1. Each Party shall provide for one or more authorities to be responsible for ensuring compliance with the provisions of this Convention.
2. To this end, such authorities:
a) shall have powers of investigation and intervention;
b) shall perform the functions relating to transfers of data provided for under Article 14, notably the approval of standardised safeguards;
c) shall have powers to issue decisions with respect to violations of the provisions of this Convention and may, in particular, impose administrative sanctions;
d) shall have the power to engage in legal proceedings or to bring to the attention of the competent judicial authorities violations of the provisions of this Convention;
e) shall promote:
i) public awareness of their functions and powers, as well as their activities;
ii) public awareness of the rights of data subjects and the exercise of such rights;
iii) awareness of controllers and processors of their responsibilities under this Convention;
specific attention shall be given to the data protection rights of children and other vulnerable individuals.
3. The competent supervisory authorities shall be consulted on proposals for any legislative or administrative measures which provide for the processing of personal data.
4. Each competent supervisory authority shall deal with requests and complaints lodged by data subjects concerning their data protection rights and shall keep data subjects informed of progress.
5. The supervisory authorities shall act with complete independence and impartiality in performing their duties and exercising their powers and in doing so shall neither seek nor accept instructions.
6. Each Party shall ensure that the supervisory authorities are provided with the resources necessary for the effective performance of their functions and exercise of their powers.
7. Each supervisory authority shall prepare and publish a periodical report outlining its activities.
8. Members and staff of the supervisory authorities shall be bound by obligations of confidentiality with regard to confidential information to which they have access, or have had access to, in the performance of their duties and exercise of their powers.
9. Decisions of the supervisory authorities may be subject to appeal through the courts.
10. The supervisory authorities shall not be competent with respect to processing carried out by bodies when acting in their judicial capacity.”
1. Chapters IV to VII of the Convention shall be renumbered to Chapters V to VIII of the Convention.
2. The title of Chapter V shall be replaced by „Chapter V – Co-operation and mutual assistance”.
3. A new Article 17 shall be added, and former Articles 13 to 27 of the Convention shall become Articles 16 to 31 of the Convention.
1. The title of Article 13 of the Convention (new Article 16) shall be replaced by the following:
2. Paragraph 1 of Article 13 of the Convention (new Article 16) shall be replaced by the following:
„1. The Parties agree to co-operate and render each other mutual assistance in order to implement this Convention.”
3. Paragraph 2 of Article 13 of the Convention (new Article 16) shall be replaced by the following:
„2. For that purpose:
a) each Party shall designate one or more supervisory authorities within the meaning of Article 15 of this Convention, the name and address of each of which it shall communicate to the Secretary General of the Council of Europe;
b) each Party which has designated more than one supervisory authority shall specify the competence of each authority in its communication referred to in the previous littera.”
4. Paragraph 3 of Article 13 of the Convention (new Article 16) shall be deleted.
A new Article 17 shall be added after the new Article 16 of the Convention as follows:
1. The supervisory authorities shall co-operate with one another to the extent necessary for the performance of their duties and exercise of their powers, in particular by:
a) providing mutual assistance by exchanging relevant and useful information and co-operating with each other under the condition that, as regards the protection of personal data, all the rules and safeguards of this Convention are complied with;
b) co-ordinating their investigations or interventions, or conducting joint actions;
c) providing information and documentation on their law and administrative practice relating to data protection.
2. The information referred to in paragraph 1 shall not include personal data undergoing processing unless such data are essential for co-operation, or where the data subject concerned has given explicit, specific, free and informed consent to its provision.
3. In order to organise their co-operation and to perform the duties set out in the preceding paragraphs, the supervisory authorities of the Parties shall form a network.”
1. The title of Article 14 of the Convention (new Article 18) shall be replaced by the following:
2. The text of Article 14 of the Convention (new Article 18) shall be replaced by the following:
„1 Each Party shall assist any data subject, whatever his or her nationality or residence, to exercise his or her rights under Article 9 of this Convention.
2. Where a data subject resides on the territory of another Party, he or she shall be given the option of submitting the request through the intermediary of the supervisory authority designated by that Party.
3. The request for assistance shall contain all the necessary particulars, relating inter alia to:
a) the name, address and any other relevant particulars identifying the data subject making the request;
b) the processing to which the request pertains, or its controller;
c) the purpose of the request.”
1. The title of Article 15 of the Convention (new Article 19) shall be replaced by the following:
2. The text of Article 15 of the Convention (new Article 19) shall be replaced by the following:
„1. A supervisory authority which has received information from another supervisory authority, either accompanying a request or in reply to its own request, shall not use that information for purposes other than those specified in the request.
2. In no case may a supervisory authority be allowed to make a request on behalf of a data subject of its own accord and without the express approval of the data subject concerned.”
1. The title of Article 16 of the Convention (new Article 20) shall be replaced by the following:
2. The recital of Article 16 of the Convention (new Article 20) shall be replaced by the following:
„A supervisory authority to which a request is addressed under Article 17 of this Convention may not refuse to comply with it unless:”
3. Littera a) of Article 16 of the Convention (new Article 20) shall be replaced by the following:
„a) the request is not compatible with its powers.”
4. Littera c) of Article 16 of the Convention (new Article 20) shall be replaced by the following:
„c) compliance with the request would be incompatible with the sovereignty, national security or public order of the Party by which it was designated, or with the rights and fundamental freedoms of individuals under the jurisdiction of that Party.”
1. The title of Article 17 of the Convention (new Article 21) shall be replaced by the following:
2. Paragraph 1 of Article 17 of the Convention (new Article 21) shall be replaced by the following:
„1. Co-operation and mutual assistance which the Parties render each other under Article 17 and assistance they render to data subjects under Articles 9 and 18 shall not give rise to the payment of any costs or fees other than those incurred for experts and interpreters. The latter costs or fees shall be borne by the Party making the request.”
3. The terms „his or her” shall replace „his” in paragraph 2 of Article 17 of the Convention (new Article 21).
The title of Chapter V of the Convention (new Chapter VI) shall be replaced by the following:
1. The terms „Consultative Committee” in paragraph 1 of Article 18 of the Convention (new Article 22) shall be replaced by „Convention Committee”.
2. Paragraph 3 of Article 18 of the Convention (new Article 22) shall be replaced by the following:
„3. The Convention Committee may, by a decision taken by a majority of two-thirds of the representatives of the Parties, invite an observer to be represented at its meetings.”
3. A new paragraph 4 shall be added after paragraph 3 of Article 18 of the Convention (new Article 22):
„4. Any Party which is not a member of the Council of Europe shall contribute to the funding of the activities of the Convention Committee according to the modalities established by the Committee of Ministers in agreement with that Party.”
1. The terms „Consultative Committee” in the recital of Article 19 of the Convention (new Article 23) shall be replaced by „Convention Committee”.
2. The term „proposals” in littera a) of Article 19 of the Convention (new Article 23) shall be replaced with the term „recommendations”.
3. References to „Article 21” in littera b) and „Article 21 paragraph 3” in littera c) of Article 19 of the Convention (new Article 23) shall be replaced respectively by references to „Article 25” and „Article 25, paragraph 3”.
4. Littera d) of Article 19 of the Convention (new Article 23) shall be replaced by the following:
„d) may express an opinion on any question concerning the interpretation or application of this Convention;”.
5. The following additional litterae shall be added following littera d) of Article 19 of the Convention (new Article 23):
„e) shall prepare, before any new accession to the Convention, an opinion for the Committee of Ministers relating to the level of personal data protection of the candidate for accession and, where necessary, recommend measures to take to reach compliance with the provisions of this Convention;
f) may, at the request of a State or an international organisation, evaluate whether the level of personal data protection the former provides is in compliance with the provisions of this Convention and, where necessary, recommend measures to be taken in order to reach such compliance;
g) may develop or approve models of standardised safeguards referred to in Article 14;
h) shall review the implementation of this Convention by the Parties and recommend measures to be taken in the case where a Party is not in compliance with this Convention;
i) shall facilitate, where necessary, the friendly settlement of all difficulties related to the application of this Convention.”
The text of Article 20 of the Convention (new Article 24) shall be replaced by the following:
„1. The Convention Committee shall be convened by the Secretary General of the Council of Europe. Its first meeting shall be held within twelve months of the entry into force of this Convention. It shall subsequently meet at least once a year, and in any case when one-third of the representatives of the Parties request its convocation.
2. After each of its meetings, the Convention Committee shall submit to the Committee of Ministers of the Council of Europe a report on its work and on the functioning of this Convention.
3. The voting arrangements in the Convention Committee are laid down in the elements for the rules of procedure appended to Protocol CETS No. 223.
4. The Convention Committee shall draw up the other elements of its rules of procedure and establish, in particular, the procedures for evaluation and review referred to in Article 4, paragraph 3, and Article 23, litterae e), f) and h) on the basis of objective criteria.”
1. Paragraphs 1 to 4 of Article 21 of the Convention (new Article 25) shall be replaced by the following:
„1. Amendments to this Convention may be proposed by a Party, the Committee of Ministers of the Council of Europe or the Convention Committee.
2. Any proposal for amendment shall be communicated by the Secretary General of the Council of Europe to the Parties to this Convention, to the other member States of the Council of Europe, to the European Union and to every non-member State or international organisation which has been invited to accede to this Convention in accordance with the provisions of Article 27.
3. Moreover, any amendment proposed by a Party or the Committee of Ministers shall be communicated to the Convention Committee, which shall submit to the Committee of Ministers its opinion on that proposed amendment.
4. The Committee of Ministers shall consider the proposed amendment and any opinion submitted by the Convention Committee, and may approve the amendment.”
2. An additional paragraph 7 shall be added after paragraph 6 of Article 21 of the Convention (new Article 25) as follows:
„7. Moreover, the Committee of Ministers may, after consulting the Convention Committee, unanimously decide that a particular amendment shall enter into force at the expiration of a period of three years from the date on which it has been opened to acceptance, unless a Party notifies the Secretary General of the Council of Europe of an objection to its entry into force. If such an objection is notified, the amendment shall enter into force on the first day of the month following the date on which the Party to this Convention which has notified the objection has deposited its instrument of acceptance with the Secretary General of the Council of Europe.”
1. Paragraph 1 of Article 22 of the Convention (new Article 26) shall be replaced by the following:
„1. This Convention shall be open for signature by the member States of the Council of Europe and by the European Union. It is subject to ratification, acceptance or approval. Instruments of ratification, acceptance or approval shall be deposited with the Secretary General of the Council of Europe.”
2. The terms „member State” in paragraph 3 of Article 22 of the Convention (new Article 26) shall be replaced by „Party”.
The title and the text of Article 23 of the Convention (new Article 27) shall be replaced as follows:
1. After the entry into force of this Convention, the Committee of Ministers of the Council of Europe may, after consulting the Parties to this Convention and obtaining their unanimous agreement, and in light of the opinion prepared by the Convention Committee in accordance with Article 23.e, invite any State not a member of the Council of Europe or an international organisation to accede to this Convention by a decision taken by the majority provided for in Article 20.d of the Statute of the Council of Europe and by the unanimous vote of the representatives of the Contracting States entitled to sit on the Committee of Ministers.
2. In respect of any State or international organisation acceding to this Convention according to paragraph 1 above, the Convention shall enter into force on the first day of the month following the expiration of a period of three months after the date of deposit of the instrument of accession with the Secretary General of the Council of Europe.”
Paragraphs 1 and 2 of Article 24 of the Convention (new Article 28) shall be replaced by the following:
„1. Any State, the European Union or other international organisation may, at the time of signature or when depositing its instrument of ratification, acceptance, approval or accession, specify the territory or territories to which this Convention shall apply.
2. Any State, the European Union or other international organisation may, at any later date, by a declaration addressed to the Secretary General of the Council of Europe, extend the application of this Convention to any other territory specified in the declaration. In respect of such territory the Convention shall enter into force on the first day of the month following the expiration of a period of three months after the date of receipt of such declaration by the Secretary General.”
1. The term „State” in the recital of Article 27 of the Convention (new Article 31) shall be replaced by „Party”.
2. References to „Articles 22, 23 and 24” in littera c) shall be replaced by references to „Articles 26, 27 and 28”.
Signature, ratification and accession
1. This Protocol shall be open for signature by Contracting States to the Convention. It shall be subject to ratification, acceptance or approval. Instruments of ratification, acceptance or approval shall be deposited with the Secretary General of the Council of Europe.
2. After the opening for signature of this Protocol and before its entry into force, any other State shall express its consent to be bound by this Protocol by accession. It may not become a Party to the Convention without acceding simultaneously to this Protocol.
Entry into force
1. This Protocol shall enter into force on the first day of the month following the expiration of a period of three months after the date on which all Parties to the Convention have expressed their consent to be bound by the Protocol, in accordance with the provisions of paragraph 1 of Article 36.
2. In the event this Protocol has not entered into force in accordance with paragraph 1, following the expiry of a period of five years after the date on which it has been opened for signature, the Protocol shall enter into force in respect of those States which have expressed their consent to be bound by it in accordance with paragraph 1, provided that the Protocol has at least thirty-eight Parties. As between the Parties to the Protocol, all provisions of the amended Convention shall have effect immediately upon entry into force.
3. Pending the entry into force of this Protocol and without prejudice to the provisions regarding the entry into force and the accession by non-member States or international organisations, a Party to the Convention may, at the time of signature of this Protocol or at any later moment, declare that it will apply the provisions of this Protocol on a provisional basis. In such cases, the provisions of this Protocol shall apply only with respect to the other Parties to the Convention which have made a declaration to the same effect. Such a declaration shall take effect on the first day of the third month following the date of its receipt by the Secretary General of the Council of Europe.
4. From the date of entry into force of this Protocol, the Additional Protocol to the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, regarding supervisory authorities and transborder data flows (ETS No. 181) shall be repealed.
5. From the date of the entry into force of this Protocol, the amendments to the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, approved by the Committee of Ministers, in Strasbourg, on 15 June 1999, have lost their purpose.
Declarations related to the Convention
From the date of entry into force of this Protocol, with respect to a Party having entered one or more declarations in pursuance of Article 3 of the Convention, such declaration(s) will lapse.
Reservations
No reservation may be made to the provisions of this Protocol.
Notifications
The Secretary General of the Council of Europe shall notify the member States of the Council of Europe and any other Party to the Convention of:
a) any signature;
b) the deposit of any instrument of ratification, acceptance, approval or accession;
c) the date of entry into force of this Protocol in accordance with Article 37;
d) any other act, notification or communication relating to this Protocol.
In witness whereof the undersigned, being duly authorised thereto, have signed this Protocol.
Done at Strasbourg, this 10th day of October 2018, in English and in French, both texts being equally authentic, in a single copy which shall be deposited in the archives of the Council of Europe. The Secretary General of the Council of Europe shall transmit certified copies to each member State of the Council of Europe, to other Parties to the Convention and any State invited to accede to the Convention.
1. Each Party has a right to vote and shall have one vote.
2. A two-thirds majority of representatives of the Parties shall constitute a quorum for the meetings of the Convention Committee. In case the amending Protocol to the Convention enters into force in accordance with its Article 37 (2) before its entry into force in respect of all Contracting States to the Convention, the quorum for the meetings of the Convention Committee shall be no less than 34 Parties to the Protocol.
3. The decisions under Article 23 shall be taken by a four-fifths majority. The decisions pursuant to Article 23, littera h), shall be taken by a four-fifths majority, including a majority of the votes of States Parties not members of a regional integration organisation that is a Party to the Convention.
4. Where the Convention Committee takes decisions pursuant to Article 23, littera h), the Party concerned by the review shall not vote. Whenever such a decision concerns a matter falling within the competence of a regional integration organisation, neither the organisation nor its member States shall vote.
5. Decisions concerning procedural issues shall be taken by a simple majority.
6. Regional integration organisations, in matters within their competence, may exercise their right to vote in the Convention Committee, with a number of votes equal to the number of their member States that are Parties to the Convention. Such an organisation shall not exercise its right to vote if any of its member States exercises its right.
7. In case of vote, all Parties must be informed of the subject and time for the vote, as well as whether the vote will be exercised by the Parties individually or by a regional integration organisation on behalf of its member States.
8. The Convention Committee may further amend its rules of procedure by a two-thirds majority, except for the voting arrangements which may only be amended by unanimous vote of the Parties and to which Article 25 of the Convention applies.
