Forty years ago tomorrow, on 28 January 1981, the first ever binding international treaty addressing the need to protect personal data was opened for signature in Strasbourg: the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, also known as “Convention 108”.

The treaty was modernised in 2018 by an Amending Protocol, not yet in force, aimed at ensuring that its data protection principles are still adapted to new technologies and to strengthen its follow-up mechanism.

To mark the anniversary of this ground-breaking treaty, Council of Europe Secretary General Marija Pejčinović Burić said: “The convention has become a major tool of global relevance for protecting the right of individuals to data protection by creating a common legal space in its currently 55 state parties. The modernised convention will address the new challenges for the protection of personal data globally in the digital era. States should ratify the protocol modernising “Convention 108” so it can enter into force as soon as possible”.

Open to any country and with the unique potential to become a global standard, in 1981 the “Convention 108” established the basic principles of data protection and rules which are still applicable today. Drafted in a technologically neutral style, the convention has remained fully valid for four decades. Today it has 55 state parties in four continents – another 20 countries participate in its work - and the Convention has become the backbone of national legislation in many countries throughout the world. The convention also provided the pillars for the first European Union directive on data protection adopted in 1995, to which succeeded in 2018 the General Data Protection Regulation (GDPR).

Since 1981 information technologies have transformed society and the way information is collected and processed. When “Convention 108” was drafted, new challenges were emerging due to the growing use of computers and data banks which enabled the increase of automatic processing of personal information in the public and private sectors.

One of the aims of the 2018 protocol modernising the Convention is to bring further together the various normative frameworks developed in different regions of the world, including the European Union’s, and to provide a multilateral instrument that is flexible, transparent and robust, facilitating the flow of data across borders while providing effective safeguards against abuse. Ten countries have already ratified the protocol creating this modernised “Convention 108” and another 33 have signed.

***

Data Protection Day 2021

On Data Protection Day 2021, a number of online events will commemorate the 40th anniversary of the Council of Europe’s data protection convention. Since its launching by the Committee of Ministers of the Council of Europe in 2006, Data Protection Day is celebrated every year on 28 January to mark the opening for signature of the treaty.

An event organised by the German Federal Ministry of the Interior, Building and Community under the German Presidency of the Council of Europe Committee of Ministers will examine the challenges of international data transfers from the perspective of Convention 108+ and the EU GDPR. (1.00 p.m. to 4.30 p.m. CET).

In addition, the winners of the 2021 edition of the Stefano Rodotà Award, which rewards innovative and original academic research on data protection, will be announced.

Finally, guidelines on facial recognition just adopted by the Committee of Convention 108 will be released.

More information on Council of Europe’s activities - Data Protection Day