Council of Europe Convention 108

Council of Europe Convention 108
Name	Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data
Adopters	Council of Europe
Adopted	1981
Entered into force	1985
Amended	2018
Language	English French

Council of Europe Convention 108

The 1981 instrument adopted by the Council of Europe established the first binding international treaty focused on personal data protection, aiming to harmonise standards across Europe and influence United Nations frameworks. It set substantive safeguards for automated processing in the context of technological developments impacting civil liberties after events such as the rise of computing in the late 20th century. The treaty has been referenced in debates involving European Commission proposals, European Court of Human Rights jurisprudence, and legislative initiatives in states like France, Germany, and United Kingdom.

Background and Purpose

The convention emerged from deliberations within the Council of Europe Secretariat and committees including the European Committee on Legal Co-operation and the Steering Committee on Media and Information Society. It responded to concerns raised by cases before the European Court of Human Rights and policy debates involving the Organisation for Economic Co-operation and Development and the United Nations Conference on Trade and Development. The purpose was to protect individual rights in the face of automated data processing technologies that affected rights recognized in instruments such as the European Convention on Human Rights and national constitutions of states like Italy and Spain.

Key Provisions and Principles

The convention codified principles including fair and lawful processing, purpose limitation, data quality, and security obligations, drawing conceptual kinship with norms in the European Union and references to cases from the European Court of Justice in matters later addressed. It established rights for data subjects such as access and rectification, and duties for controllers regarding notification to supervisory authorities akin to mechanisms found in laws of Sweden, Netherlands, and Belgium. The text addressed cross-border flows, envisaging cooperation among national authorities comparable to arrangements in treaties like the Schengen Agreement and instruments negotiated by the Organisation for Security and Co-operation in Europe.

Signatories, Parties, and Ratification

Initial signatories included member states of the Council of Europe such as Denmark, Norway, and Ireland, with subsequent ratifications by countries beyond Europe, including Canada and states in Latin America and Africa. Ratification processes involved parliaments like those of Portugal and Greece adopting implementing legislation and creating supervisory authorities similar to regulators in Austria and Switzerland. Parties engaged with accession discussions alongside regional organisations such as the European Free Trade Association and dialogues with the African Union.

Implementation and Compliance Mechanisms

The convention mandated independent supervisory authorities and administrative remedies comparable to ombuds institutions in Finland and inspection bodies in Poland. Compliance relied on national enforcement through courts—occasionally leading to litigation before the European Court of Human Rights—and cooperation among data protection authorities modeled after networks like the Global Privacy Assembly and the International Conference of Data Protection and Privacy Commissioners. Peer review and technical assistance often involved entities such as the Council of Europe Commissioner for Human Rights and agencies in Germany and Romania.

Amendments and Modernisation (Convention 108+)

Modernisation culminated in the 2018 revision known colloquially as Convention 108+, negotiated by the Committee of Ministers of the Council of Europe and supported by delegations from states including Lithuania and Hungary. Amendments updated provisions for profiling, transborder data flows, and technical safeguards to reflect advances in artificial intelligence debates in forums like the European Commission and the Organisation for Economic Co-operation and Development. The revised instrument sought alignment with regulatory frameworks such as the General Data Protection Regulation while preserving a treaty-based mechanism for non-EU members like Turkey.

Criticisms, Challenges, and Privacy Impact

Critics from civil society groups including Amnesty International and Privacy International argued the original text lacked enforcement teeth compared with later regional laws and struggled to address emergent issues raised in discussions involving Google, Facebook, and large-scale surveillance practices revealed in inquiries linked to Edward Snowden. Challenges cited by academics at institutions like University of Oxford and Harvard University concerned ambiguities in definitions and limitations in remedies, while policymakers in Russia and Belarus raised sovereignty and data localization concerns. Nevertheless, impact assessments point to influence on domestic laws in jurisdictions such as Argentina and Japan.

Relationship with Other International Instruments

The convention interacts with instruments including the European Convention on Human Rights, the OECD Guidelines on the Protection of Privacy, and United Nations resolutions on privacy, influencing bilateral agreements and sectoral frameworks like the ePrivacy Directive and dialogues under the Asia-Pacific Economic Cooperation. It has been referenced in negotiations involving the WTO and cross-border transfer mechanisms such as standard contractual clauses in discussions involving the United States and India. Coordination with forums including the Internet Governance Forum and the World Bank has supported technical cooperation and capacity-building in states from Chile to South Africa.

Category:International human rights instruments