Draft Second Additional Protocol to the Convention on Cybercrime on enhanced co-operation and disclosure of electronic evidence

Opinion 299 (2021) | Provisional version

Author(s):

Parliamentary Assembly

Origin

Assembly debate on 30 September 2021 (30th sitting) (see Doc. 15379, report of the Committee on Legal Affairs and Human Rights, rapporteur: Mr Kamal Jafarov). Text adopted by the Assembly on 30 September 2021 (30th sitting).

1. The Parliamentary Assembly recalls that the 20th anniversary of the adoption of the Convention on Cybercrime (ETS No. 185) will be celebrated in November 2021. It welcomes the success that this Convention of the Council of Europe is enjoying world-wide, currently with 66 ratifications.

2. The Assembly notes that since 2001, the exploitation of information technology for criminal purposes has strongly increased. Cybercrime is considered by many States as a serious threat to human rights, the rule of law, and to the functioning of democratic societies and even to national security. Examples of cybercrimes include online sexual violence against children, the theft and misuse of personal data, election interference and other attacks against democratic institutions, attacks against critical State and public service infrastructures, misuse of informational technology for terrorist purposes and during the ongoing Covid-19 pandemic, cyberattacks on hospitals and laboratories developing vaccines, misuse of domain names to promote fake vaccines and treatments, etc.

3. The purpose of the Second Additional Protocol to the Cybercrime Convention is to provide sharper tools to investigate cybercrime and obtain justice for victims. Given the prevalence of cybercrime today, victims of online crime must be given a better chance at obtaining justice, and perpetrators must be made to face a substantially greater risk of being held to account.

4. The Assembly recalls its previous work on the fight against cybercrime, including its Opinion 226 (2001) “Draft Convention on cyber-crime”, its Opinion 240 (2002) “Draft additional Protocol to the Convention on Cybercrime concerning the criminalisation of acts of a racist and xenophobic nature committed through computer systems”, its Recommendations 2041 (2014) “Improving user protection and security in cyberspace” and 2077 (2015) “Increasing co-operation against cyberterrorism and other large-scale attacks on the Internet” and most recently, its Resolution 2256 (2019) ″Internet governance and human rights″. The Assembly has consistently taken a constructive approach to improving international co-operation in this field whilst upholding human rights.

5. The Assembly recognises that the Draft Protocol is designed to function within the criminal justice systems of the Parties with all the procedures, regulations, methods for transmitting data, conditions and safeguards foreseen in the respective national legal systems. This applies also to the ″direct co-operation″ provided for by Articles 6 and 7, both of which require Parties to establish a proper domestic legal basis for the exercise of these powers.

6. The Assembly further recognises that both the Cybercrime Convention itself and its Additional Protocols face a difficult dilemma. The purpose of these treaties presupposes that as many States as possible to participate in fighting cybercrime as the latter does not recognise borders. Otherwise, cybercriminals will continue to operate from safe havens, to the detriment of their victims all over the world. Countries have very different legal systems, including in the sphere of criminal law and different levels of regulation regarding data protection. The Convention and its Protocols can therefore only set minimum standards of protection that must be implemented by all participant States whilst leaving open the possibility for more advanced States to implement stronger protections for their citizens. But such higher standards of protection must not jeopardize the common goal of the Convention and its Protocols, namely, to make international co-operation in the fight against cybercrime more efficient and effective.

7. The Assembly considers that the Second Additional Protocol to the Cybercrime Convention in principle strikes a reasonable balance in facing the dilemma described above. Having considered numerous proposals by different stakeholders, it suggests nevertheless the following improvements to further strengthen the protection of human rights, in particular the right to privacy:

7.1 enshrine the application of the principle of proportionality in the text of Article 13, in addition to this being mentioned in the Draft Protocol’s explanatory report;

7.2 specify in Article 14 paragraph 2 that the further processing of personal data by the receiving Party shall be provided by law, and shall constitute a necessary and proportionate measure in a democratic society to safeguard important objectives of general public interest or shall otherwise provide for the adequate protection of human rights and liberties;

7.3 include in the list of information to be made available to data subjects under Article 14 paragraph 11 the contact details of the competent data controller;

7.4 update paragraph 12.b of the Draft Protocol so as to ensure that as a general rule, information to individuals related to access and rectification shall be provided free of charge;

7.5 expressly recognise in the text of the Draft Protocol or its explanatory report that privileges and immunities of certain professions such as lawyers, doctors, journalists, religious ministers, or parliamentarians shall be respected;

7.6 make mandatory the public disclosure, by oversight authorities, of aggregate information on the use of the measures under the Protocol and on the number of individuals affected by them;

7.7 in the provisions allowing evidence taking by video conferencing, to accommodate witness protection measures available at national level; and to include the possibility for lawyers to participate in a hearing conducted by video conference to be able to defend their clients’ interests;

7.8 to enhance ″equality of arms″ between prosecution and defence by compelling the competent authorities of the Parties to make use of the investigative instruments placed at their disposal by the Draft Protocol also on behalf of the defence.