CM(2009)189 15 December 20091
1076 Meeting, 3 February 2010
10 Legal questions
10.3 Consultative Committee of the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (ETS No. 108) (T-PD) –
Abridged report of the 25th meeting (Strasbourg, 2-4 September 2009)
Item to be prepared by the GR-J on 14 January 2010
1. The Consultative Committee of the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (T-PD), established under Article 18 of the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data [ETS No. 108] (hereafter Convention 108), held its 25th meeting in Strasbourg on 2-4 September 2009. The agenda, as adopted by the T-PD, is set out in Appendix I. The list of participants can be obtained from the Directorate General of Human Rights and Legal Affairs.
II. POINTS SUBMITTED TO THE COMMITTEE OF MINISTERS FOR DECISION
2. The T-PD identified priorities and approved its future work programme (Appendix II) which it decided to bring to the attention of the Committee of Ministers. In the light of the development of new concepts and techniques for processing personal data, the T-PD proposes to prepare in 2010 an initial draft of an additional protocol and draft recommendations which will embrace new challenges faced by personal data and privacy protection and seeks the support of the Committee of Ministers to initiate this work.
3. From 3 to 6 November 2009, the Secretariat of the T-PD attended the International Conference of Data Protection and Privacy Commissioners (annual conference gathering more than 70 accredited data protection authorities over the world) to which the Council of Europe is observer. Each year, the Conference adopts a number of resolutions. This year, one of the adopted resolutions welcomed the Joint Proposal for a Draft of International Standards on the Protection of Privacy with Regard to the Processing of Personal Data (hereinafter “Draft International Standards”), a document prepared by several data protection authorities and setting principles, rights, obligations and procedures that any legal system of data protection and privacy should strive to meet. This initiative reflected the need for reinforcement of the global nature of the right to privacy and personal data protection in today’s world of borderless telecommunication networks.
The T-PD adopted the Statement on International Standards (Appendix III) recalling that the Draft International Standards took Convention 108 and its Additional Protocol as one of their sources and that Convention 108 and its Protocol remain for the time being the only legally binding international standards which have the potential to be applied worldwide. The T-PD also asked for the continued support of the International Conference of Data Protection and Privacy Commissioners in implementing the Council of Europe’s Committee of Ministers’ decision, adopted on 2 July 2008, encouraging accession to Convention 108 of non member states with the required data protection legislation.
The need for internationally applicable standards in the field of personal data and privacy protection was also reflected in the Stockholm Programme adopted by the Council of the European Union. The programme calls for the promotion of the application of the principle set out in EU instruments on data protection and the 1981 Council of Europe Convention on data protection.
The T-PD invites the Committee of Ministers to take note of the Statement on International Standards (Appendix III) and informs the Committee of Ministers that it will continue to explore further possibilities for promotion of Convention 108.
4. In 2009, the T-PD was also contacted by the International Conference of Data Protection and Privacy Commissioners to identify a day or a week other than the 28 January on which privacy and data protection are celebrated and promoted each year globally. The T-PD reiterated its position that the Data Protection Day should be on 28 January as proposed by the T-PD during its 22nd Plenary session in 2006 and as agreed by the Committee of Ministers of the Council of Europe (CM/Del/Dec(2006)962/10.1). It is understood that activities could be organised in the week close to this date therefore preserving a certain amount of flexibility. In addition, this does not prevent states from organising data protection awareness raising activities on other dates.
III. POINTS SUBMITTED TO THE COMMITTEE OF MINISTERS FOR INFORMATION
5. The T-PD:
a. elected Mr Kevin Fraser (United Kingdom), Ms Alessandra Pierucci (Italy) and Mr George Grigore (Romania) as members of the Bureau, to fulfil the terms of office until 2010;
b. took note of the presentation by the European Privacy Association regarding its submission of a request for observer status with the T-PD;
c. took note of the presentation on the work of the Group of Specialists on productivity, genetic testing and insurance of the Steering Committee on Bioethics (CDBI) and instructed the Secretariat to begin a procedure to identify which T-PD member could take part in the work as an observer;
d. took note of the presentation of the Ad hoc Committee for the World anti-Doping Agency (CAHAMA) and entrusted Mr José Leandro Núñez García (Spain) with the task of representing the T-PD during the forthcoming meeting of the above-mentioned Committee in Madrid (14 september 2009);
e. held an exchange of information on recent national developments in the field of data protection;
f. approved the text of the draft Recommendation on the protection of individuals with regard to automatic processing of personal data in the framework of profiling, as resulting from the 25th plenary meeting and decided to submit it in its final version to vote at the 2010 plenary session;
g. took note of the date of the next plenary meeting from 13 to 15 April 2010.
1. Opening of the meeting
2. Adoption of the agenda
3. Statement by the Secretariat
4. Election of three Bureau members
6. T-PD’s Future Activities
7. Discussion of the Joint Proposal for a Draft of International Standards on the Protection of Privacy with regard to the processing of Personal Data
8. Presentation by:
The Ad hoc European Committee for the World Anti-Doping Agency (CAHAMA) on the “WADA International Standard for the Protection of Privacy and Personal Information” and on the participation of the T-PD in the Cahama Working Party on anti-doping and data protection issues
CM - 1018th meeting
20 February 2008
Appendix 14 (Item 8.2)
Terms of reference of the Ad hoc European Committee for the World Anti-Doping Agency (CAHAMA)
T-PD-BUR (2008) 04 fin
Draft Opinion of the T-PD on the Compatibility of the World Anti Doping Agency’s International Standard for the Protection of Privacy and Personal Information with the Council of Europe Data Protection Standards
The Group of specialists on predictivity, genetic testing and insurance of the Council of Europe’s Steering Committee on Bioethics
Terms of reference of the Group of Specialists on Human Genetics (CDBI-CO-GT4)
Explanatory note concerning the work of the Group of specialists on predictivity, genetic testing and insurance
The European Privacy Association
Document presenting the European Privacy Association
9. Data Information on the 2009 Data Protection Day and on major developments in the data protection field since the 24th meeting of the T-PD (13-14 march 2008)
10. Date of the 26th plenary meeting of the T-PD in 2010
WORK PROGRAMME FOR THE T-PD FOR 2009 AND BEYOND
As approved by the T-PD at the 25th plenary meeting
(2-4 September 2009, Strasbourg)
1. Amendments to the Convention 1082
Following the example of the Additional Protocol (ETS No. 181), several amendments concerning the different topics could be treated simultaneously. In this context the priorities should be indetified among the topics proposed in this chapter.
1.1 Convention 108 and technological developments
Objective: to evaluate the need for additional regulatory provisions that are necessary to meet the challenges to data protection posed by technological developments (Internet etc.)
1.2 Automated individual decisions
Objective: to add provision regarding the automated individual decisions
1.3 Information that needs to be provided to the data subject by the controller
Objective: to add provision defining the information which shall be provided by the controller to the data subject on the processing of his/her personal data
1.4 Monitoring the implementation of the Convention by 108 Contracting States
Objective: to invest the Consultative Committee with the power of monitoring the implementation of Convention 108 and its Additional Protocol by member states and, eventually, to evaluate the level of protection of personal data of the state candidates for accession to Convention 108 and its Additional Protocol
Working methods: the T-PD will consider the setting-up of several working groups in charge of selected issues. These working groups, coordinated by a rapporteur (a member of the T-PD), will be composed of members of the T-PD and other representatives of the Contracting Parties, observer organisations and states. The groups must be large enough to provide the necessary expertise but not that large to hinder the effectiveness of work. Participation of experts may be considered provided that sufficient funding is available. The groups will work via email. The draft amendments will be discussed at the Bureau meetings in presence of the rapporteurs of the groups concerned. The Secretariat will prepare the document which will incorporate the proposed amendments and provide the preliminary draft of the Additional Protocol.
Partner (s): CRID, CoE experts
Calendar: The first draft of the Additional Protocol could be prepared for the plenary meeting in 2012.
Rank of priorities: Top
2. Revision of "old" and drafting of "new" Recommendations3
2.1 Recommendation No. R (87) 15 regulating the use of personal data in the police sector
Objective: the development of new concepts and techniques for processing of personal data necessary for the purpose of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties calls for the revision of the Recommendation (87) 15 or for the drafting of a new legally binding instrument.
Working methods: the T-PD will initiate a study of Recommendation (87) 15 to determine the principles to be developed in order to cover adequately the emerging issues of data protection in the field of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. The possibility of submitting a questionnaire on domestic legislation and practice to the Contracting States may be considered. On the basis of information received, the working group established within the T-PD will be responsible for the preparation of the preliminary draft, subject to further discussion at the Bureau and plenary meetings. After evaluation, if the T-PD deems this necessary, the regulation of the use of personal data on the police sector could be a subject of a legally binding instrument.
Partner (s): CoE experts, European Date Protection Authorities
Calendar: 2 years, the first draft can be submitted at the plenary in 2012
Rank of priorities: Top
2.2 Recommendation No. R (89) 2 on the protection of personal data used for employment purposes
Objective: to update Recommendation (89) 2 in light of technological developments as well as of other texts of the Council of Europe containing provisions on the processing of data in the employment field.
Working methods: the T-PD will initiate a study of Recommendation (89) 2 to determine the principles to be developed in order to cover adequately the emerging issues of data protection in the employment field. The possibility of submitting a questionnaire on domestic legislation and practice to the Contracting Parties may be considered. On the basis of information received, the working group established within the T-PD will be responsible for the preparation of the preliminary draft, subject to further discussion at the Bureau and plenary meetings.
Partner (s): CoE experts, the Secretariat of the European Social Charter
Calendar: 2 years, the first draft can be submitted at the plenary in 2014
Rank of priorities: Top
3. Other work
3.1 Status and powers of data protection supervisory authorities
Objective: to draft an explanatory document setting out a "model" of the supervisory authority as foreseen by the Additional Protocol.
Working methods: firstly, the Bureau and the T-PD will develop a questionnaire dealing with the organisation and competences of supervisory authorities and distribute it to the Contracting Parties. The Bureau will then prepare a compilation document outlining a “model” to accompany the implementation of the Additional Protocol.
Calendar: activity to be pursued after the judgment of the Court of Justice of the European Communities (ECJ) in case C-518/07.
3.2 Online social networking
Objective: to prepare a study taking into account existing instruments aiming at strengthening the rights of users in the context of the expanding phenomenon of online social networking
Working methods: the T-PD, in collaboration with representatives of the CDCJ as well as the Steering Committee on the Media and New Communication Services (CDMC), will explore the ideas concerning the working methods and the funding of the work on the draft recommendation.
Partner (s): CDMC, CoE experts
Rank of priorities: Secondary
3.3 Fundamental right to data protection
Objective: to carry out a study in order to assess the need and added value of a fundamental right to data protection, distinct of Article 8 of the ECHR
Partner (s): Steering committee for human rights (CDDH)
Calendar: activity to be pursued after the Lisbon Treaty enters into force
3.4 Opinions on the compatibility with the Council’s of Europe data protection instruments
Objective: the constant follow-up of developments within and outside the Council of Europe with data protection instruments of the Council of Europe.
Working methods: the Secretariat of the T-PD will be responsible for constantly updating the documents "Council of Europe achievements in the field of data protection” and "The case-law of the European Court of Human Rights concerning the protection of personal data"
Partner (s): Secretariat of the T-PD
Rank of priorities: constant issue
3.5 Preparation of the celebration of the 30th anniversary of signature of the Convention 108
Objective: gather proposals with the view to organising the trans-border celebration of the 30th anniversary of signature of the Convention 108
Working methods: The Bureau will prepare a questionnaire to be submitted to member states. The compilation of proposals, prepared by the Secretariat, will be discussed during the plenary meeting with the view to adopting of the common plan of action.
Partner (s): Secretariat of the T-PD
Calendar: Questionnaire to be approved during the Bureau meeting on 19-20 November 2009/ the common plan of action to be discussed during the 2010 plenary meeting.
Rank of priorities: constant issue
* * *
STATEMENT ON THE JOINT PROPOSAL FOR A DRAFT OF INTERNATIONAL STANDARDS ON THE PROTECTION OF PRIVACY WITH REGARD TO THE PROCESSING OF PERSONAL DATA
As adopted by the T-PD at the 25th plenary meeting
As the forum for policy-making and standard-setting under the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (hereafter Convention 108), the Consultative Committee of the Convention 108 (T-PD) would like to formulate the following observations on the “Joint proposal for a draft of international standards on the protection of Privacy with regard to the processing of personal data” (hereafter “draft international standards”).
The draft international standards were prepared by a working group coordinated by Spanish Data Protection Authority for the International Conference of Data Protection and Privacy Commissioners, following Montreux Declaration (2005) and Strasbourg Resolution (2008).
At its 25th meeting, held from 2 to 4 September 2009 in Strasbourg, the T-PD examined the draft international standards discussed at the meeting of the working group held on 11 June in Bilbao.
It is expected that the International Conference of Data Protection and Privacy Commissioners ascertains the draft international standards at their forthcoming conference in Madrid (4-6 November 2009).
General comments on the relationship between the international standards and Convention 108
The declared purpose of the draft international standards is to define a set of principles and rights guaranteeing the effective protection of privacy with regard to the processing of personal data with a view to facilitating international flows of personal data.
The T-PD welcomes this attempt to provide an up-to-date statement of the applicable principles. Such an endeavour is particularly important and timely in an increasingly globalised world characterised by rapid technological development which transforms the communication between individuals and public and private organisations.
The T-PD notes that the draft international standards took Convention 108 and its Additional Protocol as one of their sources. This is only consequent, taking into account that Convention 108 and its Protocol remain for the time being the only legally binding international standard which has the potential to be applied worldwide. Being drafted in a simple and technologically-neutral way, the fundamental standards contained in Convention 108 remain valid. Its strengths are its legally binding force and its cross-cutting scope of application. Convention 108 protects against privacy intrusions by public and private authorities, regardless the ways of automatic processing.
The Council of Europe’s Committee of Ministers adopted on 2 July 2008 a decision encouraging the accession of non member states with the required data protection legislation. This decision followed similar calls from European and International privacy and data protection authorities, in particular, the call launched by the Commissioners in the Montreux Declaration. The T-PD counts on continued support by the International Conference of Data Protection and Privacy Commissioners in that important endeavor as well as on its active involvement in the T-PD activities as an observer.
The draft international standards are a set of principles, which provide guidelines for national legislation. They may in particular be used to assess the compatibility of national legal frameworks for the purpose of ensuring the free flow of personal data.
The draft international standards may help to interpret some of the provisions of Convention 108 in the light of modern technological developments or even to develop them through the adoption of new legal instruments, such as Committee of Ministers’ recommendations, guidelines or even Additional Protocols to Convention 108.
It could lead to a new impetus contributing to the strengthening of data protection worldwide. The adoption of an up-to-date set of principles on data protection and privacy could thereby contribute to the worldwide promotion of Convention 108 and its additional Protocol. In this way, the much called-for harmonisation and a reinforcement of the global nature of the right to privacy and personal data protection would be ensured.
1 This document has been classified restricted until examination by the Committee of Ministers.
2 Activities carried out according to Article 21 of Convention 108.
3 To carry out the activities mentioned in this chapter, a prior mandate shall be received from the CDCJ.