Draft additional protocol to Convention ETS 108 on Supervisory Authorities and Transborder Data Flows

Opinion 217 (2000)

Author(s):

Parliamentary Assembly

Origin

Assembly debate on 5 April 2000 (12th Sitting) (see Doc. 8660, report of the Committee on Legal Affairs and Human Rights, rapporteur: Mr Bartumeu Cassany). Text adopted by the Assembly on 5 April2000 (12th Sitting).

Thesaurus

1. The Assembly believes that the protection of personal data and privacy is of prime importance in this era of the Internet and the information society.

2. The Assembly supports the draft additional protocol to the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, aimed at adapting the convention in view of the new developments in this field, while continuing to meet the requirements of individual freedom.

3. It considers that in requiring the parties to set up supervisory bodies, if they have not already done so, this text rightly reflects the Council of Europe’s various sector-based recommendations and the positions of the European Union in this field, and in particular Directive 95/46/EC of the European Parliament and of the Council of the European Union.

4. The Assembly is nevertheless of the opinion that the powers of the supervisory authorities should be broader, especially given the new forms of information technology and the growing volume of personal data being transferred. In particular, they should be given regulatory powers in order to lay down simplified rules so that the more customary types of data processing which pose a lesser threat to fundamental freedoms can be subject to less stringent formalities. They could also be invited to submit opinions on all draft legislation and regulations in this field.

5. The Assembly also believes that the supervisory authorities, the nature of which is not specified in the draft protocol, should be independent authorities, as defined in the case-law of the organs of the European Convention on Human Rights, bearing in mind the pressure that may be exerted on them from, for example, public authorities.

6. Lastly, the Assembly believes that the scope of international co-operation between supervisory authorities should be broader and that supervisory authorities should meet together in an appropriate forum under the auspices of the convention - namely the Consultative Committee of the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data - in order to pool experience, formulate opinions and partake in joint discussions.

7. The Assembly recommends that the draft protocol provide for the Consultative Committee to assist the parties, particularly those states that have ratified the convention most recently, [(1) The states which had ratified the convention on 11 February 2000 were the member states of the European Union, as well as Hungary, Iceland, Norway, Slovenia and Switzerland.] in complying with its basic principles and monitoring their application more rigorously.

8. In a field so specific and specialised as this, the Council of Europe’s existing machinery ought to be strengthened and it ought to be able to call on independent experts and specialists in new information technologies. The Council of Europe bodies should also be able to carry out or support projects in partnership with the private sector.

9. Accordingly, the Assembly recommends that the Committee of Ministers make the following amendments to the draft protocol:

9.1 in Article 1, paragraph 2, after the word “intervention” add “as well as the power to deliver opinions on all draft legislation or regulations in this field, the power to lay down simplified rules so that the more customary types of data processing which pose a lesser threat to fundamental freedoms can be subject to less stringent formalities”;

9.2 Article 1, paragraph 3, should be worded as follows: “The supervisory authorities shall be independent public authorities.”;

9.3 Article 1, paragraph 5, should be worded as follows: “In accordance with the provisions of Chapter IV and without prejudice to the provisions of Article 13 of the convention, the supervisory authorities shall co-operate with one another in an appropriate framework within the consultative committee set up under the convention, to the extent necessary to carry out their tasks, in particular by exchanging all relevant information”;

9.4 a new article should be included in the draft protocol, worded as follows: “The consultative committee shall help the parties to comply with the basic principles of the convention and this protocol and to monitor their application more rigorously.”

10. The Assembly also recommends that the Committee of Ministers invite those states that have not yet done so:

10.1 to sign and ratify the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, and the additional protocol, without delay;

10.2 to pass legislation on the protection of personal data, taking inspiration from the principles enshrined in the convention.

11. The Assembly further recommends that the Committee of Ministers invite the European Union to accede to the convention in the interests of a more consistent European constitutional approach to data protection.

12. Finally, the Assembly recommends that the Committee of Ministers help those states not yet parties to the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data to introduce appropriate laws and regulations in this field.

13. The Parliamentary Assembly believes it is also important to ensure effective protection for the rights enshrined in the convention and the draft protocol when transferring personal data to third countries, by making sure that these transfers are accompanied by suitable safeguards. It takes note of the discussions between the member states of the European Union and the United States with a view to reaching an agreement containing safeguards for transborder flows of data between Europe and the United States. It is aware that such an agreement will have implications for non-EU states which have ratified the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data. It fears that this agreement is not in keeping with the basic principles of the convention. Accordingly, the Assembly invites the Committee of Ministers to ask the consultative committee of the said convention to examine this agreement and to deliver an opinion on its compliance with the provisions of the convention.