Personal data protection: a twofold step forward with the GDPR and Convention 108

This post is also available in: frFrançais (French)

Brussels, 24 May 2018 – AEDH welcomes the validation, on 18 May 2018, of the modernisation of Convention 108 (Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data) by the Council of Europe.

While all EU Member States strive to implement the General Data Protection Regulation (GDPR) that will enter into force on 25 May 2018, the signature of the modernised version of Convention 108 by the Council of Europe’s Committee of Ministers offers the only legally-binding instrument for data protection, with treaty-level commitments, that is equivalent to the GDPR. An instrument that can be adopted to all countries in the world that wish to do so.

AEDH, as observer member, followed the work related to a well-founded modernisation considering the evolution of the data digital processing since 1981, when the Council of Europe first adopted Convention 108. AEDH has no doubt that the modernised Convention will strengthen data protection and fundamental freedoms.

Free of technological considerations that could have made it obsolete in the near future, Convention 108 provides important if not essential guarantees such as the obligation for data controllers to report data breaches, respect the principles of privacy by design, proportionality and minimisation of the data collected, as well as the introduction of the right to know the reasoning behind data processing and the right to oppose it. The modernisation protocol also allows the committee in charge of the Convention to verify compliance by the signatory countries.

Fifty countries are already Parties to Convention 108, which is now open to ratification by the European Union and other international organisations. AEDH hopes as many countries as possible will ratify the Convention in order to ensure worldwide protection of privacy, which remains a fundamental right.