The document discusses data protection and privacy standards. It summarizes the Council of Europe's Convention 108, which establishes basic principles for the protection of personal data including fair collection, specified purpose limitations, accuracy, and rights of access and remedy. The convention also prohibits processing of sensitive data without safeguards and restricts data flows to countries without adequate protection. It aims to secure privacy rights for all individuals and its principles remain relevant with modernization efforts underway to address new technologies.

1. IV Congresso
Crimes electrônicos - Formes de Proteção
São Paulo – 23 de Agosto de 2012
Privacidade e proteção aos direitos da personalidade
Conselho da Europa - Convenção 108
Sophie Kwasny
Data Protection Unit
Council of Europe

2. Habeas data / data protection / privacy
 Habeas data: ‘that you have the data’ :
right of access, rectification, update,
erasure
 data protection and protection of
invididuals: datenschutz or ‘protection of
individuals’ with regard to the processing of
personal data ?
 Privacy: Article 12 UDHR 1948, Article 17
ICCPR 1966 .. Article 8 ECHR ‘private life’
(name, image, correspondence, physycal
integrity, etc)Convention 108 Sophie Kwasny
Council of Europe

3. Challenges
 cyberspace: an interconnected world
with 2.3 billion users worldwide
 ubiquity of data and profiling
 global online transactions - $10 trillion
annually / $24 trillion by 2020
 data protection as a human right:
ECtHR, EUCJ, constitutional courts
Convention 108 Sophie Kwasny
Council of Europe

4. Protection and Security
Protection of the individuals and data security
 integrity and confidentiality: ‘Appropriate
security measures shall be taken against accidental
or unauthorised destruction or accidental loss as
well as against unauthorised access, alteration or
dissemination (Article 7 Convention 108)
 increasing role of technologies: PETs :
technical and organizational concepts also focusing
on security
Convention 108 Sophie Kwasny
Council of Europe

5. Seen from Europe…
 ‘direitos da personalidade’ : human
personality serving both as the
foundation and aim of human rights
 Early 60ies : rapid progress in the field
of electronic data processing
 70ies : first pieces of legislation and
even fundamental right in some
Constitutions
Convention 108 Sophie Kwasny
Council of Europe

6. Convention 108’s key facts
 28 January 1981 – 31st anniversary
 Drafted with the participation of non-
European countries (Australia,
Canada, Japan and the USA)
 Soon 44 parties
 Uruguay invited to accede, Marocco
asked to be invited, next ?
Convention 108 Sophie Kwasny
Council of Europe

7. Its potential
 universal basic principles
 legally binding force
 simple and technologically-neutral
 cross-cutting scope of application
covering public and private sector
 frame for multilateral cooperation
Convention 108 Sophie Kwasny
Council of Europe

8. Snapshot I
 Object and purpose: to secure in
their territory for every individual,
whatever his nationality or residence,
respect for his rights and fundamental
freedoms, and in particular his right to
privacy, with regard to the processing
of personal data (data protection).
 Definitions: personal data, data
subjects, processing, etc.
Convention 108 Sophie Kwasny
Council of Europe

9. Snapshot II
 Scope: horizontal - public and private
sector.
 Duties of the parties: take
necessary measures in domestic law to
give effect to the basic principles for
data protection set out in the
Convention.
Convention 108 Sophie Kwasny
Council of Europe

10. Snapshot III
 Basic principles:
-fair and lawful collection and processing,
-storage for specified legitimate purposes
and no longer than is necessary
-compatible use
-data: adequate, relevant and not
excessive (proportionality), accurate,
kept up to date, not name-linked for
longer than needed secure
Convention 108 Sophie Kwasny
Council of Europe

11. Snapshot IV
 Basic principles:
-information, right of access and
rectification, right to a remedy.
-outlawed : processing of "sensitive" data
on a person's race, politics, health,
religion, sexual life, criminal record,
etc., in the absence of proper legal
safeguards.
Convention 108 Sophie Kwasny
Council of Europe

12. Snapshot V
 Restrictions on the rights laid down
in the Convention are only possible
when overriding interests (e.g. State
security, defence, etc.) are at stake
 Flow of data: free between Parties
and restrictions on transborder flows
of data to States where legal
regulation does not provide adequate
protection (additional protocol - 2001)
Convention 108 Sophie Kwasny
Council of Europe

13. Snapshot V
 Mutual assistance
 Consultative committee
 Supervisory authorities
Convention 108 Sophie Kwasny
Council of Europe

14. Modernisation – trends I
 promote as a universal standard, with
an open and multistakeholder
approach
 preserve general, simple, flexible and
pragmatic character- while addressing
new ICT challenges
Convention 108 Sophie Kwasny
Council of Europe

15. Modernisation – trends II
 ensure coherence with other relevant
frameworks (EU, OECD, APEC)
 strengthen follow-up mechanism
Convention 108 Sophie Kwasny
Council of Europe

16. Complements and interconnection
 Recommendations
 Declaration on Internet
governance principles
 Cybercrime convention

17. Convention 108 Sophie Kwasny
Council of Europe
Conclusion
Convention 108 –
– robust, while at the same time
flexible, resilient, enduring,
evergreen