Logo Assembly Logo Hemicycle

Draft second additional protocol to the Convention on Cybercrime on enhanced co-operation and disclosure of electronic evidence

Opinion 299 (2021)

Parliamentary Assembly
Assembly debate on 30 September 2021 (30th sitting) (see Doc. 15379, report of the Committee on Legal Affairs and Human Rights, rapporteur: Mr Kamal Jafarov). Text adopted by the Assembly on 30 September 2021 (30th sitting).
1. The Parliamentary Assembly recalls that the 20th anniversary of the adoption of the Convention on Cybercrime (ETS No. 185) will be celebrated in November 2021. It welcomes the success that this Council of Europe convention is enjoying worldwide, currently with 66 ratifications.
2. The Assembly notes that since 2001, the exploitation of information technology for criminal purposes has strongly increased. Cybercrime is considered by many States to be a serious threat to human rights, the rule of law, the functioning of democratic societies and even to national security. Examples of cybercrime include online sexual violence against children, the theft and misuse of personal data, election interference and other attacks against democratic institutions, attacks against critical State and public-service infrastructures, misuse of informational technology for terrorist purposes and, during the ongoing Covid-19 pandemic, cyberattacks on hospitals and laboratories developing vaccines against the virus and misuse of domain names to promote fake vaccines and treatments.
3. The purpose of the Second Additional Protocol to the Convention on Cybercrime is to provide more powerful tools with which to investigate cybercrime and obtain justice for victims. Given the prevalence of cybercrime today, victims of online crime must be given a better chance of obtaining justice and perpetrators made to face a substantially greater risk of being held to account.
4. The Assembly recalls its previous work on the fight against cybercrime, including its Opinion 226 (2001) “Draft Convention on Cyber-crime”, its Opinion 240 (2002) “Draft additional Protocol to the Convention on Cybercrime concerning the criminalisation of acts of a racist and xenophobic nature committed through computer systems”, its Recommendations 2041 (2014) “Improving user protection and security in cyberspace” and 2077 (2015) “Increasing co-operation against cyberterrorism and other large-scale attacks on the Internet” and, most recently, its Resolution 2256 (2019) “Internet governance and human rights”. The Assembly has consistently taken a constructive approach to improving international co-operation in this field while upholding human rights.
5. The Assembly recognises that the draft second additional protocol is designed to function within the criminal justice systems of the parties, with all the procedures, regulations, methods for transmitting data, conditions and safeguards foreseen in their respective national legal systems. This applies also to the “direct co-operation” provided for by Articles 6 and 7, both of which require parties to establish a proper domestic legal basis for the exercise of these powers.
6. The Assembly further recognises that there is a difficult dilemma concerning both the Convention on Cybercrime itself and its additional protocols. The purpose of these treaties presupposes that as many States as possible participate in fighting cybercrime, as such crime does not recognise borders. If they do not, cybercriminals will continue to operate from safe havens, to the detriment of their victims all over the world. Countries have very different legal systems, including in the sphere of criminal law, and different levels of regulation regarding data protection. The convention and its protocols can therefore only set minimum standards of protection, which must be implemented by all participating States, while leaving open the possibility for more advanced States to implement stronger protection for their citizens. But such higher standards of protection must not jeopardise the common goal of the convention and its protocols, namely to make international co-operation in the fight against cybercrime more efficient and effective.
7. The Assembly considers that, in principle, the draft second additional protocol to the Convention on Cybercrime strikes a reasonable balance in the face of the dilemma described above. Having considered numerous proposals by the various stakeholders, it nevertheless suggests the following improvements to further strengthen the protection of human rights, in particular the right to privacy:
7.1 enshrine the application of the principle of proportionality in the text of Article 13, in addition to mentioning it in the explanatory report to the draft protocol;
7.2 specify in Article 14, paragraph 2, that the further processing of personal data by the receiving party shall be provided for by law and shall constitute a necessary and proportionate measure in a democratic society to safeguard important objectives of general public interest, or shall otherwise provide for the adequate protection of human rights and freedoms;
7.3 include in the list of information to be made available to data subjects under Article 14, paragraph 11, the contact details of the competent data controller;
7.4 revjse paragraph 12.b of the draft protocol to ensure that, as a general rule, information related to access and rectification shall be provided to individuals free of charge;
7.5 expressly recognise in the text of the draft protocol or its explanatory report that the privileges and immunities of certain professions, such as lawyers, doctors, journalists, religious ministers or parliamentarians, shall be respected;
7.6 make mandatory the public disclosure, by oversight authorities, of aggregate information on the use of the measures under the protocol and on the number of individuals affected by them;
7.7 refer to the witness protection measures available at national level in the provisions allowing the taking of evidence by videoconference, and include the possibility for lawyers to participate in a hearing conducted by videoconference so that they are able to defend their clients’ interests;
7.8 enhance “equality of arms” between the prosecution and the defence by compelling the competent authorities of the parties to make use of the investigative instruments placed at their disposal by the draft protocol also on behalf of the defence.