Convention 108
Convention 108 was opened for signature on 28 January 1981 by the Council of Europe. It was the first legally binding international instrument in data protection and, unlike the OECD Guidelines, requires signatories to implement its principles in domestic law. Deliberately not called the 'European Convention', it is open to countries outside Europe. It has three main parts: substantive principles (Ch II), transborder flows (Ch III) and mutual assistance/consultation (Ch IV–V).
Convention 108 was opened for signature 28 January 1981. It consolidates the 1973 and 1974 resolutions and was the first legally binding international instrument on data protection. Crucially, unlike the OECD Guidelines, it requires signatories to take steps in domestic law to apply its principles. It is named to be open to countries outside Europe (Mauritius, Senegal and Uruguay among non-Council-of-Europe signatories).
| Feature | OECD Guidelines (1980) | Convention 108 (1981) |
|---|---|---|
| Binding? | Not legally binding | First legally binding international instrument |
| Domestic implementation | Optional / flexible | Required of signatories |
| Body | OECD | Council of Europe |
| Geographic reach | Beyond Europe (OECD members) | Open to non-European countries too |
| Origin | Drafted with Council of Europe & EC | Consolidates 1973/74 Council of Europe resolutions |
Chapter II (substantive law): data must be obtained and processed fairly and lawfully; stored for specified, legitimate purposes; adequate, relevant and not excessive; accurate and up to date; and kept identifiable for no longer than required. Appropriate security measures are required. Special categories of data (racial origin, political/religious beliefs, health, sexual life, criminal convictions) may not be processed automatically unless domestic law provides appropriate safeguards. Individuals have rights of communication, rectification and erasure. Exceptions are allowed only where a necessary measure in a democratic society.
Chapter III (transborder flows): Article 12 says signatories shall not prohibit or require special authorisation for transfers between Convention 108 parties, because each offers a minimum level of protection. The 2001 Additional Protocol then addressed transfers to non-signatories by importing the 'adequate' (rather than 'equivalent') level of protection from the 1995 Directive.
Chapter IV (mutual assistance): each party must designate a supervisory authority to oversee compliance, liaise with others and assist individuals. Convention 108 remains the only binding international instrument with worldwide scope open to any country; the 54th accession was Argentina on 25 February 2019.