Data Protection Convention Research Articles

Protecting the patient’s data in the 21st century healthcare industry: Is the African continent ready for the digital space?

To ensure proper healthcare services and automation, including minimising medical errors and providing faster and more efficient healthcare, the medical field is experiencing innovative technological trends. They include automated patient records, hospital management system software, telemedicine, and the use of artificial intelligence devices. These innovations exist in more than just the global north, as they are slowly finding residence in African countries. Focusing on automated patient record, the article examines existing data protection legal frameworks in Africa to ascertain whether they provide effective remedy mechanisms patients can access should a breach occur. Taking cognisance of the current African Continental Free Trade Area Agreement (AfCFTA) aimed at creating a single market for goods and services; it is evident that healthcare services might have a continental approach. Thus, the article adopts a continental, regional, and national perspective. Using doctrinal method, the article compares the African Union Data Protection Convention with the European Union General Data Protection Regulation to draw lessons from the European Union Experience. The article finds that strengthened national mechanisms might provide the requisite remedy mechanisms patients can access to ensure enforcement of their rights to data protection.

The UK and the EU personal data framework after Brexit: A new trade and cooperation partnership grounded in Council of Europe Convention 108+?

The EU-UK post-Brexit agreements provide for the UK to have the closest relationship on personal data with the EU outside of the European Economic Area (EEA) and Switzerland. In the area of justice and security, the Trade and Cooperation Agreement itself provides for very extensive data exchange including DNA and fingerprints and is complemented by the first ever mutual adequacy agreement within the area of law enforcement. In some contrast, the general area of data protection is underpinned only by mutual adequacy. Whilst mandating “essentially equivalent” (GDPR, recital 104) protection, significant flexibilities may be retained. Bona fide implementation of the Council of Europe's Data Protection Convention 108+ could provide a good lodestar for a more graduated regime which also seeks to clearly reconcile data protection with competing rights. The article tentatively examines what that might entail for the data protection's core substance including the proactive transparency rules, sensitive data regime, integrity provisions and specific restrictions. Any such reform would require great care and should not detract from the need for much more effective practical enforcement.

International and regional commitments in African data privacy laws: A comparative analysis

Thirty three of the 55 African countries have enacted data privacy laws since 2001. This paper analyses two types of potential legal influences on these national laws: standards and obligations originating from outside Africa (international); and those developed within Africa, both at the continental (African Union) level, and at the level of Regional Economic Communities (RECs).Analysis commences with which countries have laws or Bills, and constitutional requirements International influences are shown to be indirect, with only slight UN influences, but with accessions by African countries to data protection Convention 108 significant in converting it into a global Convention. EU influences are also indirect (aspirational) with both the DPD and the GDPR perceived as standards to be emulated in African instruments. Of African multilateral agreements, the African Union's data protection and cybercrime Convention (2014) is yet of limited influence because it is not in force. In contrast, the ECOWAS Supplementary Act (2010) has been of considerable practical influence in West Africa. The HIPPSA ‘Model Acts’ with higher standards (particularly SADC Model Law, 2013) remain of potential influence in other regions of sub-Saharan Africa.European instruments are presented as typifying ‘three generations’ of development of data privacy laws (exemplified by (i) Convention 108, 1980; (ii) EU DPD, 1995; and (iii) EU GDPR, 2016 plus Convention 108+, 2018). The three main African multilateral instruments (ECOWAS Act, AU Convention, SADC Model Law) are compared with them, as well as between themselves.These comparisons enable conclusions to be drawn, some of which are as follows.The African regional framework does not display any Africa-specific approach to data protection. Less individualist and more communitarian African culture or human rights discourse is absent from the texts of these laws.Drafters of the African instruments seem to accept, tacitly or expressly the necessity to be consistent with other international texts, in particular European instruments. They have adopted many ‘2nd generation’ DPD elements but have anticipated relatively few of the ‘third generation’ GDPR standards.Sub-regional agreements (ECOWAS Act and model laws) have provided a means to move forward despite the lack of progress in bring the regional AU convention into force.

The UK and the EU Personal Data Framework After Brexit: Another Switzerland?

The UK-EU Trade and Cooperation Agreement sets out a pathway for the UK to have the closest relationship on personal data with the EU outside of the European Economic Area (EEA) and Switzerland. This is principally apparent in the area of justice and security where there is very extensive provision for data exchange including DNA and fingerprints. This exchange rests on specified common standards and will likely be complemented by the first ever EU adequacy agreement under the Law Enforcement Directive. In some contrast, understandings in the general area of data protection (at least outside direct marketing) point only to mutual adequacy. Whilst mandating “essentially equivalent” (GDPR, recital 104) protection, significant flexibility is retained. Given the UK’s distinct approach to data protection, the EU may find that it adopts a more divergent approach in the medium term than, for example, Switzerland. Bona fide implementation of the Council of Europe’s Data Protection Convention 108+ may provide a good lodestar for a more graduated regime which also seeks to clearly reconcile data protection with competing rights. The paper tentatively examines what that might entail for the proactive transparency rules, sensitive data regime, integrity provisions and specific restrictions. Any such reform would require great care and should not detract from the need for much more effective practical enforcement.

The ‘right to be forgotten’ beyond the EU: an analysis of wider G20 regulatory action and potential next steps

ABSTRACT It has been increasingly asserted that data protection can and should enable individuals to exert some control at least ex post over online data dissemination. Notwithstanding contrary suggestions, therefore, the ‘right to be forgotten’ is not solely an EU phenomenon. Post-2014 the majority of the eight national Data Protection Authorities (DPAs) s operating in non-EU G20 jurisdictions with established data protection legislation have sought to implement such a right through guidance and, in three cases, also enforcement. These jurisdictions span three regions and encompass jurisdictions such as Australia and Canada with a similar outlook to the EU. In light of the profoundly globalised nature of the internet, greater transnational coordination would be valuable. Whilst the G20 is itself ill-suited to this task, the pan-regional Data Protection Convention framework overseen by the Council of Europe as well as the Global Privacy Assembly could play an important role.

Assessing UK Data Protection Reform in Transnational Context: What New Direction?

This paper analyses the post-Brexit reforms to UK data protection put forward in Data: A New Direction. It is found that they are wide-ranging and significant but generally not radical. The great bulk of the proposed substantive changes to data protection (although not the most far-reaching suggestions concerning either e-privacy or automated decision-making) could be plausibly justified under the restrictions regime set out in the General Data Protection Regulation (GDPR). The reforms to the integrity duties would be deeper and pose some risk of reducing ʻaccountabilityʼ to formalistic theatre even when high risk processing is underway. Nevertheless, in principle their basic structure remains compatible with Data Protection Convention 108+ (DPC+). Proposals to shift the ICO away from a de jure focus on upholding data protection rights are difficult to square even with the DPC+. De facto the ICO is not acting as an effective enforcer of data subject rights even today, but these proposals would entrench and further this troubling reality. This points to a critical problem with the initiative, namely, its lack of balance vis-a-vis the interests of the data subject. A reform package which sought to marry more robust and accountable enforcement for individuals with some liberalisation of the substance and process of data protection would offer a better way forward.

Giving ‘teeth’ to the African Union towards advancing compliance with data privacy norms

ABSTRACT That international organizations have always played a pivotal role in the development and advancement of data privacy norms is now beyond doubt. With regard to advancing compliance specifically, the role of international organizations cannot be overemphasized. Although data privacy is no longer new to Africa, compliance with data privacy norms has been significantly lower compared to other jurisdictions. A (possible) explanation for this is that the primary regional organization on the continent – the African (AU) – has played an insignificant role in this regard. Related to this explanation is the usual contention that the absence of a settled normative standard is a reason for the low level of compliance. Since there is now a continental data privacy standard in Africa - the AU Data Protection Convention - the question remains why is compliance still low. Therefore, using insights from the normative and institutional theories of state compliance with international norms, the article examines why there is still a low compliance rate. The article then suggests how to strengthen the AU towards advancing compliance with data privacy norms on the continent.

The ʻRight to be Forgottenʼ beyond the EU: An Analysis of Wider G20 Regulatory Action and Potential Next Steps

It has been increasingly asserted that data protection can and should enable individuals to exert a degree of control at least ex post over the online dissemination of their personal data. This paper demonstrates that, notwithstanding contrary suggestions in the literature, a concern to implement such a right to be forgotten extends well beyond the EU. Indeed, post-2014 the majority of the eight national DPAs operating in non-EU G20 jurisdictions with established data protection legislation have sought to implement this right through guidance and, in three cases, also enforcement. Whilst not as extensive as the number of countries with statutory supports for such a right, these jurisdictions span three regions and encompass jurisdictions such as Australia and Canada with a similar outlook to the EU. In light of the profoundly globalised nature of the internet, it is suggested that the EU could fruitfully promote greater transnational coordination of this issue. Whilst the G20 is itself ill-suited to this task, the pan-regional Data Protection Convention framework overseen by the Council of Europe as well as the Global Privacy Assembly could play a valuable role here.

The ‘Strasbourg Effect’ on data protection in light of the ‘Brussels Effect’: Logic, mechanics and prospects

This article considers various factors that will shape the potential effect of the Council of Europe's modernised Convention on data protection (Convention 108+) on non-European states’ regulatory policy. It does so by elucidating the logic and mechanics of this effect in light of the ‘Brussels Effect’ that is commonly attributed, in part, to EU data protection law. The central arguments advanced in the article are that the impact of Convention 108+ beyond Europe will rest primarily on the Council of Europe's ideational power tempered by processes of acculturation, and secondarily on the degree to which the EU is willing to use the ‘Brussels Effect’ as a vehicle for promoting non-European states’ accession to the Convention.

Implementing Convention 108+: Observers and NGO contributions

The Consultative Committee of data protection Convention 108 has among its accredited Observers five non-government organisations (NGOs) with strong interests in data privacy. This article considers how such NGO Observers can contribute to Convention 108+, the ‘modernised’ and strengthened version of the Convention now undergoing ratification by parties to the existing Convention, and considers whether the roles proposed for 108+ involvement by NGO Observers are satisfactory, or whether they need to be strengthened. It concludes NGOs have good reasons for wanting 108+ to maintain high standards, and to advocate for that. It is easy to say in theory, but will they have the opportunity in practice? Four distinct reasons for NGO Observer interest are identified. The involvement of three NGOs in the Consultative Committee’s deliberations on the accession and periodic follow-up evaluation mechanisms is shown to have resulted in improvements to an already very strong set of evaluation criteria. From an NGO perspective, these Council of Europe processes are significantly more transparent, participatory and responsive, than those adopted by APEC (Privacy Framework and Cross-border Privacy Rules system), the OECD (Privacy Guidelines) and European Union (‘adequacy’ under the GDPR).

The ‘Strasbourg Effect’ in Data Protection: Its Logic, Mechanics and Prospects in Light of the ‘Brussels Effect’

This article considers various factors that will shape the potential effect of the Council of Europe’s modernised Convention on data protection (Convention 108+) on non-European states’ regulatory policy. It does so by elucidating the logic and mechanics of this effect in light of the ‘Brussels Effect’ that is commonly attributed, in part, to EU data protection law. The central arguments advanced in the article are that the impact of Convention 108+ beyond Europe will rest primarily on the Council of Europe’s ideational power tempered by processes of acculturation, and secondarily on the degree to which the EU is willing to use the ‘Brussels Effect’ as a vehicle for promoting non-European states’ accession to the Convention.

PERLINDUNGAN DATA PRIBADI SEBAGAI BAGIAN DARI HAK ASASI MANUSIA ATAS PERLINDUNGAN DIRI PRIBADI

Protection of personal data as closely related to the protection of personal and private rights. Indonesia does not yet have legislation that specifically regulates the protection of personal data. then the problem that the author raises is: the comparison of the right to personal protection as part of human rights in Indonesia with the constitution in other countries and the concept of comparing the protection of personal data as a manifestation of the human rights of personal protection in Indonesia and other countries. related to the protection of personal rights in Indonesia is a state constitutional obligation regulated in the 1945 Constitution of the Republic of Indonesia Article 28G Paragraph (1). The constitutions of other countries such as in several Asian, African, and European countries as mentioned above have explicitly regulated and mentioned the protection of guarantees and personal rights or privacy rights of their citizens. while in Indonesia such as Saudi Arabia and Madagascar it does not explicitly mention anything about the right of privacy in their constitution. it can be concluded that the concept of personal data protection can be found in international and regional instruments such as the European Union Data Protection Directive, the European Union Data Protection Convention, and the OECD Guidelines.

Comparing African Data Privacy Laws: International, African and Regional Commitments

Since 2001, 32 of the 55 African countries have enacted data privacy laws, over 20% of all countries with such laws. This article commences with an analysis of which countries have these laws, which have Bills, and which have neither. The extent to which their constitutions require protection of data privacy is also assessed. We suggest that this legislation is not characterized by distinctively African elements, but is more a product of urbanization and globalization. The article focuses on two types of influences on these national laws: standards and obligations originating from outside Africa (international); and those developed within Africa, both at the continental (AU) level, and at the level of Regional Economic Communities (RECs). International influences on African data privacy legislation is indirect. UN influences are as yet slight, but Africa is playing a significant role in the conversion of data protection Convention 108 from a European into a global Convention. The influences of the EU’s data protection Directive (DPD, 1995) and Regulation (GDPR, 2016) are also indirect (aspirational), because no African countries have been assessed as providing ‘adequate protections’ under either instrument. Of potentially great importance is the 2014 adoption of the African Union Convention on Cyber-security and Personal Data Protection (‘Malabo Convention’), but it has only yet only received a third of the necessary ratifications. Of other Africa-wide developments, formation of the African DPA Network of eleven national data protection authorities is important. Of more practical effect have been data privacy agreements and model laws in Regional Economic Communities (RECs). The most mature development as yet, and the earliest, has been from the Economic Community of West African States (ECOWAS), which has had eleven of fifteen member enact legislation in compliance with its 2010 Supplementary Act, Africa’s only binding data protection agreement yet in force, and was influenced strongly by the EU DPD (1995). Following the ECOWAS ‘pilot’, the ITU’s EU-funded HIPPSA project assisted in the development of ‘model laws’ (or similar) in all of the other RECs in Sub-Saharan Africa (SADC, EAC, ECCAS and CEMAC), with improvements on the ECOWAS standards. The three main African instruments (AU Convention, ECOWAS Act, SADC Model Law) are compared with the European instruments typifying the ‘three generations’ of development of data privacy laws (Convention 108, 1980; EU DPD, 1995; and EU GDPR, 2016 and Convention 108+). Conclusions are drawn on the extent to which the three African instruments require, on average, that national laws should include the standards of each of these three generations of international instruments. The article concludes with observations about the consistency of the African instruments. The following article in this series will compare the standards embodied in each of the 32 national laws, taking the same ‘three generation’ approach.

How far can Convention 108+ ‘globalise’? Prospects for Asian accessions

The ‘globalisation’ of Council of Europe data protection Convention 108 through non-European accessions has continued steadily, with eight such accessions since the first in 2013. The ‘modernisation’ of the Convention was completed on 10 October 2018 when the amending protocol for the new ‘Convention 108+’ became open for signature. Any new countries from outside Europe wishing to accede will have to accede to both Convention 108 and the amending Protocol (ie to 108+). The standards required of the laws of acceding countries by 108+ are higher than those required by 108, and are arguably mid-way between 108 and those of the European Union's General Data Protection Regulation (GDPR).This article examines to what extent each of the 26 ‘countries’ (separate jurisdictions) in Asia are likely to be able to accede to 108+, if they wish to. As yet, none have acceded to 108. It proposes an efficient way to consider such a question across such a complex set of jurisdictions. Fifteen of the 26 Asian countries already have data privacy laws, and two others have official Bills for such laws. An assessment of the prospects for accession can be done by considering in order the following grounds which may be impediments to accession: Jurisdictions which are not States; States which are not democratic; Laws of inadequate scope; Laws lacking an independent data protection authority; Laws with substantive provisions falling short of 108+ ‘accession standards’; States with proposed Bills only; and States with no relevant laws or proposed Bills.The most difficult step in this procedure is in deciding which of the substantive provisions of 108+ constitute its ‘accession standards’, or elements essential for accession to be invited. Neither the Convention, nor the guidelines issued by its Consultative Committee, shed much light on this question. However, previous practice under Convention 108, show there is some flexibility involved.The article concludes with suggestions as to how such flexibility can be made more transparent, and observations on which Asian countries, in light of the seven step assessment carried out in the article, are the most likely candidates to be able to accede to 108+, in both the short and medium terms.

How Far Can Convention 108+ ‘Globalise’?: Prospects for Asian Accessions

The ‘globalisation’ of Council of Europe data protection Convention 108 through non-European accessions has continued steadily, with eight such accessions since the first in 2013. The ‘modernisation’ of the Convention was completed on 10 October 2018 when the amending protocol for the new ‘Convention 108+’ became open for signature. Any new countries from outside Europe wishing to accede will have to accede to both Convention 108 and the amending Protocol (ie to 108+). The standards required of the laws of acceding countries by 108+ are higher than those required by 108, and are arguably mid-way between 108 and those of the European Union’s General Data Protection Regulation (GDPR). This article examines to what extent each of the 26 ‘countries’ (separate jurisdictions) in Asia are likely to be able to accede to 108+, if they wish to. As yet, none have acceded to 108. It proposes an efficient way to consider such a question across such a complex set of jurisdictions. Fifteen of the 26 Asian countries already have data privacy laws, and two others have official Bills for such laws. An assessment of the prospects for accession can be done by considering in order the following grounds which may be impediments to accession: Jurisdictions which are not States; States which are not democratic; Laws of inadequate scope; Laws lacking an independent data protection authority; Laws with substantive provisions falling short of 108+ ‘accession standards’; States with proposed Bills only; and States with no relevant laws or proposed Bills. The most difficult step in this procedure is in deciding which of the substantive provisions of 108+ constitute its ‘accession standards’, or elements essential for accession to be invited. Neither the Convention, nor the guidelines issued by its Consultative Committee, shed much light on this question. However, previous practice under Convention 108, show there is some flexibility involved. The article concludes with suggestions as to how such flexibility can be made more transparent, and observations on which Asian countries, in light of the seven step assessment carried out in the article, are the most likely candidates to be able to accede to 108+, in both the short and medium terms.

NGO Involvement in the Evaluation and Follow-Up Mechanisms for Data Protection Convention 108+ (Submission to the Consultative Committee of Data Protection Convention 108 by the Australian Privacy Foundation (APF), the Electronic Privacy Information Center (EPIC) and Privacy International (PI))

Three NGOs specialising in privacy issues, the Australian Privacy Foundation (APF), the Electronic Privacy Information Centre (EPIC) from the US, and the UK-based Privacy International, have made a joint submission to the Consultative Committee of data protection Convention 108, concerning the proposed Evaluation and Follow-Up Mechanism for the new 'modernised' version of the Convention (usually called 'Convention 108+). The submission give strong support to the comprehensive and valuable recommendations contained in the proposals, and suggests expanded NGO involvement in the proposed evaluation and follow-up mechanisms. In particular, the Submission proposes involvement of NGO nominees in Working Groups of the new Convention Committee, for the additional perspectives they can bring. Among fourteen s suggestions, others concern transparency of processes, the order of evaluation of Convention Parties, the evaluation criteria, and participation in Committee discussions of particular evaluations. The Evaluation and Follow-Up Mechanism will be discussed at the Consultative Committee's next Plenary Meeting in Strasbourg in November 2019.

Asia-Pacific Free Trade Deals Clash with GDPR and Convention 108

Two distinct worlds of international agreements – concerning free trade and data protection – are now colliding due to provisions which may impose incompatible obligations on parties to both types of agreements. On the one hand, new Asia-Pacific free trade agreements (FTAs) include strict limits on how legislation can restrict personal data exports or require data localisation. On the other hand, the EU’s GDPR, and Convention 108/108+ require countries’ laws to impose restrictions on data exports if those countries wish to be held to provide ‘adequate’ protection, or to accede to the Convention. Mexico and Japan are the first countries where a clash of these obligations requires resolution, but similar clashes may soon arise in relation to Canada, New Zealand, and potentially other countries. This article explains how and where these conflicts are arising. The Comprehensive and Progressive Agreement for Trans-Pacific Partnership (CPTPP – the ‘new TPP’) comes into force on 30 December 2018 because six of the eleven signatories (Mexico, Canada, Japan, New Zealand, Australia and Singapore) have ratified it and deposited their agreements (only four were needed). It comes into force between ratifying parties. CPTPP’s implications for privacy legislation are primarily that (i) it imposes an onerous Four-Step-Test’ for any exceptions to its prohibition on data export limitations. There are similar data localisation prohibitions. State party dispute settlement provisions can result in a panel awarding monetary assessments against a party, and in some limited situations Investor-state dispute settlement (ISDS) provisions could apply. The United States – Mexico – Canada Agreement (USMCA – the ‘new NAFTA’) was agreed to on 1 October 2018, but is yet to be ratified and come into force. The test for data export restriction limitations, although using different words, is in substance the same as in the CPTPP. ‘Data localisation’ by requiring local processing is prohibited, and there are no exceptions, unlike the CPTPP. The requirements of both the CPTPP and the USMCA require careful consideration by any of their Parties who are already Parties to Council of Europe data protection Convention 108 and its 2001 additional Protocol, or intending to accede to Convention 108+, or have obtained an adequacy decision by the EU or are attempting to obtain one under the GDPR. This article considers the position of Mexico, due to its accession to Convention 108 on 1 October 2018, its ratification of CPTPP, and potential ratification of USMCA. It also considers the position of Japan, due to it being about to obtain a positive ‘adequacy’ assessment under the GDPR from the EU, and its ratification of the CPTPP. Canada is in a similar position, and other countries may become so. When worlds collide, the results are unpredictable.

Global Convergence of Data Privacy Standards and Laws: Speaking Notes for the European Commission Events on the Launch of the General Data Protection Regulation (GDPR) in Brussels & New Delhi, 25 May 2018

The presentation covered the following six aspects of the relationship between new data protection standards such as the General Data Protection Regulation (GDPR) and what is being enacted in the rest of the world. (1) The global diffusion of data privacy laws since 1970, seen through five key facts: (i) 126 countries (as at June 2018) now have data privacy laws which at least meet the ten minimum standards set by international agreements as early as 1980: (ii) 60% of these laws (75) are from outside Europe; (iii) 45 of the 126 laws have been enacted this decade, an average of 5 new laws per annum; (iv) At least 34 further countries have official Bills in the legislative process; and (v) Many countries (not only in the EU) are now enacting, or have already enacted, new laws to strengthen their original DP laws. Maps of the 126 laws and 34 Bills are included. (2) Global convergence on higher standards is occurring, not chaotic development. My estimate is that the average enactment of the distinctive new principles in the 1995 EU general data protection Directive, across all 75 non-European data privacy laws is at least 7/10 of those principles. Within European jurisdictions it is closer to 10/10. Data protection laws outside Europe already converge on more than ½ of the higher standards that have been required in Europe since the 1990s. (3) The GDPR is already influencing a higher level of legislative convergence. An incomplete study of over 30 countries outside Europe (in Africa, Asia and elsewhere), shows that six new ‘GDPR principles’ have been enacted by at least 10 countries, and all new GDPR principles by at least one. (4) ‘GDPR creep’, voluntary convergence by businesses where there is no legal obligation, is a new global phenomenon. (5) There is convergence on a global treaty, (Global) Data Protection Convention 108, which originated with the Council of Europe, but is being acceded to by non-European countries since 2011. It has also last week (18 May) been ‘modernised’ with new standards including many but not all of the GDPR’s new elements. ‘GDPR Lite’ may be the new global standard. (6) There are potential impediments to adoption of high global standards, First, countries may make commitments to regional agreements requiring lower standards, including to allow data exports, and then legislate to implement them. Second, Free Trade Agreements may place stronger prohibitions on personal data export restrictions than does the global GATS agreement, creating clashing standards.

The UN Should Adopt Data Protection Convention 108 as a Global Treaty: Submission on The Right to Privacy in the Digital Agee to the UN High Commissioner for Human Rights, to the Human Rights Council, and to the Special Rapporteur on the Right to Privacy

The UN High Commissioner for Human Rights has invited submissions on ‘the right to privacy in the digital age’. This submission argues that: (i) Data privacy laws have been enacted globally (now by 124 countries), with average standards closer to the higher ‘European’ (2nd generation) standards than to the lower OECD (1st generation) standards. (ii) Data protection Convention 108 is an open convention, to which any country can apply to accede, not only European countries. Such ‘globalisation’ of Convention 108 has been actively encouraged by the Council of Europe since 2010, with positive results, and 56 UN members will soon be parties to it. It is the only global data protection convention that has any practical prospects of being developed and adopted. (iii) The single best and most effective strategy that the United Nations can adopt to strengthen ‘national legislative and regulatory frameworks concerning the collection, processing, retention or use of personal data’ (as the call for submissions puts it), is to develop a package of measures to align UN policies with data protection Convention 108. Seven specific measures are recommended to create such an alignment.

Balancing Globalisation's Benefits and Commitments: Accession to Data Protection Convention 108 by Countries Outside Europe

The ‘globalisation’ of Council of Europe data protection Convention 108 beyond its European origins has been underway since the start of this decade, when the first non-European accession (by Uruguay) was assessed and approved. The global nature of this process was demonstrated by the completion of the second non-European accession with Mauritius’ deposit of its instrument of accession in a ceremony at today’s Conference. Four other non-European countries are now at various stages of the accession process, and there is increasing interest from other countries (by both governments and NGOs), exemplified by participants in today’s conference from 16 countries outside the Council of Europe, and from many international organisations.This presentation first sets the global context of Convention 108’s ‘globalisation: 111 countries now with data privacy laws, and the majority (57/54) from outside Europe. By 2011 the data privacy Acts outside Europe included on average about 7/10 of the higher ‘European standards’, and this has continued in the last five years. The number of potential Convention 108 ‘candidates’ for accession has yet to be assessed, but the potential for greater ‘globalisation’ is clear.The presentation then sets out 13 benefits that countries outside Europe can obtain from accession to Convention 108: (i) realistic prospects; (ii) no realistic alternative; (iii) voluntary obligations; (iv) international ‘best practice’ recognition; (v) reciprocal data exports; (vi) moderate standards; (vii) minimum standards; (viii) a ‘whitelist’ substitute; (ix) ‘adequacy’ assistance; (x) development assistance; (xi) business benefits with exports and imports; (xii) individual benefits from minimum protections; and (xiii) assistance to international organisations. The significance of these potential benefits, or potential disadvantages, will vary between countries. For each country, they require a balanced assessment of the interests of that country and its government, of businesses operating within it, and of its citizens and residents.The ‘Convention bodies’ (Consultative Committee (T-PD), Secretariat and Committee of Ministers) have significant responsibilities to help ensure that Parties are only required to export their citizens’ data to other countries which have sufficiently high standards of data protection, and their enforcement. However, the current Convention 108 does not explicitly recognise these responsibilities, and the current practice of the ‘Convention bodies’ does not make it transparent enough that they are being carried out. This should be improved.Compared with Europeans, citizens of non-European states that accede to the Convention are at a disadvantage in lacking means under international law to enforce the Convention. The UN Special Rapporteur on the Right to Privacy may be able to help make UN instruments relevant to privacy more able to be used for this purpose.The presentation concludes that the expansion of Convention 108 has implications for every country, and it is good policy for each country to be well-informed and consider carefully the potential benefits of accession.