At Strasbourg, the member States of the Council of Europe open for signature, on 28 January 1981, the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (European Treaty Series No. 108). The text is done in English and in French, both texts being equally authoritative, in a single copy deposited in the archives of the Council of Europe; the Secretary General transmits certified copies to each member State and to any State invited to accede.

The preamble links the Council of Europe’s aim — greater unity based on the rule of law and on human rights and fundamental freedoms — to the need to extend safeguards for the right to respect for privacy, taking account of the increasing flow across frontiers of personal data undergoing automatic processing, while reaffirming commitment to freedom of information regardless of frontiers. The Parties agree that it is necessary to reconcile respect for privacy with the free flow of information between peoples.

Article 1 states the object: to secure in the territory of each Party for every individual, whatever nationality or residence, respect for rights and fundamental freedoms, and in particular the right to privacy, with regard to automatic processing of personal data relating to him (“data protection”). Article 2 defines personal data, automated data file, automatic processing (storage, logical or arithmetical operations, alteration, erasure, retrieval or dissemination) and the controller of the file.

Article 3 requires the Parties to apply the Convention to automated personal data files and automatic processing in the public and private sectors. A State may declare, at signature or when depositing ratification, that it will not apply the Convention to certain categories of automated files (other than those already subject to domestic data-protection rules), that it will also apply it to information relating to groups of persons, or to non-automated files, or that such extensions apply only to listed categories. Exclusions and extensions cannot be claimed reciprocally against a Party that has not made the same choice.

Chapter II requires each Party to give effect in domestic law to the basic principles. Personal data undergoing automatic processing must be obtained and processed fairly and lawfully, stored for specified and legitimate purposes and not used incompatibly with them, adequate, relevant and not excessive, accurate and, where necessary, kept up to date, and preserved in identifiable form no longer than required. Data revealing racial origin, political opinions or religious or other beliefs, and data concerning health or sexual life, may not be processed automatically unless domestic law provides appropriate safeguards; the same applies to data relating to criminal convictions. Appropriate security measures must protect stored data against accidental or unauthorised destruction or loss and against unauthorised access, alteration or dissemination.

Article 8 enables any person to establish the existence of an automated file, its main purposes and the identity of the controller; to obtain confirmation and communication of data in an intelligible form; to obtain rectification or erasure where processing is contrary to the basic principles; and to have a remedy if such a request is not complied with. No exception to Articles 5, 6 and 8 is allowed except within Article 9: derogation must be provided by law and constitute a necessary measure in a democratic society in the interests of State security, public safety, the monetary interests of the State or the suppression of criminal offences, or of protecting the data subject or the rights and freedoms of others. Restrictions on access rights may be provided by law for statistics or scientific research when there is obviously no risk of an infringement of privacy.

Chapter III governs transborder flows: a Party shall not, for the sole purpose of protecting privacy, prohibit or subject to special authorisation flows to the territory of another Party, with derogations for specific categories of data or files, or to prevent transfers via another Party to a non-Contracting State from circumventing its legislation. Later chapters organise mutual assistance between designated authorities, assistance to data subjects resident abroad, a Consultative Committee and the amendment procedure. The Convention is open for signature by member States of the Council of Europe, subject to ratification, acceptance or approval; it enters into force on the first day of the month following the expiry of three months after five member States have expressed consent to be bound. No reservation may be made.

Image: Palais de l'Europe, Strasbourg, Council of Europe; CC BY 3.0, Wikimedia Commons. Cropped to 16:9.

Source consulted: Convention for the Protection of Individuals with Regard to Automatic Processing of Personal Data. Treaty text: Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, ETS No. 108, Council of Europe.