‘Modernised’ Data Protection Convention 108 and the GDPR

Abstract

One week before the GDPR came into force on 25 May 2018, the ‘modernisation’ of data protection Convention 108 was completed by the Council of Europe on 18 May, by the parties to the existing Convention agreeing to a Protocol amending it (‘Protocol’). The new version of the Convention is now being called ‘108 ’ to distinguish it.

This article analyses some aspects of the relationships between 108 and 108 , and further developments at the Plenary Meeting of the Convention’s Consultative Committee in Strasbourg, 19-21 June 2018 including a conference to ‘launch’ the new 108 .

The transition from 108 to 108 is complex. Any new countries wishing to accede will have to accede to the Protocol (ie to 108 ) as well as to Convention 108, except for a handful of countries previously invited to accede.

There are two options for when Convention 108 will come into force. One involves ratification by all existing 52 parties; the other could see it in force between ratifying parties as early as 2023.

Accession to Convention 108 will have a positive effect on applications for 'adequacy' assessments to the EU under the General Data Protection Regulation (GDPR), but the extent to which 108 compliance will be sufficient for EU adequacy is uncertain.

The article discusses these various complexities.

Keywords: data protection, privacy, European Union, EU, Council of Europe, Convention 108, adequacy, accession