One of the main objectives of Convention 108+ is to facilitate the free flow of information between Parties to the Convention and from Parties to non-Parties while at the same time ensuring that the protection “flies” with the personal data when it leaves the jurisdiction of the Parties. The main reasons for such requirements are laid down in the Preamble of the Convention: “(…) it is necessary to secure the human dignity and protection of the human rights and fundamental freedoms of every individual and, given the diversification, intensification and globalisation of data processing and personal data flows, personal autonomy based on a person’s right to control of his or her personal data and the processing of such data”.
Pre-approved standardised safeguards provided by legally binding and enforceable instruments can ensure an appropriate level of protection guaranteed by Convention 108+ in cases where personal data are sent outside of its territorial scope of application. Practice shows that the use of such instruments is deemed to be a hands-on, user-friendly way for the transfer of data across borders and are relied upon by most data exporters and importers in the private sector in a transborder flow context.
The Committee of Convention 108 (T-PD), during its 44th plenary meeting held in Strasbourg from 14 to 16 June 2023, adopted the first module of the Model Contractual Clauses for transborder data flows of personal data developed on the basis of Convention 108+, for data flows from data controller to data controller, which are now also publicly available. These much-awaited clauses have the potential to bridge similar transfer tools (such as the ones existing in the EU Member States, in Latin America, for Asean countries, and national ones, etc.) and to contribute to the convergence towards appropriate data protection standards globally.
The clauses are recommended to be used as adopted and are therefore ready for pre-approval by competent national authorities to be transposed in the nationally and regionally available set of transfer instruments, mechanisms for data controllers. To be fully exhaustive, they are to be complemented with two more modules soon to be adopted by the T-PD.
