Balancing Globalisation's Benefits and Commitments: Accession to Data Protection Convention 108 by Countries Outside Europe

Abstract

The ‘globalisation’ of Council of Europe data protection Convention 108 beyond its European origins has been underway since the start of this decade, when the first non-European accession (by Uruguay) was assessed and approved. The global nature of this process was demonstrated by the completion of the second non-European accession with Mauritius’ deposit of its instrument of accession in a ceremony at today’s Conference. Four other non-European countries are now at various stages of the accession process, and there is increasing interest from other countries (by both governments and NGOs), exemplified by participants in today’s conference from 16 countries outside the Council of Europe, and from many international organisations.

This presentation first sets the global context of Convention 108’s ‘globalisation: 111 countries now with data privacy laws, and the majority (57/54) from outside Europe. By 2011 the data privacy Acts outside Europe included on average about 7/10 of the higher ‘European standards’, and this has continued in the last five years. The number of potential Convention 108 ‘candidates’ for accession has yet to be assessed, but the potential for greater ‘globalisation’ is clear.

The presentation then sets out 13 benefits that countries outside Europe can obtain from accession to Convention 108: (i) realistic prospects; (ii) no realistic alternative; (iii) voluntary obligations; (iv) international ‘best practice’ recognition; (v) reciprocal data exports; (vi) moderate standards; (vii) minimum standards; (viii) a ‘whitelist’ substitute; (ix) ‘adequacy’ assistance; (x) development assistance; (xi) business benefits with exports and imports; (xii) individual benefits from minimum protections; and (xiii) assistance to international organisations. The significance of these potential benefits, or potential disadvantages, will vary between countries. For each country, they require a balanced assessment of the interests of that country and its government, of businesses operating within it, and of its citizens and residents.

The ‘Convention bodies’ (Consultative Committee (T-PD), Secretariat and Committee of Ministers) have significant responsibilities to help ensure that Parties are only required to export their citizens’ data to other countries which have sufficiently high standards of data protection, and their enforcement. However, the current Convention 108 does not explicitly recognise these responsibilities, and the current practice of the ‘Convention bodies’ does not make it transparent enough that they are being carried out. This should be improved.

Compared with Europeans, citizens of non-European states that accede to the Convention are at a disadvantage in lacking means under international law to enforce the Convention. The UN Special Rapporteur on the Right to Privacy may be able to help make UN instruments relevant to privacy more able to be used for this purpose.

The presentation concludes that the expansion of Convention 108 has implications for every country, and it is good policy for each country to be well-informed and consider carefully the potential benefits of accession.

Note: This is a slightly expanded version of an invited presentation to the Council of Europe Convention 108 ‘Globalisation’ Conference, 17 June 2016, Strasbourg, France.

Keywords: privacy, data protection, Council of Europe, CoE, Convention 108, accession