MONACO among the first signatories of the Amending Protocol (CETS No. 223) to “Convention 108”

MONACO signed on 10 October 2018 the Amending Protocol (CETS: 223) – open for signature by the 53 Contracting States[i] to “Convention 108”[ii] – together with 19 other Council of Europe member States (Austria, Belgium, Bulgaria, Estonia, Finland, France, Germany, Ireland, Latvia, Lithuania, Luxembourg, Norway, Netherlands, Portugal, Russia, Spain, Sweden, Czech Republic, United Kingdom), and Uruguay, non-member State. Iceland joined the list of signatories on 21 November 2018.

The Amending Protocol modernises and enhances the effectiveness of “Convention 108” and its Additional Protocol concerning Supervisory Authorities and Transborder Flows (CETS: 181).

The Ad Hoc Committee on Data Protection (CAHDATA) responsible for finalizing the modernization was particularly attentive to the fact that the amended “Convention 108” remind consistent with the General Regulations on Data Protection of the European Union entered into force on 25 May 2018 (GDPR), which “amplifies the principles of Convention 108”.[iii]

Conversely, the GDPR takes into account accession to “Convention 108” in assessing whether a third country to the EU offers an adequate level of data protection substantially equivalent to that of the EU (if yes, transfers of personal data to that third country do not require authorisation).[iv]

“Convention 108” covers the processing of data of natural persons, but domestic law may provide for the extension of protection to the data of legal persons in order to protect their legitimate interests.

“Convention 108” as modernised by Amending Protocol CETS No. 223 will only enter into force after ratification.

[i] Contracting States to “Convention 108”: [Council of Europe member States] Albania, Andorra, Armenia, Austria, Azerbaijan, Belgium, Bosnia and Herzegovina, Bulgaria, Croatia, Croatia, Denmark, Estonia, Spain, Federation of Russia, Finland, France, Georgia, Greece, Hungary, Ireland, Iceland, Italy, Latvia, The Former Yugoslav Republic of Macedonia, Liechtenstein, Lithuania, Luxembourg, Malta, Monaco, Montenegro, Norway, Netherlands, Poland, Portugal, Republic Moldova, Slovak Republic, Czech Republic, Romania, San Marino, Serbia, Slovenia, Sweden, Switzerland, Turkey, Ukraine, United Kingdom; [non-member States] Argentina, Burkina Faso, Cape Verde, Morocco, Mauritius, Mexico, Senegal, Tunisia, Uruguay. Open to International Organisations too.

[ii] Convention for the protection of individuals with regard to the processing of personal data of 28 January 1981.

[iii] Explanatory Report to the Protocol amending the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, 10 October 2018.

[iv] GDPR, Recital 105.