|
|
Doc. 8660
10 March 2000
Draft additional Protocol to Convention ETS 108 on Supervisory Authorities and Transborder Data Flows
Report1
Committee on Legal Affairs and Human Rights
Rapporteur: Mr Jaume Bartumeu Cassany, Andorra, Socialist Group
Summary
The report recognises the significance of the draft additional Protocol to Convention ETS 108, which is designed to supplement the principles embodied in the Convention by introducing two new substantive provisions, one on the establishment of supervisory authorities and the other on transborder flows of personal data.
It aims to support and strengthen the Council of Europe bodies already responsible for these questions by enabling them to call on expert assistance and to devise projects with the private sector.
More specifically, the report argues that the draft protocol should address the question of monitoring the provisions of the Convention and protocol through existing Council of Europe machinery.
It also concludes that the supervisory authorities should have more powers than those set out in the draft protocol, that they should be independent public authorities as defined in the case law of the European Court of Human Rights, and that they should co-operate in an international forum having a recognised status, namely the Consultative Committee set up under the Convention.
I. Draft opinion
1. The Assembly believes that the protection of personal data and privacy is of prime importance in this era of the Internet and the information society.
2. The Assembly supports the draft additional protocol to the Convention for the protection of individuals with regard to automatic processing of personal data, aimed at adapting the Convention in view of the new developments in this field, while continuing to meet the requirements of individual freedom.
3. It considers that in requiring the parties to set up supervisory bodies, if they have not already done so, this text rightly reflects the Council of Europe’s various sector-based recommendations and the positions of the European Union in this field, and in particular Directive 95/46/EC of the European Parliament and of the Council of the European Union.
4. The Assembly is nevertheless of the opinion that the powers of the supervisory authorities should be broader, especially given the new forms of information technology and the growing volume of personal data being transferred. In particular, they should be given regulatory powers in order to lay down simplified rules so that the more customary types of data processing which pose a lesser threat to fundamental freedoms can be subject to less stringent formalities. They could also be invited to submit opinions on all draft legislation and regulations in this field.
5. The Assembly also believes that the supervisory authorities, the nature of which is not specified in the draft protocol, should be independent authorities, as defined in the case law of the organs of the European Convention on Human Rights, bearing in mind the pressure that may be exerted on them from, for example, public authorities.
6. Lastly, the Assembly believes that the scope of international co-operation between supervisory authorities should be broader and that supervisory authorities should meet together in an appropriate forum under the auspices of the Convention - namely the Consultative Committee of Convention No 108 - in order to pool experience, formulate opinions and partake in joint discussions.
7. The Assembly recommends that the draft protocol provide for the Consultative Committee to assist the parties, particularly those states that have ratified the Convention most recently2, in complying with its basic principles and monitoring their application more rigorously.
8. In a field so specific and specialised as this, the Council of Europe’s existing machinery ought to be strengthened and it ought to be able to call on independent experts and specialists in new information technologies. The Council of Europe bodies should also be able to carry out or support projects in partnership with the private sector.
9. Accordingly, the Assembly recommends that the Committee of Ministers make the following amendments to the draft protocol:
i. in Article 1, paragraph 2, after the word “intervention” add “as well as the power to deliver opinions on all draft legislation or regulations in this field, the power to lay down simplified rules so that the more customary types of data processing which pose a lesser threat to fundamental freedoms can be subject to less stringent formalities";
ii. Article 1, paragraph 3, should be worded as follows: “The supervisory authorities shall be independent public authorities.”;
iii. Article 1, paragraph 5, should be worded as follows: “In accordance with the provisions of Chapter IV and without prejudice to the provisions of Article 13 of the Convention, the supervisory authorities shall co-operate with one another in an appropriate framework within the Consultative Committee set up under the Convention, to the extent necessary to carry out their tasks, in particular by exchanging all relevant information”;
iv. a new article should be included in the draft protocol, worded as follows: “The Consultative Committee shall help the parties to comply with the basic principles of the Convention and this Protocol and to monitor their application more rigorously.”
10. The Assembly also recommends that the Committee of Ministers invite those states that have not yet done so:
i. to sign and ratify the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, and the additional protocol, without delay;
ii. to pass legislation on the protection of personal data, applying the principles enshrined in the Convention.
11. The Assembly further recommends that the Committee of Ministers invite the European Union to accede to the Convention in the interests of a more consistent European constitutional approach to data protection.
12. Finally, the Assembly recommends that the Committee of Ministers help those states not yet parties to the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data to introduce appropriate laws and regulations in this field.
II. Explanatory memorandum by Mr Bartumeu Cassany, Rapporteur
A. Introduction
1. The Assembly was asked on 20 September 1999 by the Committee of Ministers to provide an opinion on the draft additional protocol to Convention ETS 108, drawn up by the Consultative Committee of the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (T-PD).
2. The Consultative Committee decided on its own initiative to improve the Convention on two points not covered by the Convention or mentioned only indirectly, namely supervisory authorities (to which the Convention makes an indirect reference in Article 10 under “appropriate … remedies” and transborder flows of personal data to a recipient which is not subject to the jurisdiction of a party to the Convention (there is only an indirect reference to transborder data flows to third countries in Article 12.3.b of the Convention).
B. The substance of the protocol
3. The draft protocol therefore supplements the Convention. It contains a fairly general preamble and three articles (there is no need to deal with Article 3 given that it is devoted to the final provisions). It sets out to adapt legislation while continuing to meet the requirements of protecting individual freedom.
4. The draft protocol follows on from a directive of the European Parliament and of the Council of 24 October 1995, on which it draws to a significant extent,3 which entered into force on 25 October 1998.
5. The preamble reaffirms the importance of the right to information and the right to privacy, and states that supervisory authorities, virtually ignored by the Convention, shall be set up.
6. Article 1 is based on Article 28 of the European directive and relates to national supervisory authorities responsible for ensuring compliance with laws or regulations adopted in pursuance of the provisions of (i) the Convention with regard to fundamental data protection principles (cf Chapter II, Articles 4-11 of the Convention) and transborder data flows (cf Chapter III, Article 12 of the Convention) and (ii) the Protocol. It is unfortunate that the draft protocol says nothing about the status of supervisory authorities. Whereas the European directive at least states in Article 28 that these authorities shall be “public”, the draft protocol is very vague about their nature, leaving the door wide open to a host of interpretations. These supervisory authorities (the same term as in the 1995 European directive) are to have powers of investigation and intervention, the power to engage in legal proceedings and bring to the attention of the competent judicial authorities violations of laws and regulations adopted in pursuance of the aforementioned articles of the Convention. The supervisory authorities may hear claims lodged by individuals concerning the protection of their rights with regard to data processing. They shall exercise their functions in complete independence. Their decisions may be appealed against through the courts. They are to co-operate with one another, in particular by exchanging information.
7. Article 2 draws on Articles 25 and 26 of the European directive and covers transborder data flows to third countries. Transfers may be made only if the recipient state or international organisation can ensure an adequate level of protection. By way of derogation, a state party may authorise the transfer of data in two cases: (i) if domestic law provides for it because of specific interests of the data subject or if there are legitimate prevailing interests, or (ii) if safeguards, which can result from contractual clauses, are provided by the person responsible for the transfer. In this way it makes a distinction between countries providing an adequate level of protection (paragraph 1) and those which do not provide for such a level of protection (paragraph 2).
C. Proposals by the rapporteur
8. The rapporteur believes that the proposed text, intentionally based on the 1995 European directive, should be supported. In negotiations between Europe and the United States, it is essential to support the standpoint of the European Union and of the Council of Europe, which are in the best position to defend an approach geared more to respect of privacy in relation to the free movement of data, to the new forms of information technology and to electronic commerce.
9. The United States are attempting to impose a more liberal vision of transborder flows of personal data, while the approach in Europe, in essence that of the Council of Europe and the European Union, is based more on respect for human rights and fundamental freedoms. The protection of personal data and privacy is of prime importance in this era of the Internet and the information society.
10. In order to afford guarantees to transborder flows of personal data between European Union member states and the United States, the US proposed to the EU in the current negotiations, to reply to European expectations by adopting the security principles drawn up by the American Ministry of Commerce (the “Safe Harbour” principles), which are reflected in paragraph 2.b of Article 2 in the words “in particular”. American firms which commit themselves to respecting the said principles will be able to freely receive personal data. There is, however, some room for doubt as to whether US law provides the adequate level of protection required of third countries to which data may be transferred from Europe. Accordingly, this article should be left in place.
11. The Rapporteur notes that the contractual clauses might still continue to be used, in particular in countries which do not implement the Safe Harbour principles. The rights guaranteed in the Convention and the draft Protocol must be effectively guaranteed by means of an effective appeal procedure; one might recall in this respect the case-law of the European Court of Human Rights, and in particular the recent admissibility decision of 14 October 1999 in the case of Kenneth Lehtinen v. Finland.
12. Nevertheless, it is necessary to supplement a number of provisions in the Protocol, beginning with paragraph 2 of Article 1. This lists the powers of supervisory authorities which, while they are identical to those contained in the directive, may be considered as the minimum. Supervisory authorities should also have regulatory powers in order to draw up model rules concerning the more customary types of data processing which pose no threat to privacy or fundamental freedoms. They should also have the power to amend draft texts or to verify their application in situ.
13. In paragraph 3 of Article 1, it is not enough to state that supervisory authorities shall exercise their authority in complete independence; it is imperative that these authorities be independent administrative authorities, as defined in the case-law of the organs of the European Convention on Human Rights (see Judgment of 7 July 1989 in the case of Gaskin v. United Kingdom, judgment in the case of M.S. v. Sweden and judgement of 1997 in the case of Z. v. Finland). This independence must be ensured through guarantees enshrined in the law. The supervisory authorities must also be independent and have at their disposal the adequate human and financial resources which they need in order to function correctly.
14. In paragraph 5 of Article 1, the scope of international co-operation between national authorities should be broadened. Here again, it is not the minimalist approach which should prevail. Rather, supervisory authorities must jointly seek solutions. Along the lines of the Working Party on the Protection of Individuals with regard to the Processing of Personal Data set up by Article 29 of the European directive (the “Article 29 Working Party”), the supervisory authorities should meet together in a single international body, for example in the Council of Europe’s Consultative Committee, to exchange experiences and initiate discussions. All these authorities should reflect together in such a body on how the Convention should be applied to the Internet.
Reporting committee: Committee on Legal Affairs and Human Rights.
Budgetary implications for the Assembly: none.
Reference to committee: Doc 8526 and Reference No. 2437 of 20 September 1999.
Draft opinion adopted unanimously by the committee on 6 March 2000.
Members of the committee: MM Jansson (Chairperson), Bindig, Frunda, Mrs Err (Vice-Chairpersons), Mrs Aguiar, MM Akçali, Arzilli, Attard Montalto, Bal, Bartumeu Cassany, Bruce, Bulic, Clerfayt, Contestabile, Demetriou, Derycke, Enright, Mrs Frimansdóttir, MM Fyodorov, Holovaty, Mrs Imbrasiene, MM Jaskiernia, Jurgens, Kelemen, Lord Kirkhill, Mr Kresak, Mrs Krzyzanowska, Mr Le Guen, Mrs Libane (alternate: Mr Cilevics), MM Lintner, Lippelt, Loutfi, Magnusson, Mrs Markovic-Dimova, MM Marty, McNamara, Mertel, Moeller, Mozetic, Mrs Näslund, Mr Nastase, Mrs Ninoshvili, MM Pavlov, Pollo, Polydoras, Mrs Pourtaud, MM Robles Fraga, Rodeghiero (alternate: Provera), Mrs Roudy (alternate: Mr Michel), MM Serafini (alternate: Lauricella), Shishlov, Simonsen, Solonari, Spindelegger, Svoboda, Symonenko, Tabajdi, Tallo, Vera Jardim (alternate: Lacão), Verhagen (alternate: Dees), Verivakis, Mrs Vermot-Mangold (alternate: Mrs Nabholz-Haidegger), Vyvadil, Mrs Wohlwend, MM. Yanez Barnuevo (alternate: Mrs Calleja), Zhirinovsky (alternate: Kovalev).
N.B. The names of those members present at the meeting are printed in italics.
Secretaries to the committee: Mr Plate, Ms Coin and Ms Kleinsorge.
2 The states which had ratified the Convention on 11 February 2000 were the member states of the European Union, as well as Hungary, Iceland, Norway, Slovenia and Switzerland.
3 Directive 95/46/EC of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data, cf Official Journal L 281 of 23/11/95, pp. 0031-0050.