Protecting personal data world wide: Convention 108+

Almost one year after the General Data Protection Regulation (GDPR) entered into force in the European Union (EU), the question often arises about what could other countries around the world do to protect their citizens’ personal data. Although there are countries that have data protection laws in place, many still do not, or have laws that are only partially adequate.

The need for a global data protection

Given the existing (and increasing) data flows, having different degrees of data protection in different regions is a threat to those countries and regions that are advanced in their legislations (such as EU, Uruguay, Argentina, and Japan). Harmonisation is also key to ensuring that enforcement is equally strong everywhere, and companies have no possibility to engage in “forum shopping”.

Currently, the global standard for data protection could be the updated Convention 108 (“Convention 108+”). This Convention, even though it was developed by the Council of Europe, can be signed and ratified by any country around the world. The modernised Convention 108 brings a number of improvements to the previous text:

• Any individual is covered by its protection, independently of their nationality, as long as they are within the jurisdiction of one of the parties who have ratified the Convention.
• Definitions are updated, and the scope of application includes both automated and non-automated processing of personal data.
• The catalogue of sensitive data has been extended to include genetic and biometric data as well as trade-union membership or ethnic origin.
• There are now requirements to notify without undue delay any security breaches.
• Data subjects are granted new rights, namely the right not to be subject to a decision which affects the data subject which is based solely on an automated processing.

How to get there

While working to improve data protection at national or regional levels, an additional effort should be made to be sure that signing and ratifying Convention 108+ is part of any agenda. On 9 April 2019, the European Council adopted a decision that authorises EU Member States to ratify Convention 108+. This should be done without undue delay. At the same time, the possibilities the Convention 108+ offers for a global data protection campaign will be discussed with activists from around the world during the RightsCon 2019 conference.

Modernised Convention for the Protection of Individuals with Regard to the Processing of Personal Data – Consolidated text
http://search.coe.int/cm/Pages/result_details.aspx?ObjectId=09000016807c65bf

The modernised Convention 108: novelties in a nutshell
http://rm.coe.int/modernised-conv-overview-of-the-novelties/16808accf8

Explanatory Report to the Protocol amending the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data
https://rm.coe.int/cets-223-explanatory-report-to-the-protocol-amending-the-convention-fo/16808ac91a

(Contribution by Diego Naranjo, EDRi)