Preamble
The member States of the Council of Europe, signatory hereto,
Considering that the aim of the Council of Europe is to achieve greater
unity between its members, based in particular on respect
for the rule of
law, as well as human rights and fundamental freedoms;
Considering that it is desirable to extend the safeguards for everyone's
rights and fundamental freedoms, and in particular
the right to the respect
for privacy, taking account of the increasing flow across frontiers of personal
data undergoing
automatic processing;
Reaffirming at the same time their commitment to freedom of information
regardless of frontiers;
Recognising that it is necessary to reconcile the fundamental values of
the respect for privacy and the free flow of information
between peoples,
Have agreed as follows:
Chapter I – General provisions
Article 1 – Object and purpose
The purpose of this convention is to secure in the territory of each Party for every
individual, whatever his nationality or residence,
respect for his rights and fundamental
freedoms, and in particular his right to privacy, with regard to automatic processing of
personal data relating to him ("data protection").
Article 2 – Definitions
For the purposes of this convention:
- "personal data" means any information relating to an identified or
identifiable individual ("data subject");
- "automated data file" means any set of data undergoing automatic processing;
- "automatic processing" includes the following operations if carried out in
whole or in part by automated means: storage
of data, carrying out of logical and/or
arithmetical operations on those data, their alteration, erasure, retrieval or
dissemination;
- "controller of the file" means the natural or legal person, public authority,
agency or any other body who is competent
according to the national law to decide what
should be the purpose of the automated data file, which categories of personal
data should
be stored and which operations should be applied to them.
Article 3 – Scope
- The Parties undertake to apply this convention to automated personal data files and
automatic processing of personal data in the
public and private sectors.
- Any State may, at the time of signature or when depositing its instrument of
ratification, acceptance, approval or accession,
or at any later time, give notice by a
declaration addressed to the Secretary General of the Council of Europe:
- that it will not apply this convention to certain categories of automated personal data
files, a list of which will be deposited.
In this list it shall not include, however,
categories of automated data files subject under its domestic law to data protection
provisions. Consequently, it shall amend this list by a new declaration whenever
additional categories of automated personal
data files are subjected to data protection
provisions under its domestic law;
- that it will also apply this convention to information relating to groups of persons,
associations, foundations, companies,
corporations and any other bodies consisting
directly or indirectly of individuals, whether or not such bodies possess legal
personality;
- that it will also apply this convention to personal data files which are not processed
automatically.
- Any State which has extended the scope of this convention by any of the declarations
provided for in sub-paragraph 2.b or c above
may give notice in the said declaration that
such extensions shall apply only to certain categories of personal data files, a
list of
which will be deposited.
- Any Party which has excluded certain categories of automated personal data files by a
declaration provided for in sub-paragraph
2.a above may not claim the application of this
convention to such categories by a Party which has not excluded them.
- Likewise, a Party which has not made one or other of the extensions provided for in
sub-paragraphs 2.b and c above may not claim
the application of this convention on these
points with respect to a Party which has made such extensions.
- The declarations provided for in paragraph 2 above shall take effect from the moment of
the entry into force of the convention
with regard to the State which has made them if
they have been made at the time of signature or deposit of its instrument of
ratification,
acceptance, approval or accession, or three months after their receipt by the Secretary
General of the Council
of Europe if they have been made at any later time. These
declarations may be withdrawn, in whole or in part, by a notification
addressed to the
Secretary General of the Council of Europe. Such withdrawals shall take effect three
months after the date
of receipt of such notification.
Chapter II – Basic principles for data protection
Article 4 – Duties of the Parties
- Each Party shall take the necessary measures in its domestic law to give effect to the
basic principles for data protection set
out in this chapter.
- These measures shall be taken at the latest at the time of entry into force of this
convention in respect of that Party.
Article 5 – Quality of data
Personal data undergoing automatic processing shall be:
- obtained and processed fairly and lawfully;
- stored for specified and legitimate purposes and not used in a way incompatible with
those purposes;
- adequate, relevant and not excessive in relation to the purposes for which they are
stored;
- accurate and, where necessary, kept up to date;
- preserved in a form which permits identification of the data subjects for no longer than
is required for the purpose for which
those data are stored.
Article 6 – Special categories of data
Personal data revealing racial origin, political opinions or religious or other
beliefs, as well as personal data concerning health
or sexual life, may not be processed
automatically unless domestic law provides appropriate safeguards. The same shall apply to
personal data relating to criminal convictions.
Article 7 – Data security
Appropriate security measures shall be taken for the protection of personal data stored
in automated data files against accidental
or unauthorised destruction or accidental loss
as well as against unauthorised access, alteration or dissemination.
Article 8 – Additional safeguards for the data subject
Any person shall be enabled:
- to establish the existence of an automated personal data file, its main purposes, as
well as the identity and habitual residence
or principal place of business of the
controller of the file;
- to obtain at reasonable intervals and without excessive delay or expense confirmation of
whether personal data relating to him
are stored in the automated data file as well as
communication to him of such data in an intelligible form;
- to obtain, as the case may be, rectification or erasure of such data if these have been
processed contrary to the provisions
of domestic law giving effect to the basic principles
set out in Articles 5 and 6 of this convention;
- to have a remedy if a request for confirmation or, as the case may be, communication,
rectification or erasure as referred to
in paragraphs b and c of this article is not
complied with.
Article 9 – Exceptions and restrictions
- No exception to the provisions of Articles 5, 6 and 8 of this convention shall be
allowed except within the limits defined in
this article.
- Derogation from the provisions of Articles 5, 6 and 8 of this convention shall be
allowed when such derogation is provided for
by the law of the Party and constitutes a
necessary measure in a democratic society in the interests of:
- protecting State security, public safety, the monetary interests of the State or the
suppression of criminal offences;
- protecting the data subject or the rights and freedoms of others.
- Restrictions on the exercise of the rights specified in Article 8, paragraphs b, c and
d, may be provided by law with respect
to automated personal data files used for
statistics or for scientific research purposes when there is obviously no risk of an
infringement of the privacy of the data subjects.
Article 10 – Sanctions and remedies
Each Party undertakes to establish appropriate sanctions and remedies for violations of
provisions of domestic law giving effect
to the basic principles for data protection set
out in this chapter.
Article 11 – Extended protection
None of the provisions of this chapter shall be interpreted as limiting or otherwise
affecting the possibility for a Party to grant
data subjects a wider measure of protection
than that stipulated in this convention.
Chapter III – Transborder data flows
Chapter IV – Mutual assistance
Article 13 – Co-operation between Parties
- The Parties agree to render each other mutual assistance in order to implement this
convention.
- For that purpose:
- each Party shall designate one or more authorities, the name and address of each of
which it shall communicate to the Secretary
General of the Council of Europe;
- each Party which has designated more than one authority shall specify in its
communication referred to in the previous sub-paragraph
the competence of each authority.
- An authority designated by a Party shall at the request of an authority designated by
another Party:
- furnish information on its law and administrative practice in the field of data
protection;
- take, in conformity with its domestic law and for the sole purpose of protection of
privacy, all appropriate measures for furnishing
factual information relating to specific
automatic processing carried out in its territory, with the exception however of the
personal data being processed.
Article 14 – Assistance to data subjects resident abroad
- Each Party shall assist any person resident abroad to exercise the rights conferred by
its domestic law giving effect to the principles
set out in Article 8 of this convention.
- When such a person resides in the territory of another Party he shall be given the
option of submitting his request through the
intermediary of the authority designated by
that Party.
- The request for assistance shall contain all the necessary particulars, relating inter
alia to:
- the name, address and any other relevant particulars identifying the person making the
request;
- the automated personal data file to which the request pertains, or its controller;
- the purpose of the request.
Article 15 – Safeguards concerning assistance rendered by
designated authorities
- An authority designated by a Party which has received information from an authority
designated by another Party either accompanying
a request for assistance or in reply to
its own request for assistance shall not use that information for purposes other than
those specified in the request for assistance.
- Each Party shall see to it that the persons belonging to or acting on behalf of the
designated authority shall be bound by appropriate
obligations of secrecy or
confidentiality with regard to that information.
- In no case may a designated authority be allowed to make under Article 14, paragraph 2,
a request for assistance on behalf of
a data subject resident abroad, of its own accord
and without the express consent of the person concerned.
Article 16 – Refusal of requests for assistance
A designated authority to which a request for assistance is addressed under Articles 13
or 14 of this convention may not refuse
to comply with it unless:
- the request is not compatible with the powers in the field of data protection of the
authorities responsible for replying;
- the request does not comply with the provisions of this convention;
- compliance with the request would be incompatible with the sovereignty, security or
public policy (ordre public) of the Party
by which it was designated, or with the rights
and fundamental freedoms of persons under the jurisdiction of that Party.
Article 17 – Costs and procedures of assistance
- Mutual assistance which the Parties render each other under Article 13 and assistance
they render to data subjects abroad under
Article 14 shall not give rise to the payment of
any costs or fees other than those incurred for experts and interpreters. The
latter costs
or fees shall be borne by the Party which has designated the authority making the request
for assistance.
- The data subject may not be charged costs or fees in connection with the steps taken on
his behalf in the territory of another
Party other than those lawfully payable by
residents of that Party.
- Other details concerning the assistance relating in particular to the forms and
procedures and the languages to be used, shall
be established directly between the Parties
concerned.
Chapter V – Consultative Committee
Article 18 – Composition of the committee
- A Consultative Committee shall be set up after the entry into force of this convention.
- Each Party shall appoint a representative to the committee and a deputy representative.
Any member State of the Council of Europe
which is not a Party to the convention shall
have the right to be represented on the committee by an observer.
- The Consultative Committee may, by unanimous decision, invite any non-member State of
the Council of Europe which is not a Party
to the convention to be represented by an
observer at a given meeting.
Article 19 – Functions of the committee
The Consultative Committee:
- may make proposals with a view to facilitating or improving the application of the
convention;
- may make proposals for amendment of this convention in accordance with Article 21;
- shall formulate its opinion on any proposal for amendment of this convention which is
referred to it in accordance with Article
21, paragraph 3;
- may, at the request of a Party, express an opinion on any question concerning the
application of this convention.
Article 20 – Procedure
- The Consultative Committee shall be convened by the Secretary General of the Council of
Europe. Its first meeting shall be held
within twelve months of the entry into force of
this convention. It shall subsequently meet at least once every two years and
in any case
when one-third of the representatives of the Parties request its convocation.
- A majority of representatives of the Parties shall constitute a quorum for a meeting of
the Consultative Committee.
- After each of its meetings, the Consultative Committee shall submit to the Committee of
Ministers of the Council of Europe a report
on its work and on the functioning of the
convention.
- Subject to the provisions of this convention, the Consultative Committee shall draw up
its own Rules of Procedure.
Chapter VI – Amendments
Article 21 – Amendments
- Amendments to this convention may be proposed by a Party, the Committee of Ministers of
the Council of Europe or the Consultative
Committee.
- Any proposal for amendment shall be communicated by the Secretary General of the Council
of Europe to the member States of the
Council of Europe and to every non-member State
which has acceded to or has been invited to accede to this convention in accordance
with
the provisions of Article 23.
- Moreover, any amendment proposed by a Party or the Committee of Ministers shall be
communicated to the Consultative Committee,
which shall submit to the Committee of
Ministers its opinion on that proposed amendment.
- The Committee of Ministers shall consider the proposed amendment and any opinion
submitted by the Consultative Committee and may
approve the amendment.
- The text of any amendment approved by the Committee of Ministers in accordance with
paragraph 4 of this article shall be forwarded
to the Parties for acceptance.
- Any amendment approved in accordance with paragraph 4 of this article shall come into
force on the thirtieth day after all Parties
have informed the Secretary General of their
acceptance thereof.
Chapter VII – Final clauses
Article 22 – Entry into force
- This convention shall be open for signature by the member States of the Council of
Europe. It is subject to ratification, acceptance
or approval. Instruments of
ratification, acceptance or approval shall be deposited with the Secretary General of the
Council
of Europe.
- This convention shall enter into force on the first day of the month following the
expiration of a period of three months after
the date on which five member States of the
Council of Europe have expressed their consent to be bound by the convention in accordance
with the provisions of the preceding paragraph.
- In respect of any member State which subsequently expresses its consent to be bound by
it, the convention shall enter into force
on the first day of the month following the
expiration of a period of three months after the date of deposit of the instrument
of
ratification, acceptance or approval.
Article 23 – Accession by non-member States
- After the entry into force of this convention, the Committee of Ministers of the Council
of Europe may invite any State not a
member of the Council of Europe to accede to this
convention by a decision taken by the majority provided for in Article 20.d
of the Statute
of the Council of Europe and by the unanimous vote of the representatives of the
Contracting States entitled
to sit on the committee.
- In respect of any acceding State, the convention shall enter into force on the first day
of the month following the expiration
of a period of three months after the date of
deposit of the instrument of accession with the Secretary General of the Council
of
Europe.
Article 24 – Territorial clause
- Any State may at the time of signature or when depositing its instrument of
ratification, acceptance, approval or accession, specify
the territory or territories to
which this convention shall apply.
- Any State may at any later date, by a declaration addressed to the Secretary General of
the Council of Europe, extend the application
of this convention to any other territory
specified in the declaration. In respect of such territory the convention shall enter
into
force on the first day of the month following the expiration of a period of three months
after the date of receipt of
such declaration by the Secretary General.
- Any declaration made under the two preceding paragraphs may, in respect of any territory
specified in such declaration, be withdrawn
by a notification addressed to the Secretary
General. The withdrawal shall become effective on the first day of the month following
the
expiration of a period of six months after the date of receipt of such notification by the
Secretary General.
Article 25 – Reservations
No reservation may be made in respect of the provisions of this convention.
Article 26 – Denunciation
- Any Party may at any time denounce this convention by means of a notification addressed
to the Secretary General of the Council
of Europe.
- Such denunciation shall become effective on the first day of the month following the
expiration of a period of six months after
the date of receipt of the notification by the
Secretary General.
Article 27 – Notifications
The Secretary General of the Council of Europe shall notify the member States of the
Council and any State which has acceded to
this convention of:
- any signature;
- the deposit of any instrument of ratification, acceptance, approval or accession;
- any date of entry into force of this convention in accordance with Articles 22, 23 and
24;
- any other act, notification or communication relating to this convention.
In witness whereof the undersigned, being duly authorised thereto, have signed this
Convention.
Done at Strasbourg, the 28th day of January 1981, in English and in French, both texts
being equally authoritative, in a single
copy which shall remain deposited in the archives
of the Council of Europe. The Secretary General of the Council of Europe shall
transmit
certified copies to each member State of the Council of Europe and to any State invited to
accede to this Convention.
