Protecting personal data world wide: Convention 108+
Almost one year after the General Data Protection Regulation (GDPR)
entered into force in the European Union (EU), the question often arises
about what could other countries around the world do to protect their
citizens' personal data. Although there are countries that have data
protection laws in place, many still do not, or have laws that are only
partially adequate.
The need for a global data protection
Given the existing (and increasing) data flows, having different degrees
of data protection in different regions is a threat to those countries
and regions that are advanced in their legislations (such as EU,
Uruguay, Argentina, and Japan). Harmonisation is also key to ensuring
that enforcement is equally strong everywhere, and companies have no
possibility to engage in “forum shopping”.
Currently, the global standard for data protection could be the updated
Convention 108 (“Convention 108+”). This Convention, even though it was
developed by the Council of Europe, can be signed and ratified by any
country around the world. The modernised Convention 108 brings a number
of improvements to the previous text:
- Any individual is covered by its protection, independently of their
nationality, as long as they are within the jurisdiction of one of the
parties who have ratified the Convention.
- Definitions are updated, and the scope of application includes both
automated and non-automated processing of personal data.
- The catalogue of sensitive data has been extended to include genetic
and biometric data as well as trade-union membership or ethnic origin.
- There are now requirements to notify without undue delay any security
breaches.
- Data subjects are granted new rights, namely the right not to be
subject to a decision which affects the data subject which is based
solely on an automated processing.
How to get there
While working to improve data protection at national or regional levels,
an additional effort should be made to be sure that signing and
ratifying Convention 108+ is part of any agenda. On 9 April 2019, the
European Council adopted a decision that authorises EU Member States to
ratify Convention 108+. This should be done without undue delay. At the
same time, the possibilities the Convention 108+ offers for a global
data protection campaign will be discussed with activists from around
the world during the RightsCon 2019 conference.
Modernised Convention for the Protection of Individuals with Regard to
the Processing of Personal Data – Consolidated text
http://search.coe.int/cm/Pages/result_details.aspx?ObjectId=09000016807c65bf
The modernised Convention 108: novelties in a nutshell
http://rm.coe.int/modernised-conv-overview-of-the-novelties/16808accf8
Explanatory Report to the Protocol amending the Convention for the
Protection of Individuals with regard to Automatic Processing of
Personal Data
https://rm.coe.int/cets-223-explanatory-report-to-the-protocol-amending-the-convention-fo/16808ac91a
(Contribution by Diego Naranjo, EDRi)