Privacy & Information Security Law Blog

On October 10-12, 2011, the Council of Europe’s Bureau of the Consultative Committee of the Convention for the Protection of Individuals with regard to the Automatic Processing of Personal Data (known as the “T-PD-Bureau”) met in Strasbourg, France, to discuss, among other things, amending the Council of Europe’s Convention 108 and Additional Protocol. Convention 108 (together with the Protocol), which underlies the European Union’s legal framework for data protection, is the only legally-binding international convention that addresses data protection. Amendment of the Convention is also closely linked to the current review of the EU data protection framework.

As we have explained previously, the T-PD-Bureau is comprised primarily of representatives from government ministries and European data protection authorities. An agenda and documents discussed at the meeting are available on the Council of Europe’s website.

The group spent the majority of the meeting considering a document prepared by the Council of Europe’s secretariat that contains proposals for changes to the Convention 108 and the Protocol. One of the main topics was the regulation of transborder data flows, with input from Richard Thomas, Global Strategy Advisor of the Centre for Information Policy Leadership at Hunton & Williams (the proposal is contained on pages 20-22 of the secretariat’s draft).

Broadly speaking, the ICC proposal would move away from focusing on the transfer of personal data across borders. Under the proposal, the Convention would instead provide that personal data should receive an adequate level of protection under the Convention no matter where they are processed, if the processing concerns individuals who reside in a state that is a party to the Convention, or manifests a sufficient connection to such a state. In addition, the proposal would allow organizations (not just states) to be found to offer adequate protection, and would implement the principle of accountability by allowing international data transfers to organizations that (1) have implemented appropriate and effective measures for ensuring adequate protection under the Convention, and (2) are able to demonstrate such mechanisms to supervisory authorities.

Consideration of the amendments to the Convention will continue at the meeting of the Plenary of the Council of Europe’s Consultative Committee, which will take place in Strasbourg from November 29 to December 2, 2011.