The aim of the Protocol of amendment is to modernise and improve the Convention (ETS No. 108), taking into account the new challenges to the protection of individuals with regard to the processing of personal data which have emerged since the Convention was adopted in 1980.

The modernisation of the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, the only existing legally binding international treaty with global relevance in this field, addresses the challenges to privacy resulting from the use of new information and communication technologies, and strengthens the convention’s mechanism to ensure its effective implementation.

The Protocol provides a robust and flexible multilateral legal framework to facilitate the flow of data across borders while providing effective safeguards when personal data are being used. It constitutes a bridge between different regions of the world and different normative frameworks, including the new European Union´s legislation that will become fully applicable on 25 May 2018 and which refers to Convention 108 in the context of transborder data flows.

Some of the innovations contained in the Protocol are the following:

• Stronger requirements regarding the proportionality and data minimisation principles, and lawfulness of the processing;
• Extension of the types of sensitive data, which will now include genetic and biometric data, trade union membership and ethnic origin;
• Obligation to declare data breaches;
• Greater transparency of data processing;
• New rights for the persons in an algorithmic decision making context, which are particularly relevant in connection with the development of artificial intelligence;
• Stronger accountability of data controllers;
• Requirement that the “privacy by design” principle is applied;
• Application of the data protection principles to all processing activities, including for national security reasons, with possible exceptions and restrictions subject to the conditions set by the Convention, and in any case with independent and effective review and supervision;
• Clear regime of transborder data flows;
• Reinforced powers and independence of the data protection authorities and enhancing legal basis for international cooperation.

• Convention and Protocols

• Directorate General Human Rights and Rule of Law - Data Protection
• Directorate General Human Rights and Rule of Law - European Committee on Legal Co-operation (CDCJ)