European Treaty Series - No.

108

CONVENTION FOR THE PROTECTION OF INDIVIDUALS WITH REGARD TO AUTOMATIC PROCESSING OF PERSONAL DATA

Strasbourg, 28.I.1981

ETS108AutomaticprocessingofPersonalData,28.I.1981 _______________________________________________________________________________________________

Preamble ThememberStatesoftheCouncilofEurope,signatoryhereto, ConsideringthattheaimoftheCouncilofEuropeistoachievegreaterunitybetweenits members,basedinparticularonrespectfortheruleoflaw,aswellashumanrightsand fundamentalfreedoms; Considering that it is desirable to extend the safeguards for everyone's rights and fundamentalfreedoms,andinparticulartherighttotherespectforprivacy,takingaccountof theincreasingflowacrossfrontiersofpersonaldataundergoingautomaticprocessing; Reaffirming at the same time their commitment to freedom of information regardless of frontiers; Recognisingthatitisnecessarytoreconcilethefundamentalvaluesoftherespectforprivacy andthefreeflowofinformationbetweenpeoples, Haveagreedasfollows: ChapterIGeneralprovisions Article1Objectandpurpose ThepurposeofthisconventionistosecureintheterritoryofeachPartyforeveryindividual, whateverhisnationalityorresidence,respectforhisrightsandfundamentalfreedoms,andin particularhisrighttoprivacy,withregardtoautomaticprocessingofpersonaldatarelatingto him(dataprotection). Article2Definitions Forthepurposesofthisconvention:
a

personal data means any information relating to an identified or identifiable individual(datasubject); automateddatafilemeansanysetofdataundergoingautomaticprocessing; automaticprocessingincludesthefollowingoperationsifcarriedoutinwholeorin partbyautomatedmeans:storageofdata,carryingoutoflogicaland/orarithmetical operationsonthosedata,theiralteration,erasure,retrievalordissemination; controllerofthefilemeansthenaturalorlegalperson,publicauthority,agencyorany

b c

ETS108AutomaticprocessingofPersonalData,28.I.1981 _______________________________________________________________________________________________

otherbodywhoiscompetentaccordingtothenationallawtodecidewhatshouldbethe purposeoftheautomateddatafile,whichcategoriesofpersonaldatashouldbestored andwhichoperationsshouldbeappliedtothem.

Article3Scope
1

The Parties undertake to apply this convention to automated personal data files and automaticprocessingofpersonaldatainthepublicandprivatesectors. AnyStatemay,atthetime ofsignatureorwhendepositing itsinstrument ofratification, acceptance,approvaloraccession,oratanylatertime,givenoticebyadeclarationaddressed totheSecretaryGeneraloftheCouncilofEurope:
a

thatitwillnotapplythisconventiontocertaincategoriesofautomatedpersonaldata files,alistofwhichwillbedeposited.Inthislistitshallnotinclude,however,categories ofautomateddatafilessubject under itsdomesticlawtodataprotectionprovisions. Consequently, it shall amend this list by a new declaration whenever additional categoriesofautomatedpersonaldatafilesaresubjectedtodataprotectionprovisions underitsdomesticlaw; that it will also apply this convention to information relating to groups of persons, associations, foundations, companies, corporations and any other bodies consisting directlyorindirectlyofindividuals,whetherornotsuchbodiespossesslegalpersonality; thatitwillalsoapplythisconventiontopersonaldatafileswhicharenotprocessed automatically.

Any State which has extended the scope of this convention by any of the declarations providedforinsubparagraph2.borcabovemaygivenoticeinthesaiddeclarationthatsuch extensionsshallapplyonlytocertaincategoriesofpersonaldatafiles,alistofwhichwillbe deposited. Any Party which has excluded certain categories of automated personal data files by a declarationprovidedforinsubparagraph2.aabovemaynotclaimtheapplicationofthis conventiontosuchcategoriesbyaPartywhichhasnotexcludedthem. Likewise,aPartywhichhasnotmadeoneorotheroftheextensionsprovidedforinsub paragraphs2bandcabovemaynotclaimtheapplicationofthisconventiononthesepoints withrespecttoaPartywhichhasmadesuchextensions. Thedeclarationsprovidedforinparagraph2aboveshalltakeeffectfromthemomentofthe entryintoforceoftheconventionwithregardtotheStatewhichhasmadethemiftheyhave beenmadeatthetimeofsignatureordepositofitsinstrumentofratification,acceptance, approvaloraccession,orthree monthsaftertheirreceiptbytheSecretary Generalofthe Council of Europe if they have been made at any later time. These declarations may be withdrawn,inwholeorinpart,byanotificationaddressedtotheSecretaryGeneralofthe CouncilofEurope.Suchwithdrawalsshalltakeeffectthreemonthsafterthedateofreceiptof suchnotification.

ETS108AutomaticprocessingofPersonalData,28.I.1981 _______________________________________________________________________________________________

ChapterIIBasicprinciplesfordataprotection Article4DutiesoftheParties
1

EachPartyshalltakethenecessarymeasuresinitsdomesticlawtogiveeffecttothebasic principlesfordataprotectionsetoutinthischapter.

ETS108AutomaticprocessingofPersonalData,28.I.1981 _______________________________________________________________________________________________
2

Thesemeasuresshallbetakenatthelatestatthetimeofentryintoforceofthisconventionin respectofthatParty. Article5Qualityofdata Personaldataundergoingautomaticprocessingshallbe:

a b

obtainedandprocessedfairlyandlawfully; storedforspecifiedandlegitimatepurposesandnotusedinawayincompatiblewith thosepurposes; adequate,relevantandnotexcessiveinrelationtothepurposesforwhichtheyarestored; accurateand,wherenecessary,keptuptodate; preservedinaformwhichpermitsidentificationofthedatasubjectsfornolongerthanis requiredforthepurposeforwhichthosedataarestored.

c d e

Article6Specialcategoriesofdata Personaldatarevealingracialorigin,politicalopinionsorreligiousorotherbeliefs,aswellas personaldataconcerninghealthorsexuallife,maynotbeprocessedautomaticallyunless domesticlawprovidesappropriatesafeguards.Thesameshallapplytopersonaldatarelating tocriminalconvictions. Article7Datasecurity Appropriatesecuritymeasuresshallbetakenfortheprotectionofpersonaldatastoredin automateddatafilesagainstaccidentalorunauthoriseddestructionoraccidentallossaswell asagainstunauthorisedaccess,alterationordissemination. Article8Additionalsafeguardsforthedatasubject Anypersonshallbeenabled:
a

toestablishtheexistenceofanautomatedpersonaldatafile,itsmainpurposes,aswellas theidentityandhabitualresidenceorprincipalplaceofbusinessofthecontrollerofthe file; toobtainatreasonableintervalsandwithoutexcessivedelayorexpenseconfirmationof whetherpersonaldatarelatingtohimarestoredintheautomateddatafileaswellas communicationtohimofsuchdatainanintelligibleform; toobtain,asthecasemaybe,rectificationorerasureofsuchdataifthesehavebeen processedcontrarytotheprovisionsofdomesticlawgivingeffecttothebasicprinciples setoutinArticles5and6ofthisconvention; tohavearemedyifarequestforconfirmationor,asthecasemaybe,communication, rectificationorerasureasreferredtoinparagraphsbandcofthisarticleisnotcomplied

ETS108AutomaticprocessingofPersonalData,28.I.1981 _______________________________________________________________________________________________

with.

Article9Exceptionsandrestrictions
1

NoexceptiontotheprovisionsofArticles5,6and8ofthisconventionshallbeallowedexcept withinthelimitsdefinedinthisarticle. DerogationfromtheprovisionsofArticles5,6and8ofthisconventionshallbeallowedwhen suchderogationisprovidedforbythelawofthePartyandconstitutesanecessarymeasurein ademocraticsocietyintheinterestsof:

a

protecting State security, public safety, the monetary interests of the State or the suppressionofcriminaloffences; protectingthedatasubjectortherightsandfreedomsofothers.

b 3

RestrictionsontheexerciseoftherightsspecifiedinArticle8,paragraphsb,candd,maybe provided by law with respect to automated personal data files used for statistics or for scientificresearchpurposeswhenthereisobviouslynoriskofaninfringementoftheprivacy ofthedatasubjects. Article10Sanctionsandremedies Each Party undertakes to establish appropriate sanctions and remedies for violations of provisionsofdomesticlawgivingeffecttothebasicprinciplesfordataprotectionsetoutin thischapter. Article11Extendedprotection Noneoftheprovisionsofthischaptershallbeinterpretedaslimitingorotherwiseaffecting the possibilityforaPartytogrant datasubjectsawidermeasure ofprotectionthanthat stipulatedinthisconvention.

ChapterIIITransborderdataflows Article12Transborderflowsofpersonaldataanddomesticlaw
1

The following provisions shall apply tothe transfer across national borders, by whatever medium,ofpersonaldataundergoingautomaticprocessingorcollectedwithaviewtotheir beingautomaticallyprocessed. APartyshallnot,forthesolepurposeoftheprotectionofprivacy,prohibitorsubjectto special authorisationtransborder flows of personal data going to the territory ofanother Party. Nevertheless,eachPartyshallbeentitledtoderogatefromtheprovisionsofparagraph2:

ETS108AutomaticprocessingofPersonalData,28.I.1981 _______________________________________________________________________________________________
a

insofarasitslegislationincludesspecificregulationsforcertaincategoriesofpersonal dataorofautomatedpersonaldatafiles,becauseofthenatureofthosedataorthose files,exceptwheretheregulationsoftheotherPartyprovideanequivalentprotection; whenthetransferismadefromitsterritorytotheterritoryofanonContractingState through the intermediary of the territory of another Party, in order to avoid such transfers resulting in circumvention of the legislation of the Party referred to at the beginningofthisparagraph.

ChapterIVMutualassistance Article13CooperationbetweenParties
1

The Parties agree to render each other mutual assistance in order to implement this convention. Forthatpurpose:
a

eachPartyshalldesignateoneormoreauthorities,thenameandaddressofeachof whichitshallcommunicatetotheSecretaryGeneraloftheCouncilofEurope; each Party which has designated more than one authority shall specify in its communication referred to in the previous subparagraph the competence of each authority.

AnauthoritydesignatedbyaPartyshallattherequestofanauthoritydesignatedbyanother Party:
a b

furnishinformationonitslawandadministrativepracticeinthefieldofdataprotection; take, in conformity with its domestic law and for the sole purpose of protection of privacy,allappropriatemeasuresforfurnishingfactualinformationrelatingtospecific automatic processing carried out in its territory, with the exception however of the personaldatabeingprocessed.

Article14Assistancetodatasubjectsresidentabroad
1

Each Party shall assist any person resident abroad to exercise the rights conferred by its domesticlawgivingeffecttotheprinciplessetoutinArticle8ofthisconvention. WhensuchapersonresidesintheterritoryofanotherPartyheshallbegiventheoptionof submittinghisrequestthroughtheintermediaryoftheauthoritydesignatedbythatParty. Therequestforassistanceshallcontainallthenecessaryparticulars,relatinginteraliato:
a

thename,addressandanyotherrelevantparticularsidentifyingthepersonmakingthe request;

ETS108AutomaticprocessingofPersonalData,28.I.1981 _______________________________________________________________________________________________
b c

theautomatedpersonaldatafiletowhichtherequestpertains,oritscontroller; thepurposeoftherequest.

Article15Safeguardsconcerningassistancerenderedbydesignatedauthorities
1

An authority designated by a Party which has received information from an authority designatedbyanotherPartyeitheraccompanyingarequestforassistanceorinreplytoits own request for assistance shall not use that information for purposes other than those specifiedintherequestforassistance.

ETS108AutomaticprocessingofPersonalData,28.I.1981 _______________________________________________________________________________________________
2

EachPartyshallseetoitthatthepersonsbelongingtooractingonbehalfofthedesignated authorityshallbeboundbyappropriateobligationsofsecrecyorconfidentialitywithregard tothatinformation. InnocasemayadesignatedauthoritybeallowedtomakeunderArticle14,paragraph2,a request for assistance on behalf ofa data subject resident abroad, ofitsown accordand withouttheexpressconsentofthepersonconcerned. Article16Refusalofrequestsforassistance AdesignatedauthoritytowhicharequestforassistanceisaddressedunderArticles13or14 ofthisconventionmaynotrefusetocomplywithitunless:
a

the request is not compatible with the powers in the field of data protection of the authoritiesresponsibleforreplying; therequestdoesnotcomplywiththeprovisionsofthisconvention; compliancewiththerequestwouldbeincompatiblewiththesovereignty,securityor publicpolicy(ordrepublic)ofthePartybywhichitwasdesignated,orwiththerightsand fundamentalfreedomsofpersonsunderthejurisdictionofthatParty.

b c

Article17Costsandproceduresofassistance
1

MutualassistancewhichthePartiesrendereachotherunderArticle13andassistancethey rendertodatasubjectsabroadunderArticle14shallnotgiverisetothepaymentofanycosts orfeesotherthanthoseincurredforexpertsandinterpreters.Thelattercostsorfeesshallbe bornebythePartywhichhasdesignatedtheauthoritymakingtherequestforassistance. Thedatasubjectmaynotbechargedcostsorfeesinconnectionwiththestepstakenonhis behalfintheterritoryofanotherPartyotherthanthoselawfullypayablebyresidentsofthat Party. Otherdetailsconcerningtheassistancerelatinginparticulartotheformsandproceduresand thelanguagestobeused,shallbeestablisheddirectlybetweenthePartiesconcerned.

ChapterVConsultativeCommittee Article18Compositionofthecommittee
1 2

AConsultativeCommitteeshallbesetupaftertheentryintoforceofthisconvention. EachPartyshallappointarepresentativetothecommitteeandadeputyrepresentative.Any memberStateoftheCouncilofEuropewhichisnotaPartytotheconventionshallhavethe righttoberepresentedonthecommitteebyanobserver. TheConsultativeCommitteemay,byunanimousdecision,inviteanynonmemberStateofthe CouncilofEuropewhichisnotaPartytotheconventiontoberepresentedbyanobserverata givenmeeting.

10

ETS108AutomaticprocessingofPersonalData,28.I.1981 _______________________________________________________________________________________________

Article19Functionsofthecommittee TheConsultativeCommittee:
a

may make proposals with a view to facilitating or improving the application of the convention; maymakeproposalsforamendmentofthisconventioninaccordancewithArticle21; shallformulateitsopiniononanyproposalforamendmentofthisconventionwhichis referredtoitinaccordancewithArticle21,paragraph3; may, at the request of a Party, express an opinion on any question concerning the applicationofthisconvention.

b c

Article20Procedure
1

TheConsultativeCommitteeshallbeconvenedbytheSecretaryGeneraloftheCouncilof Europe.Itsfirstmeetingshallbeheldwithintwelvemonthsoftheentryintoforceofthis convention.Itshallsubsequentlymeetatleastonceeverytwoyearsandinanycasewhenone thirdoftherepresentativesofthePartiesrequestitsconvocation. AmajorityofrepresentativesofthePartiesshallconstituteaquorumforameetingofthe ConsultativeCommittee. Aftereachofitsmeetings,theConsultativeCommittee shallsubmit tothe Committee of Ministers of the Council of Europe a report on its work and on the functioning of the convention. Subjecttotheprovisionsofthisconvention,theConsultativeCommitteeshalldrawupits ownRulesofProcedure.

ChapterVIAmendments Article21Amendments
1

AmendmentstothisconventionmaybeproposedbyaParty,theCommitteeofMinistersof theCouncilofEuropeortheConsultativeCommittee. AnyproposalforamendmentshallbecommunicatedbytheSecretaryGeneraloftheCouncil ofEuropetothememberStatesoftheCouncilofEuropeandtoeverynonmemberState whichhasaccededtoorhasbeeninvitedtoaccedetothisconventioninaccordancewiththe provisionsofArticle23. Moreover, any amendment proposed by a Party or the Committee of Ministers shall be communicated to the Consultative Committee, which shall submit to the Committee of Ministersitsopiniononthatproposedamendment. The Committee of Ministers shall consider the proposed amendment and any opinion submittedbytheConsultativeCommitteeandmayapprovetheamendment.

11

ETS108AutomaticprocessingofPersonalData,28.I.1981 _______________________________________________________________________________________________
5

Thetextofany amendmentapprovedbytheCommitteeofMinistersinaccordancewith paragraph4ofthisarticleshallbeforwardedtothePartiesforacceptance. Anyamendmentapprovedinaccordancewithparagraph4ofthisarticleshallcomeintoforce onthethirtiethdayafterallPartieshaveinformedtheSecretaryGeneraloftheiracceptance thereof.

ChapterVIIFinalclauses Article22Entryintoforce
1

ThisconventionshallbeopenforsignaturebythememberStatesoftheCouncilofEurope.It issubjecttoratification,acceptance orapproval.Instrumentsofratification,acceptance or approvalshallbedepositedwiththeSecretaryGeneraloftheCouncilofEurope. Thisconventionshallenterintoforceonthefirstdayofthemonthfollowingtheexpirationof aperiodofthreemonthsafterthedateonwhichfivememberStatesoftheCouncilofEurope haveexpressedtheirconsenttobeboundbytheconventioninaccordancewiththeprovisions oftheprecedingparagraph. InrespectofanymemberStatewhichsubsequentlyexpressesitsconsenttobeboundbyit, theconventionshallenterintoforceonthefirstdayofthemonthfollowingtheexpirationofa periodofthreemonthsafterthedateofdepositoftheinstrumentofratification,acceptanceor approval. Article23AccessionbynonmemberStates

Aftertheentryintoforceofthisconvention,theCommitteeofMinistersoftheCouncilof Europe may invite any State not a member of the Council of Europe to accede to this conventionbyadecisiontakenbythemajorityprovidedforinArticle20.doftheStatuteof theCouncilofEuropeandbytheunanimousvoteoftherepresentativesoftheContracting Statesentitledtositonthecommittee. InrespectofanyaccedingState,theconventionshallenterintoforceonthefirstdayofthe monthfollowingtheexpirationofaperiodofthreemonthsafterthedateofdepositofthe instrumentofaccessionwiththeSecretaryGeneraloftheCouncilofEurope. Article24Territorialclause

AnyState may at the time ofsignature orwhendepositing itsinstrument ofratification, acceptance,approvaloraccession,specifytheterritoryorterritoriestowhichthisconvention shallapply. AnyStatemayatanylaterdate,byadeclarationaddressedtotheSecretaryGeneralofthe CouncilofEurope,extendtheapplicationofthisconventiontoanyotherterritoryspecifiedin thedeclaration.Inrespectofsuchterritorytheconventionshallenterintoforceonthefirst dayofthemonthfollowingtheexpirationofaperiodofthreemonthsafterthedateofreceipt ofsuchdeclarationbytheSecretaryGeneral. Anydeclarationmadeunderthetwoprecedingparagraphsmay,inrespectofanyterritory

12

ETS108AutomaticprocessingofPersonalData,28.I.1981 _______________________________________________________________________________________________

specified in such declaration, be withdrawn by a notification addressed to the Secretary General.Thewithdrawalshallbecomeeffectiveonthefirstdayofthemonthfollowingthe expiration of a period of six months after the date of receipt of such notification by the SecretaryGeneral.

Article25Reservations Noreservationmaybemadeinrespectoftheprovisionsofthisconvention. Article26Denunciation

1

AnyPartymayatanytimedenouncethisconventionbymeansofanotificationaddressedto theSecretaryGeneraloftheCouncilofEurope. Such denunciation shall become effective on the first day of the month following the expirationofaperiodofsixmonthsafterthedateofreceiptofthenotificationbytheSecretary General. Article27Notifications TheSecretaryGeneraloftheCouncilofEuropeshallnotifythememberStatesoftheCouncil andanyStatewhichhasaccededtothisconventionof:
a b c d

anysignature; thedepositofanyinstrumentofratification,acceptance,approvaloraccession; anydateofentryintoforceofthisconventioninaccordancewithArticles22,23and24; anyotheract,notificationorcommunicationrelatingtothisConvention.

In witness whereof the undersigned, being duly authorised thereto, have signed this Convention. DoneatStrasbourg,the28thdayofJanuary1981,inEnglishandinFrench,bothtextsbeing equallyauthoritative,inasinglecopywhichshallremaindepositedinthearchivesofthe CouncilofEurope.TheSecretaryGeneraloftheCouncilofEuropeshalltransmitcertified copiestoeachmemberStateoftheCouncilofEuropeandtoanyStateinvitedtoaccedetothis Convention.