What is “Convention 108”?

Convention 108 is an international treaty and a legally binding commitment of the Council of Europe member states to protect the right to privacy of individuals. As of today, all Council of Europe member states have ratified Convention 108 recognising this fundamental human right. Convention 108 is not a closed document and some non–Council of Europe states have acceded to the treaty, respectively: Argentina, Cabo Verde, Mauritius, Mexico, Morocco, Senegal, Tunisia, and Uruguay. Ratification by other states signals a commitment to privacy and data protection and is a key step toward an adequacy decision of essential equivalence with the GDPR.

Background

The signing of Convention 108 on 28 January 1981 is why Europeans celebrate the date as Data Protection Day. Convention 108 was developed by the Council of Europe, one of the most influential international organizations. The Council of Europe was established in the aftermath of the devastating Second World War to unite a shattered Europe under the rule of law, democracy, and human rights.

In fact, the process of building the large-scale treaty on the protection of individuals personal’s data began in 1950 with the adoption the European Convention of Human Rights which laid the foundation of a right to privacy providing individuals a right to respect for one’s “private and family life, his home and his correspondence.” These rights are not absolute, subject to certain restrictions that are “in accordance with law” and “necessary in a democratic society”.

Notably absent from the European Convention of Human Rights was the right to data protection. In the years following the adoption of the European Convention on Human Rights, it became apparent that more systematic and specific requirements were needed to afford protection to individuals’ personal data. This recognition led the Council of Europe in the 1970s to adopt two resolutions which specified principles to protect personal data in automated data banks. The objective of these resolutions was to spur adoption of national legislation.

Almost in parallel, the emergence of computers in combination with telecommunication opened new prospects for data processing on an international scale and distributed processing networks enabled users to store and access information in distant countries. The national laws that had been adopted were inconsistent and presented a real challenge for businesses to determine what laws applied and when.

In this climate, internationally binding norms became increasingly necessary. The Council of Europe had a new task ahead, that of setting about and developing an international standard with fundamental rules to apply regardless of where data processing took place. To ensure international cooperation, the Council of Europe collaborated with the Organization for Economic Co-operation and Development (OECD), a group of leading industrial countries including the United States, on guiding principles. After four years of negotiation, on 28 January 1981, Convention 108 or, on its long name, “Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data” was concluded.

Agreement between organisations under Convention 108 data protection framework

The Main Content of Convention 108

Convention 108 lays out legal definitions for the main concepts of data protection law such as: personal data, data controller and processing activity, data subject rights and the idea of privacy as a “take-back control” by individuals over the processing of their personal data. In addition, principles of data processing such as: lawful, fair, purpose specific, and proportional data processing through privacy by design and by default, compliance, transparency, data security, and risk management were conceived as the cornerstones of “anything done with the data.” The Council of Europe has made it therefore, and a uniform norm to protect privacy and provide for the free flow of personal data has been successfully created.

Convention 108+

Since its adoption, Convention 108 has undergone a few rounds of updates. An additional Protocol was adopted in 2001 to bring the Convention 108 in line with the Data Protection Directive from 1995. The Convention was again updated in 2018 to align with the GDPR in what is known as Convention 108+. As Colin J. Bennett, professor in the Department of Political Science at the University of Victoria writes in his paper The Council of Europe’s Modernized Convention on Personal Data Protection. Why Canada Should Consider Accession, “Convention 108+ is explicitly drafted with a view to its possible role as a global instrument that offers reciprocal rights and obligations. (…) it is motivated by, and framed in, clear human rights language. Unlike the GDPR, it is not driven by an overriding need to balance privacy with commercial interests. Its language is also more accessible than the highly legalistic GDPR. It is designed to ‘travel.’”

Convention 108+ and the General Data Protection Regulation

Despite its name, the Council of Europe is not a European Union institution. It is an international organisation consisting of 47 member states stretching far beyond the EU. The GDPR was adopted by the EU to give Convention 108’s guarantees legal force. The interplay between the regulation and the additional protocol is even more integral demonstrating a continued international dialogue. The update to Convention 108+ includes the basic tenets of the GDPR, meaning countries that adopt Convention 108+ align closely with the regulation. This is an important factor in assessment of third country legislation. Recital 105 of the GDPR states: “The Commission should take account of obligations arising from the third country’s participation in multilateral or regional systems in particular in relation to the protection of personal data, as well as the implementation of such obligations. In particular, the third country’s accession to the Council of Europe Convention 108 and its Additional Protocol.” As Bruno Gencarelli, head of data flows and protection at the European Commission, said “Even the EU’s data protection directive for law enforcement is inspired partly by Convention 108.”

Conclusion

Over the years, Convention 108 influenced regional and national legislation in the EU and beyond. Globalisation was written in the Convention 108 DNA. Convention 108 has always been viewed as an instrument whose principles can be exported. Notably, Convention 108 is not restricted to the Council of Europe member states. For non-EU countries, accession to the Convention plays a key role in obtaining and maintaining an adequacy decision. As legal scholars Paul de Hert and Papakonstantinou put it, Convention 108 represents a balanced approach: “A text that is broad enough for all countries in the world to accept and still has binding power for everybody to actually implement.”