered by Convention 108 in order to better address privacy issues.

The provisions of the amended Convention 108 cover both activities falling within the scope of Union law and activities outside its scope, such as in national security and defence.

The amended Convention 108 shall contain safeguards based on the same principles as those set out in Regulation (EU) 2016/679 (General Data Protection Regulation) and Directive (EU) 2016/680 on the protection of individuals with regard to the processing of personal data by competent authorities for the purpose of the prevention, investigation, detection, prosecution or enforcement of criminal offences and on the free movement of such data.

Consequently, the entry into force of the amended Convention shall:

- contribute to the promotion of Union data protection standards at global level,

- facilitate data flows between the Union and the non-Union Parties to Convention 108,

- ensure compliance by Member States with their international obligations under Convention 108,

- enable future accession of the Union to Convention 108.

ENTRY INTO FORCE: 9.4.2019.

The European Parliament adopted by 624 votes to 12 with 27 abstentions, a legislative resolution on the draft Council decision authorising Member States to ratify, in the interest of the European Union, the Protocol amending the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data.

The European Parliament gave its consent to the draft Council decision.

The purpose of the Amending Protocol is to broaden the scope, increase the level and improve the effectiveness of the data protection provided by Convention 108 in order to better address the issues relating to protection of privacy arising in the digital age.

The modernised convention (i.e. Convention 108 as amended by the Amending Protocol) will cover all types of data processing within the jurisdiction of the parties in both the public and private sectors.

The Committee on Civil Liberties, Justice and Home Affairs adopted the report by József NAGY (EPP, SK) on the draft Council decision authorising Member States to ratify, in the interest of the European Union, the Protocol amending the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data.

The committee recommended that the European Parliament give its consent to the draft Council decision.

The aim of the amending protocol is the modernisation and harmonisation of Convention 108 to better address emerging privacy challenges and to strengthen its application.

As stated in the explanatory memorandum accompanying the recommendation, Convention 108 plays a crucial role in spreading the ‘European data protection model’ globally. A higher level of protection will facilitate the exchange of personal data based on appropriate safeguards.

Moreover, increasing the data protection standards of the Convention will facilitate data flows between the EU and the non-EU Parties to the Convention.

This is also recognised by the General Data Protection Regulation (GDPR) which defines the accession to and implementation of Convention 108 and its additional protocol as an important criterion in the assessment of whether a third country meets the necessary conditions for international transfers stipulated in EU law with a view to declaring the adequacy of that third country’s data protection legal framework.

PURPOSE: to authorise Member States to ratify, in the interest of the European Union, the Protocol amending the Council of Europe Convention for the protection of individuals with regard to automatic processing of personal data (ETS No 108).

PROPOSED ACT: Council Decision.

ROLE OF THE EUROPEAN PARLIAMENT: the Council can adopt the act only if the European Parliament has approved it.

BACKGROUND: on 6 June 2013, the Council authorised the Commission to participate on behalf of the Union in the negotiations on the modernisation of the Council of Europe Convention for the protection of individuals with regard to automatic processing of personal data (ETS No 108) (‘Convention 108’) and the conditions and modalities of accession of the Union to the amended Convention 108.

The Protocol amending Convention 108 was adopted by the Committee of Ministers of the Council of Europe on 18 May 2018.

The provisions of the amended Convention 108, to the extent they apply to the processing of personal data in the context of activities falling within the scope of Union law, may affect common rules or alter their scope within the meaning of Article 3(2) of the Treaty, as these provisions are based on the same principles as those set out in Regulation (EU) 2016/679 (General Data Protection Regulation) and in Directive (EU) 2016/680 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data.

The Union cannot sign or ratify the amending Protocol, as under Convention 108 only States are Parties. Member States should therefore be authorised to ratify the amending Protocol, acting jointly in the interests of the Union, insofar as its provisions fall within the exclusive competence of the Union.

CONTENT: the draft Council decision aims to authorise Member States to ratify, in the interest of the European Union, the Protocol amending the Council of Europe Convention for the protection of individuals with regard to automatic processing of personal data (ETS No 108), insofar as its provisions fall within the exclusive competence of the Union.

The amending Protocol aims to widen the scope, increase the level and improve the effectiveness of data protection afforded under Convention 108.

The modernised Convention (i.e. Convention 108 modified by the amending Protocol) will cover all types of data processing under the jurisdiction of the Parties, in both the public and private sectors.

More specifically, the modernised Convention:

further specifies the principle of lawful processing (in particular with respect to the requirements for consent) and further strengthen the protection of special categories of data (while also expanding the categories to those recognised as special categories of personal data in Union law); provides for additional safeguards for individuals when their personal data are processed (in particular, obligations to examine the likely impact of an intended data processing operation and to implement relevant technical and organisational measures, and the obligation to report serious data breaches); strengthen data subjects’ rights (especially with regard to transparency and access to data); introduces new rights , such as the right not to be subject to a decision significantly affecting the data subject based solely on automated processing, the right to object to the processing and the right to have a remedy in case of violation of an individual's rights; includes revised provisions requiring the Parties to establish one or more independent authorities responsible for ensuring compliance with the provisions of Convention 108.

Overall, the modernised Convention ensures a high level of protection, while leaving a margin of flexibility to the Parties as regards the implementation of its provisions in domestic law, which would make accession to the modernised Convention 108 attractive to those countries, including those outside Europe, which are contemplating establishing or strengthening their data protection systems.

PURPOSE: to authorise Member States to ratify, in the interest of the European Union, the Protocol amending the Council of Europe Convention for the protection of individuals with regard to automatic processing of personal data (ETS No 108).

PROPOSED ACT: Council Decision.

ROLE OF THE EUROPEAN PARLIAMENT: the Council can adopt the act only if the European Parliament has approved it.

BACKGROUND: on 6 June 2013, the Council authorised the Commission to participate on behalf of the Union in the negotiations on the modernisation of the Council of Europe Convention for the protection of individuals with regard to automatic processing of personal data (ETS No 108) (‘Convention 108’) and the conditions and modalities of accession of the Union to the amended Convention 108.

The Protocol amending Convention 108 was adopted by the Committee of Ministers of the Council of Europe on 18 May 2018.

The provisions of the amended Convention 108, to the extent they apply to the processing of personal data in the context of activities falling within the scope of Union law, may affect common rules or alter their scope within the meaning of Article 3(2) of the Treaty, as these provisions are based on the same principles as those set out in Regulation (EU) 2016/679 (General Data Protection Regulation) and in Directive (EU) 2016/680 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data.

The Union cannot sign or ratify the amending Protocol, as under Convention 108 only States are Parties. Member States should therefore be authorised to ratify the amending Protocol, acting jointly in the interests of the Union, insofar as its provisions fall within the exclusive competence of the Union.

CONTENT: the draft Council decision aims to authorise Member States to ratify, in the interest of the European Union, the Protocol amending the Council of Europe Convention for the protection of individuals with regard to automatic processing of personal data (ETS No 108), insofar as its provisions fall within the exclusive competence of the Union.

The amending Protocol aims to widen the scope, increase the level and improve the effectiveness of data protection afforded under Convention 108.

The modernised Convention (i.e. Convention 108 modified by the amending Protocol) will cover all types of data processing under the jurisdiction of the Parties, in both the public and private sectors.

More specifically, the modernised Convention:

further specifies the principle of lawful processing (in particular with respect to the requirements for consent) and further strengthen the protection of special categories of data (while also expanding the categories to those recognised as special categories of personal data in Union law); provides for additional safeguards for individuals when their personal data are processed (in particular, obligations to examine the likely impact of an intended data processing operation and to implement relevant technical and organisational measures, and the obligation to report serious data breaches); strengthen data subjects’ rights (especially with regard to transparency and access to data); introduces new rights , such as the right not to be subject to a decision significantly affecting the data subject based solely on automated processing, the right to object to the processing and the right to have a remedy in case of violation of an individual's rights; includes revised provisions requiring the Parties to establish one or more independent authorities responsible for ensuring compliance with the provisions of Convention 108.

Overall, the modernised Convention ensures a high level of protection, while leaving a margin of flexibility to the Parties as regards the implementation of its provisions in domestic law, which would make accession to the modernised Convention 108 attractive to those countries, including those outside Europe, which are contemplating establishing or strengthening their data protection systems.

PURPOSE: to authorise Member States to ratify, in the interest of the European Union, the Protocol amending the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (ETS No. 108).

PROPOSED ACT: Council Decision.

ROLE OF THE EUROPEAN PARLIAMENT: Council may adopt the act only if Parliament has given its consent to the act.

BACKGROUND: the Council of Europe Convention for the Protection of Individuals with Regard to Automatic Processing of Personal Data (Convention 108) is the only legally binding multilateral agreement in the field of personal data protection. Convention 108 requires the Parties to incorporate into their respective national laws the necessary measures to ensure respect for the human right of all individuals with regard to the processing of personal data.

At present, 51 States have ratified Convention 108, including all 28 EU Member States.

Convention 108 was opened for signature in 1981, long before the era of the internet and electronic communications. The development of technology and globalisation of information poses new challenges in the field of protection of personal information.

On 31 May 2013, the Council authorised the Commission to participate on behalf of the Union in the negotiations on the modernisation of the Council of Europe Convention for the protection of individuals with regard to automatic processing of personal data (EST 108) and the conditions and modalities of accession of the Union to the modernised Convention.

The Protocol amending Convention 108 (the amending Protocol) was adopted by the Council of Europe Committee of Ministers on 18 May 2018 and will be open for signature as of 25 June 2018.

The amending Protocol aims to widen the scope, increase the level and improve the effectiveness of data protection afforded under Convention 108.

Given that the Union cannot sign or ratify the amending Protocol, as under the current Convention 108 only States are Parties, Member States should therefore be authorised to ratify the amending Protocol, acting jointly in the interests of the Union.

CONTENT: the present proposal calls on the Council to adopt the decision to authorise Member States to ratify, in the interest of the European Union, the Protocol amending the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (ETS No 108) (the amending Protocol) insofar as its provisions fall within Union competence.