Convention 108

Who is excluded from Convention 108 compliance? 

Convention 108 does not apply “to data processing carried out by an individual in the course of purely personal or household activities.”

How can I keep my organization Convention 108 compliant? 

Convention 108 regulates compliance in a similar manner to other data protection laws. Firstly it lists several principles in Articles 5, 7, and 8, according to which personal data processing and collection

• has to be proportionate to the legitimate purpose; 
• has to be carried out on the basis of “free, specific, informed, and unambiguous consent of the data subject;”
• has to be processed lawfully, fairly and in a transparent manner;
• has to be collected for “explicit, specified, and legitimate purposes and not processed in a way incompatible with those purposes;”
• has to be adequate, relevant and not excessive in relation to the purposes for which they are processed;
• has to be “accurate and, where necessary, kept up to date”; and
• has  to be “preserved in a form which permits identification of data subjects for no longer than is necessary for the purposes for which those data are processed.”

Appropriate security measures have to be implemented “against risks such as accidental or unauthorized access to, destruction, loss, use, modification or disclosure of personal data,” and, for the purpose of transparency of processing, controllers have to be inform data subjects of

• their (the controller’s) identity and address;
• the legal basis and the purposes of processing;
• the categories of personal data processed;
• any recipients of the personal data, if that is the case, and
• the means for exercising the data subject rights.

In the case of sensitive personal data, its processing can only be done if appropriate security measures are in place in each country in accordance with Convention 108, guarding sensitive personal data “against the risks that the processing of sensitive data may present for the interests, rights and fundamental freedoms of the data subject, notably a risk of discrimination.”

Article 10 lists additional obligations for controllers and, where applicable, for processors, both of whom are required to

• take all appropriate measures to comply with the Convention and be able to demonstrate this; 
• examine the likely impact of intended data processing on the rights and fundamental freedoms of data subjects prior to the commencement of such processing, and design the data processing in such a manner as to prevent or minimize the risk of interference with those rights and fundamental freedoms;
• implement technical and organizational measures which take into account the implications of the right to the protection of personal data at all stages of the data processing; and
• adapt the above three obligations “according to the nature and volume of the data, the nature, scope and purpose of the processing and, where appropriate, the size of the controller or processor,” in such a way as to have in mind “the interests, rights and fundamental freedoms of the data subjects.”
  
  

What data access rights does Convention 108 grant? 

According to Convention 108, data subjects have the following rights: 

• The right to not be subject to automated decision making
• The right to access their personal data
• The right to be informed of the reasoning behind the processing of their personal data
• The right to object to the processing of their personal data
• The right to correct
• The right to delete

Additionally, data subjects have a private right of action in the event of a violation of the provisions of Convention 108 and to benefit from the assistance of the supervisory authorities of the country where the violation occurred. 

How to address data subject access requests under Convention 108?

Convention 108 does not offer specific guidelines or timeframes for addressing data subject requests, but does mention that data subjects should be able to receive a reply to a request for information “at reasonable intervals and without excessive delay or expense.”

In the case of a request for rectification or erasure, data subjects have the right to receive this “free of charge and without excessive delay.”

Enforcement and penalties

There are no specific penalties for violation of Convention 108, nor is there one single regulating authority, instead what the text of the legislation mandates is that “each Party undertakes to establish appropriate judicial and non-judicial sanctions and remedies for violations of the provisions of this Convention.”

Data Subject Rights - GDPR vs. Convention 108